Apptainer 1.1.0, a Linux Foundation project (formerly Singularity), Arrives With Added Security Features and Build Improvements
New features improve security by reducing attack surface while improving user experience
RENO, Nev., Sept. 27, 2022 /PRNewswire-PRWeb/ -- The Apptainer community today announced version 1.1.0 of the popular container system for secure, high-performance computing (HPC). Improvements in the new version provide a smaller attack surface for production deployments while offering features that improve and simplify the user experience. Apptainer continues the legacy of Singularity with backwards compatibility, stability, added security, performance and reproducibility.
*Rootless Container Runtime*
Version 1.1.0 of Apptainer delivers a smaller attack surface with the implementation of a fully rootless container runtime in that Apptainer no longer installs a setuid-root portion by default. Instead, common operations can now be executed with only unprivileged user namespaces. If a user installs from binary packages (EPEL packages coming soon), the setuid portion can be restored by installing the apptainer-suid package. Or, if users install from source, it can be included by compiling with the mconfig –with-suid option.
Improvements shipping as part of this new feature include:
- A squashfuse image driver that enables mounting SIF files without using setuid-root.
- A fuse2fs image driver that enables mounting EXT3 files and EXT3 SIF overlay partitions without using setuid-root.
- A persistent overlay option (--overlay) and --writable-tmpfs without using setuid-root. This requires unprivileged user namespaces and either a new enough kernel (>= 5.11) or the fuse-overlayfs command.
- The ability to change SIF file mounts to use squashfuse_ll instead of squashfuse for improved performance. For even better parallel performance, a patched multithreaded version of squashfuse_ll is included in rpm and debian packaging.
*Container Build Improvement*
Apptainer 1.1.0 is further enhanced by allowing users greater flexibility to set up containers without using root. The new version extends the --fakeroot option to make it useful when /etc/subuid and /etc/subgid mappings have not been configured on the host. When this is the case, a root-mapped unprivileged user namespace (the equivalent of unshare -r) and/or the fakeroot command from the host will be tried. Together, these emulate the same mappings and are simpler to administer. This feature is especially useful with the --overlay and --writable-tmpfs options and for building containers unprivileged, because they allow installing packages that assume they're running as root.
Complete release notes can be found at the Apptainer GitHub repository:
https://github.com/apptainer/apptainer/releases
*About Apptainer*
Apptainer is the Linux Foundation successor to the popular Singularity container runtime. Originally developed under the Singularity trademark, Apptainer is the most widely used container system for HPC. The open source project executes HPC applications at bare-metal performance while being secure, portable and 100% reproducible. More information about the changes in this release are available in this paper on arXiv.
CIQ is the primary support and services provider for the Apptainer project. CIQ is building the next generation of software infrastructure for enterprise and research organizations running compute and data-intensive workloads.
Apptainer is a trademark of The Apptainer Series of LF Projects LLC. More at https://lfprojects.org/policies.
###
Media Contact
Robert Cathey, Cathey Communications for CIQ, 865-386-6118, [email protected]
SOURCE Apptainer
Share this article