←back to thread

Apptainer: Application Containers for Linux

(apptainer.org)
105 points cl3misch | 1 comments | 26 Jun 25 09:45 UTC | HN request time: 0.203s | source
Show context
IshKebab ◴[26 Jun 25 10:42 UTC] No.44386057[source]▶
We tried to use this on our compute cluster for silicon design/verification. We gave up in the end and just went with the traditional TCL (now Lua) modules.

The problems are:

1. You can't have apptainers that use each other. The most common case was things like Make, GCC, Git etc. If Make is in a different apptainer to GCC then it won't work because as soon as you go into Make then it can't see GCC any more.

2. It doesn't work if any of your output artefacts depend on things inside the container. For example you use your GCC apptainer to compile a program. It appears to work, but when you run it you find it actually linked to something in the apptainer that isn't visible any more. This is also a problem for C headers.

3. We had constant issues with PATH getting messed up so you can't see things outside the apptainer that should have been available.

All in all it was a nice idea but ended up causing way more hassle than it was worth. It was much easier just to use an old OS (RHEL8) and get everything to work directly on that.

replies(5): >>44386967 #>>44387745 #>>44387848 #>>44389356 #>>44391642 #
mbreese ◴[26 Jun 25 12:54 UTC] No.44386967[source]▶
I think of using Apptainer/Singularity as more like Docker than anything else (without the full networking configs). These are all issues with traditional Docker containers as well, so I’m not sure how you were using the containers or what you were expecting.

For my workflows on HPC, I use apptainers as basically drop-in replacements for Docker, and for that, they work quite well. These biggest benefit is that the containers are unprivileged. This means you can’t do a lot of things (in particular complex networking), but it also makes it much more secure for multi-tenant systems (like HPC).

(I know Docker and Apptainer are slightly different beasts, but I’m speaking in broad strokes in a general sense without extra permissions).

replies(1): >>44390672 #
1. d3Xt3r ◴[26 Jun 25 19:54 UTC] No.44390672[source]▶
You can also run Docker itself in rootless mode[1]. And if for some reason you don't want to run Docker, you can also use Podman or Incus instead, and they both support Docker images, as well as running unpriviliged. Finally, there's also Flox[2], which is a Nix-based application Sandbox, that I believe would align more towards your (and OP's) use case (unless you specifically require Docker image compatibility).

So unfortunately your example doesn't illustrate why Apptainer is a better option.

[1] https://docs.docker.com/engine/security/rootless/

[2] https://flox.dev/