Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support --no-mount in --oci mode #1781

Closed
Tracked by #1467
dtrudg opened this issue Jun 16, 2023 · 0 comments · Fixed by #1785
Closed
Tracked by #1467

Support --no-mount in --oci mode #1781

dtrudg opened this issue Jun 16, 2023 · 0 comments · Fixed by #1785

Comments

@dtrudg
Copy link
Member

dtrudg commented Jun 16, 2023

In --oci mode, --no-mount should support disabling the following mounts...

  • proc
  • sys
  • devpts
  • tmp
  • home

The following are not supported, and should warn...

  • dev (OCI containers require a minimal dev tmpfs, and the runtime will insert minimal dev entries)
  • cwd (We don't mount cwd in OCI mode at this time)

The following values should warn for now, pending consideration of how/when to handle singularity.conf bind path entries.

  • bind-paths
  • a specific absolute path in singularity.conf bind-paths
dtrudg added a commit to dtrudg/singularity that referenced this issue Jun 16, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs#1781
dtrudg added a commit to dtrudg/singularity that referenced this issue Jun 19, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs#1781
dtrudg added a commit to dtrudg/singularity that referenced this issue Jun 19, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs#1781
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 10, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs/singularity#1781

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 11, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs/singularity#1781

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 21, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs/singularity#1781

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 24, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs/singularity#1781

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 24, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs/singularity#1781

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 24, 2023
Allow the `--no-mount` flag to be specified in `--oci` mode. This
allows disabling the following mounts:

* proc
* sys
* devpts
* tmp
* home

Note that `dev` cannot be supported in `--oci` mode, as an OCI
runtime *requires* that certain devices are present, and will include
them in a `/dev` tmpfs.

We currently run similar to native mode `--compat`, so we don't mount
the current working directory. Therefore, `--no-mount cwd` is not
supported.

Similarly, `--compat` infers that `bind path` entries from
`singularity.conf` are ignored. We may handle them in some way, in future.

Fixes sylabs/singularity#1781

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant