add support for installing with bwrap

[smoors]

cfr. #4110

UPDATE 2026-03-13

done:

• add --bwrap-installpath option to specify the temporary install path.
• add --bwrap option: if set, EB will gather all info needed to run with bwrap.
• add rerun_with_bwrap() function in main.py which reruns EB with bwrap if --bwrap is set (and disables --bwrap for a real installation).
• require --experimental flag
• add end-to-end CI test
• also run the interactive debug shell with bwrap
• make sure it also works with easystack files and specifying multiple easyconfigs with 1 EB cmd
• write json file with bwrap install info into bwrap installpath
• also support bwrap for --job

to do in follow-up PR:

• add deployment step: moving the installation to the final destination

requires the following easyblock PRs to work for all software:

• use clean_dir instead of remove_dir on installation directory for Amber easyblock easybuild-easyblocks#3935
• use clean_dir instead of remove_dir on installation directory for Anaconda easyblock easybuild-easyblocks#3934
• use clean_dir instead of remove_dir on installation directory for FDTD_Solutions easyblock easybuild-easyblocks#3933
• use clean_dir instead of remove_dir on installation directory for GATE easyblock easybuild-easyblocks#3932
• use clean_dir instead of remove_dir on installation directory for Go easyblock easybuild-easyblocks#3931
• use clean_dir instead of remove_dir on installation directory for Molpro easyblock easybuild-easyblocks#3930
• use clean_dir instead of remove_dir on installation directory for Tkinter easyblock easybuild-easyblocks#3929
• use clean_dir instead of remove_dir on installation directory for Java easyblock easybuild-easyblocks#3928
• use clean_dir instead of remove_dir on installation directory for Binary easyblock easybuild-easyblocks#3927
• use clean_dir instead of remove_dir on installation directory for Tarball easyblock easybuild-easyblocks#3926

[boegel]

@smoors I only took a very quick look at this, but do we really need eb.py, or can we just update easybuild/main.py instead?

[smoors]

@smoors I only took a very quick look at this, but do we really need eb.py, or can we just update easybuild/main.py instead?

oh cool, i didn't think this was possible but you're right!

EDIT: done in 5595842

[boegel]

@smoors We should cover the use of --bwrap in a CI workflow...

Maybe an extra step can be added at the end of .github/workflows/end2end.yml ?

[smoors]

@smoors We should cover the use of --bwrap in a CI workflow...

Maybe an extra step can be added at the end of .github/workflows/end2end.yml ?

done in ab03bb8

successful test in https://github.com/easybuilders/easybuild-framework/actions/runs/22448778136/job/65010878984?pr=5130

it runs in a separate workflow, directly in the VM instead of a container because i couldn't get bwrap to work in a container in a github workflow.

[bartoldeman]

This looks like a very good start, however we have a slightly different use case where ideally we'd be able to have the installation directory on a read-only file system (e.g. cvmfs), i.e. which EESSI solves with apptainer.

but for that the
mkdir(spath, parents=True)
will not work, unless the directory already exists (e.g. with eb --rebuild). What can work is overlayfs but it'll have to do something like this:

while not os.path.exists(spath):
       spath = os.path.dirname(spath)

and then
f"bwrap --dev-bind / / --overlay-src {spath} --overlay /bwrap/rwdir /bwrap/workdir {spath} ..."
this way the spath/path/to/install/dir can be created inside bwrap by regular eb.

It has to be mounted at that exact point (first parent dir that exists) since if you go too high you'll have permission issues inside bwrap.

This could be added in a compatible fashion, i.e. if the mkdir fails, use overlayfs. I'll do a few tests with this technique and will let you know.

[smoors]

@bartoldeman would be nice if you can get it working with overlayfs. our bwrap version doesn't support it yet, but we currently don't have cvmfs so we don't need it (yet).