SingularityCE 3.11.2 Release

[preminger]

SingularityCE 3.11.2 is a bugfix patch release in the 3.11 series, and can be found here:

https://github.com/sylabs/singularity/releases/tag/v3.11.2

Changes detailed below.

New Features & Functionality

• OCI mode now supports --hostname (requires UTS namespace, therefore this flag will infer --uts).
• OCI mode now supports --scratch (shorthand: -S) to mount a tmpfs scratch directory in the container.
• Support --pwd in OCI mode.
• OCI mode now supports --home. Supplying a single location (e.g. --home /myhomedir) will result in a new tmpfs directory being created at the specified location inside the container, and that dir being set as the in-container user's home dir. Supplying two locations separated by a colon (e.g. --home /home/user:/myhomedir) will result in the first location on the host being bind-mounted as the second location in-container, and set as the in-container user's home dir.
• OCI mode now handles --dns and resolv.conf on par with native mode: the --dns flag can be used to pass a comma-separated list of DNS servers that will be used in the container; if this flag is not used, the container will use the same resolv.conf settings as the host.
• Added allow kernel squashfs directive to singularity.conf. Defaults to yes. When set to no, Singularity will not mount squashfs filesystems using the kernel squashfs driver.
• Added allow kernel extfs directive to singularity.conf. Defaults to yes. When set to no, Singularity will not mount extfs filesystems using the kernel extfs driver.

Bug Fixes

• Require runc in RPM packages built on SLES, not crun, because crun is part of the Package Hub community repository that may not be enabled. SingularityCE will still prefer crun if it has been installed.
• Use /dev/loop-control for loop device creation, to avoid issues with recent kernel patch where max_loop is not set.
• Always request inner userns in --oci mode without --fakeroot, so that inner id mapping is applied correctly.
• Use correct target uid/gid for inner id mappings in --oci mode.
• Avoid runc cgroup creation error when using --oci from a root-owned cgroup (e.g. ssh login session scope).
• Pass host's TERM environment variable to container in OCI mode. Can be overridden by setting SINGULARITYENV_TERM on host.
• Honour config passwd and config group directives from singularity.conf in --oci mode.
• Honour mount proc / mount sys / mount tmp / mount home directives from singularity.conf in --oci mode.
• Corrected singularity.conf comment, to refer to correct file as source of default capabilities when root default capabilities = file.

Thanks / Reporting Bugs

Thanks to our contributors for code, feedback and, testing efforts!

As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new

If you think that you've discovered a security vulnerability please report it to: [email protected]

Have fun!

Source Code

Please use the singularity-ce-3.11.2.tar.gz download below to obtain and install SingularityCE 3.11.2 from source. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.

[dtrudg]

SingularityCE 3.11.2 - Erratum

Following the release of SingularityCE 3.11.2, it was reported that the new allow kernel squashfs directive in singularity.conf is not correctly respected for encrypted SIF containers.

A patch has now been merged onto the release-3.11 branch of the GitHub repository to fix this issue, and will be included in the next 3.11 patch release.

For SingularityCE 3.11.2 a workaround is available. Setting both allow container encrypted = no and allow kernel squashfs = no will ensure that no kernel squashfs mounts take place, including from encrypted containers.

Many thanks to Dave Dykstra for raising the issue promptly.