There is no Apptainer docker image, only a Singularity image based on the Sylabs releases.

This relates mostly to the "User Namespaces and Fakeroot" page. I found it fairly confusing because apptainer has so many modular features, each of which requires different levels of permissions and dependent software, that in turn enable different capabilities in apptainer. In theory this could be expanded to talk about FUSE filesystems etc as well.

The motivation for this is helping sysadmins determine which features they can enable "for free" (ie without security risks) e.g. fakeroot, and which ones can be skipped. e.g. the setuid flag is possibly not needed on newer Linux kernels.

I think it might be helpful to present this information as a collection of paragraphs, one for each capability, that describe this information in a structure way. Now I don't actually have all the info to write this because I still don't fully understand everything, but here's an example:

Name: Fakeroot binary
How to Enable Install fakeroot command (can be compiled from scratch or installed as a package)
Required Privileges: None (any user can compile fakeroot)
Security risks: None
Enables: The use of sudo inside apptainer, for example sudo apt install or sudo make install. This allows the use of many standard installation mechanisms, which can make building containers much easier

Name: Setuid Flag
How to Enable Install apptainer-suid package instead of apptainer
Required Privileges: Root
Security risks: Potentially
Enables: Allows apptainer to run on old Linux kernels that don't support user namespaces

Name: subuid Mappings
How to Enable: The root user can customize /etc/subuid and /etc/subgid
Required Privileges: Root
Security risks: No (?)
Enables: Allows apptainer to map multiple users inside the container to multiple users outside the container. This extends the default behaviour whereby the running user outside the container is mapped to root inside the container.

As in apptainer/apptainer-userdocs#3

Document known system incompatibilities:

• hidepid=1 or hidepid=2 option on /proc mount are known to be incompatible with instances and setuid workflow
• running apptainer inside "weak" chroot is not permitted

Which Document page:

https://apptainer.org/docs/admin/main/installation.html#install-unprivileged-from-pre-built-binaries

Expected results:

The install script will succesfully install apptainer, if the privileges and dependencies necessary are met.

Actual results:

As of writing linux-mirrors.fnal.gov is reachable over HTTP but not HTTPS. This results in the installation script failing:

# curl -s https://raw.githubusercontent.com/apptainer/apptainer/main/tools/install-unprivileged.sh | bash -s /opt/apptainer
Could not find apptainer version from https://linux-mirrors.fnal.gov/linux/fedora/epel/7/x86_64/Packages/a

This can be worked around currently by replacing https://linux-mirrors.fnal.gov with http://linux-mirrors.fnal.gov.

Make a "{aProject}" replacement with a value of "an Apptainer" to replace the 3 cases of "a {Project}".

Import the following sylabs admindocs PRs:

• sylabs/singularity-admindocs#95
• sylabs/singularity-admindocs#120

Also review these to see if they're better than what we already have:

• sylabs/singularity-admindocs#116
• sylabs/singularity-admindocs#117
• sylabs/singularity-admindocs#136

Similarly to what was done in apptainer/apptainer-userdocs#38.

We need to reference a version in the locations there v3 was used because it was used to differentiate features from the v2 line of Singularity which is not relevant to the decimation of apptainer at this point.

There are still some references to Singularity in different parts.

Which Document page:

On what page is the problem?

https://apptainer.org/docs/admin/latest/user_namespace.html#basics

Expected results:

What are you expecting to see?

For user foo an entry in /etc/subuid might be:

foo:10000:65536

where foo is the username, 10000 is the start of the UID range that can be used by foo in a user namespace uid mapping, and 65536 number of UIDs available for mapping.

Same for /etc/subgid:

foo:10000:65536

Actual results:

What is the problem, what's misspelled, or what's missing?

Isn't 100000 a typo? I assume its suppose to be 10000.

For user foo an entry in /etc/subuid might be:

foo:100000:65536

where foo is the username, 100000 is the start of the UID range that can be used by foo in a user namespace uid mapping, and 65536 number of UIDs available for mapping.

Same for /etc/subgid:

foo:100000:65536

Which Document page:

installation.rst

Expected results:

Bash completion files installed according to the document page.

Actual results:

The code here seem to indicate they are installed elsewhere.

Incoming perspective: A few months back I did some preliminary work on introducing Singularity into one of my environments, but I haven't touched it since then and I've forgotten some things.

https://apptainer.org/docs/admin/latest/admin_quickstart.html#architecture-of-apptainer , i.e.

This would also be helpful because my other major use case is being able to point someone else to something summarizing how the technology is supposed to work.

There is a very old FAQ mentioned here that I haven't been able to find any existing instances of https://stackoverflow.com/questions/45169598/chroot-vs-singularity -> http://singularity.lbl.gov/faq#how-is-singularity-different-from-chroot , the question just doesn't seem to exist anywhere.

Short discussion of the steps admins need to take to migrate from Singularity to Apptainer.

Topics:

• singularity command symlink
• legacy environment variable prefix support, reference docs from: apptainer/apptainer-userdocs#23
• configurations: apptainer/apptainer#87

Update the Copyright messages as in apptainer/apptainer-userdocs#44.

The Apptainer INSTALL.md refers to installation.html here as a place for instructions to install from EPEL but they are missing.

This resolves change requests in #19

replacements.py should be updated to replace {command} to APPTAINER

Similar to apptainer/apptainer-userdocs#36

Similarly to what was done for apptainer/apptainer-userdocs#18

Similarly to what was done for apptainer/apptainer-userdocs#16

replacements.py should be updated to replace {ENVPREFIX} to APPTAINER

Similar to apptainer/apptainer-userdocs#47