Package: udocker-stimela
udocker is a basic user tool to execute simple docker containers in user
space without requiring root privileges. Enables download and execution
of docker containers by non-privileged users in Linux systems where
docker is not available. It can be used to pull and execute docker
containers in Linux batch systems and interactive clusters that are
managed by other entities such as grid infrastructures or externally
managed batch or interactive systems.udocker does not require any type of privileges nor the deployment of
services by system administrators. It can be downloaded and executed
entirely by the end user.udocker is a wrapper around several tools to mimic a subset of the
docker capabilities including pulling images and running containers
with minimal functionality.How does it workudocker is a simple tool written in Python, it has a minimal set
of dependencies so that can be executed in a wide range of Linux
systems.udocker does not make use of docker nor requires its presence.udocker "executes" the containers by simply providing a chroot like
environment over the extracted container. The current implementation
supports different methods to mimic chroot enabling execution of
containers without requiring privileges under a chroot like environment.
udocker transparently supports several methods to execute the containers
using tools and libraries such as:PRootFakechrootrunCSingularityAdvantagesProvides a docker like command line interfaceSupports a subset of docker commands:
search, pull, import, export, load, create and runUnderstands docker container metadataCan be deployed by the end-userDoes not require privileges for installationDoes not require privileges for executionDoes not require compilation, just transfer the Python script and runEncapsulates several execution methodsIncludes the required tools already compiled to work across systemsTested with GPGPU and MPI applicationsRuns both on new and older Linux distributions including:
CentOS 6, CentOS 7, Ubuntu 14, Ubuntu 16, Ubunto 18, Fedora, etcInstallationSee theInstallation manualSyntaxCommands:
  search <repo/image:tag>       :Search dockerhub for container images
  pull <repo/image:tag>         :Pull container image from dockerhub
  images                        :List container images
  create <repo/image:tag>       :Create container from a pulled image
  ps                            :List created containers
  rm  <container>               :Delete container
  run <container>               :Execute container
  inspect <container>           :Low level information on container
  name <container_id> <name>    :Give name to container
  rmname <name>                 :Delete name from container

  rmi <repo/image:tag>          :Delete image
  rm <container-id>             :Delete container
  import <tar> <repo/image:tag> :Import tar file (exported by docker)
  import - <repo/image:tag>     :Import from stdin (exported by docker)
  load -i <exported-image>      :Load image from file (saved by docker)
  load                          :Load image from stdin (saved by docker)
  export -o <tar> <container>   :Export container rootfs to file
  export - <container>          :Export container rootfs to stdin
  inspect <repo/image:tag>      :Return low level information on image
  verify <repo/image:tag>       :Verify a pulled image
  clone <container>             :duplicate container

  protect <repo/image:tag>      :Protect repository
  unprotect <repo/image:tag>    :Unprotect repository
  protect <container>           :Protect container
  unprotect <container>         :Unprotect container

  mkrepo <topdir>               :Create repository in another location
  setup                         :Change container execution settings
  login                         :Login into docker repository
  logout                        :Logout from docker repository

  help                          :This help
  run --help                    :Command specific help


Options common to all commands must appear before the command:
  -D                          :Debug
  --repo=<directory>          :Use repository at directoryExamplesSome examples of usage:Search container images in dockerhub.udocker search  fedora
udocker search  ubuntu
udocker search  indigodatacloudPull from dockerhub and list the pulled images.udocker pull  fedora:25
udocker pull  busybox
udocker pull  iscampos/openqcd
udocker imagesPull from a registry other than dockerhub.udocker pull --registry=https://registry.access.redhat.com  rhel7
udocker create --name=rh7 rhel7
udocker run rh7Create the container from a pulled image and run it.udocker create --name=myfed  fedora:25
udocker run  myfed  cat /etc/redhat-releaseRun mounting the host /home/u457 into the container directory /home/cuser.
Notice that you can "mount" any host directory inside the container, this
is not a real mount but the directories will be visible inside the container.udocker run -v /home/u457:/home/cuser -w /home/user myfed  /bin/bash
udocker run -v /var -v /proc -v /sys -v /tmp  myfed  /bin/bashPut a script in your host /tmp and execute it in the container.udocker run  -v /tmp  myfed  /bin/bash -c 'cd /tmp; ./myscript.sh'Run mounting the host /var, /proc, /sys and /tmp in the same container
directories. Notice that the content of these container directories will
be obfuscated.udocker run -v /var -v /proc -v /sys -v /tmp  myfed  /bin/bashInstall software inside the container.udocker run  --user=root myfed  yum install -y firefox pulseaudio gnash-pluginRun as some user. The usernames should exist in the container.udocker run --user 1000:1001  myfed  /bin/id
udocker run --user root   myfed  /bin/id
udocker run --user jorge  myfed  /bin/idRunning Firefox../udocker run --bindhome --hostauth --hostenv \
   -v /sys -v /proc -v /var/run -v /dev --user=jorge --dri myfed  firefoxChange execution engine mode from PRoot to Fakechroot and run../udocker setup  --execmode=F4  myfed

./udocker run --bindhome --hostauth --hostenv \
   -v /sys -v /proc -v /var/run -v /dev --user=jorge --dri myfed  firefoxChange execution engine mode to accelerated PRoot../udocker setup  --execmode=P1  myfedChange execution engine to runC../udocker setup  --execmode=R1  myfedChange execution engine to Singularity. Requires the availability of
Singularity in the host system../udocker setup  --execmode=S1  myfedLimitationsSince root privileges are not involved any operation that really
requires such privileges will not be possible. The following  are
examples of operations that are not possible:accessing host protected devices and fileslistening on TCP/IP privileged ports (range below 1024)mount file-systemsthe su command will not workchange the system timechanging routing tables, firewall rules, or network interfacesIf the containers require such capabilities then docker should be used
instead.The current implementation is limited to the pulling of docker images
and its execution. The actual containers should be built using docker
and dockerfiles.udocker does not provide all the docker features, and is not intended
as a docker replacement.Debugging inside of udocker with the PRoot engine will not work due to
the way PRoot implements the chroot environmentudocker is mainly oriented at providing a run-time environment for
containers execution in user space.udocker is particularly suited to run user applications encapsulated
in docker containers.SecurityBecause of the limitations described in the previous section udocker does
not offer isolation features such as the ones offered by docker. If the
containers content is not trusted then these containers should not be
executed with udocker as they will run inside the user environment.The containers data will be unpacked and stored in the user home directory or
other location of choice. Therefore the containers data will be subjected to
the same filesystem protections as other files owned by the user. If the
containers have sensitive information the files and directories should be
adequately protected by the user.udocker does not require privileges and runs under the identity of the user
invoking it.Users can downloaded udocker and execute it without requiring system
administrators intervention.udocker via PRoot offers the emulation of the root user. This emulation
mimics a real root user (e.g getuid will return 0). This is just an emulation
no root privileges are involved. This feature makes possible the execution
of some tools that do not require actual privileges but which refuse to
work if the username or id are not root or 0. This enables for instance
software installation using rpm, yum or dnf inside the container.Due to the lack of isolation udocker must not be run by privileged users.Other limitationsNotice that when using execution engines other than PRoot (Pn modes) the
created containers cannot be moved across hosts. In this case convert back
to a Pn mode before transfer.The accelerated mode of PRoot (mode P1) may exhibit failures in Linux kernels
above 4.0 with some applications due to kernel changes and upstream issues in
this case use mode P2 or any of the other modes.The runC mode requires a recent kernel with user namespaces enabled.The singularity mode requires the availability of Singularity in the host
system.DocumentationThe full documentation is available at:GitBook:https://indigo-dc.gitbooks.io/udocker/content/master:https://github.com/indigo-dc/udocker/blob/master/SUMMARY.mddevel:https://github.com/indigo-dc/udocker/blob/devel/SUMMARY.mdContributingSee:ContributingCitingWhen citing udocker please use the following:Jorge Gomes, Emanuele Bagnaschi, Isabel Campos, Mario David, Luís Alves, João Martins, João Pina, Alvaro López-García, Pablo Orviz, Enabling rootless Linux Containers in multi-user environments: The udocker tool, Computer Physics Communications, Available online 6 June 2018, ISSN 0010-4655,https://doi.org/10.1016/j.cpc.2018.05.021AcknowledgementsDockerhttps://www.docker.com/PRoothttps://proot-me.github.io/Fakechroothttps://github.com/dex4er/fakechroot/wikirunChttps://runc.io/Singularityhttps://www.sylabs.io/INDIGO DataCloudhttps://www.indigo-datacloud.euEOSC-hubhttps://eosc-hub.euDEEP-Hybrid-DataCloudhttps://deep-hybrid-datacloud.euudocker (1.1.3)Support for nvidia drivers on ubuntucloses: #162Installation improvementscloses: #166Fix issue on Fn mode symlink convertionpartially addresses: #160udocker (1.1.2)Improve parsing of quotes in the command linecloses: #98Fix version command to exit with 0closes: #107Add kill-on-exit to proot on Pn modesImprove download of udocker utilsHandle authentication headers when pullingcloses: #110Handle of redirects when pullingFix registries tableSupport search quay.ioFix auth header when no standard Docker registry is usedAdd registry detection on image nameAdd --version optionForce python2 as interpretercloses: #131Fix handling of volumes in metadataHandle empty metadataFix http proxy functionalitycloses: #115Ignore --no-trunc and --all in the images commandcloses: #108Implement verification of layers in manifestAdd --nvidia to support GPUs and related driversSend download messages to stderrEnable override of curl executableFix building on CentOS 6closes: #157Mitigation for upstream limitation in runC without ttycloses: #132Fix detection of executable with symlinks in containercloses: #118Updated runC to v1.0.0-rc5Experimental support for Alpine in Fn modesImprove pathname translation in Fn modes for mounted dirspartially addresses: #160udocker (1.1.1)New execution engine using singularityUpdated documentation with OpenMPI information and examplesAdditional unit testsRedirect messages to stderrImproved parsing of quotes in the command linecloses: #87Allow override of the HOME environment variableAllow override of libfakechroot.so at the container levelAutomatic selection of libfakechroot.so from container infoImprove automatic installEnable resetting prefix paths in Fn modes in remote hostsDo not set AF_UNIX_PATH in Fn modes when the host /tmp is a volumeExport containers in both docker and udocker formatImport containers docker and udocker formatLoad, import and export to/from stdin/stdoutClone existing containersSupport for TCP/IP port remap in execution modes PnFix run with basenames failingcloses: #89Allow run as root flagcloses: #91udocker (1.1.0)Support image names prefixed by registry similarly to dockerAdd execution engine selection logicAdd fr execution engine based on shared library interceptionAdd rc execution engine based on rootless namespacesImprove proot tmp files cleanup on non ext filesystemsImprove search returning empty on Docker repositoriesImprove runC execution portabilityAdd environment variable UDOCKER_KEYSTOREcloses: #75Prevent creation of .udocker when UDOCKER_KEYSTORE is usedcloses: #75udocker (1.0.4)Documentation fixesudocker (1.0.3)Support for import Docker containers in newer metadata structureImprove the command line parsingImprove temporary file handling and removalSupport for additional execution engines to be provided in the futureImproved parsing of entrypoint and cmd metadatacloses: #53Increase name alias lengthcloses: #52Add support for change dir into volume directoriescloses: #51Fix deletion of files upon container importcloses: #50Fix exporting of host environment variables to the containerscloses: #48Change misleading behavior of import tarball from move to copycloses: #44Fix validation of volumes specificationcloses: #43udocker (1.0.2)Improve download on repositories that fail authentication on /v2Improve run verification of binaries with recursive symbolic linksImprove accelerated seccomp on kernels >= 4.8.0closes: #40udocker (1.0.1)Minor bugfixesExecutable name changed from udocker.py to udockerAdded support for login into docker repositoriesAdded support for private repositoriesAdded support for listing of v2 repositories catalogAdded checksum verification for sha256 layersImproved download handling for v1 and v2 repositoriesImproved installation tarball structureInsecure flag fixedAddress seccomp change introduced on kernels >= 4.8.0Utilities for packagingImproved verbose levels, messaging and outputcloses: #24, #23Fully implement support for registry selection --registry parametercloses: #29Provide support for private repositories e.g. gitlab registriescloses: #30Provide --insecure command line parameter for SSL requestscloses: #31udocker (1.0.0)Initial version