论文标题
无固定的插件
Apptainer Without Setuid
论文作者
论文摘要
自开始以来，Apptainer（以前称为奇异性）在SetuID-Root程序的协助下实施了许多容器功能。它仍然支持该模式，但是从1.1.0版本开始，它默认情况下不再使用setuid。这是可行的，因为它现在可以使用无私人的用户名称空间和FUSE安装Squashfs文件系统，Ext3文件系统和覆盖文件系统。现在，它还使无特权用户能够构建容器，即使不需要系统管理员可以配置 /etc /subuid和 /etc /subgid，与其他“无根”容器系统不同。结果，即使容器运行时可以防止任何高架特权，也可以使用所有无特点功能。截至版本1.2.0，AppTainer还支持奇异图像格式（SIF）容器文件的完全无特权的加密。使用或不使用加密的基于FUSE的安装座具有特别具有挑战性的HEP基准测试的性能与以前需要提高特权使用基于Linux内核的方法相同。
Apptainer (formerly known as Singularity) since its beginning implemented many of its container features with the assistance of a setuid-root program. It still supports that mode, but as of version 1.1.0 it no longer uses setuid by default. This is feasible because it now can mount squashfs filesystems, ext3 filesystems, and overlay filesystems using unprivileged user namespaces and FUSE. It also now enables unprivileged users to build containers, even without requiring system administrators to configure /etc/subuid and /etc/subgid unlike other "rootless" container systems. As a result, all the unprivileged functions can be used nested inside of another container, even if the container runtime prevents any elevated privileges. As of version 1.2.0 Apptainer also supports completely unprivileged encryption of Singularity Image Format (SIF) container files. Performance with a particularly challenging HEP benchmark using the FUSE-based mounts both with and without encryption is essentially identical to the previous methods that required elevated privileges to use the Linux kernel-based counterparts.
