Thanks for piping up. Charliecloud specifically doesn't require setuid, but many HPC systems won't have user namespaces enabled. (It removed the setuid compon

Thanks for piping up. Charliecloud specifically doesn't require setuid, but many HPC systems won't have user namespaces enabled. (It removed the setuid component which allowed it to work on RHEL6, for instance.) You can also easily build a root for it under proot, for instance -- and proot itself is probably OK for running computationally-intensive work. HPC systems already have a privilege escalation mechanism available from the resource manager, but I don't know there's a problem using it for this sort of thing. Shifter controls the images, so you're not at risk from malformed filesystems, at least. Definitely setuid in Singularity should worry people. It has a non-stellar security record, and has been less than transparent about issues. The last time I looked at the code for instance it still had many calls unchecked for error returns (including all mallocs), and wrote uninitialized memory to image files. It was a mistake to get it into Fedora, and HPC people should be a bit more circumspect. That said, resource managers probably provide most attack surface in HPC systems, in some case completely trivially. By the way, it's often possible just to run programs from an unpacked filesystem of another distribution just by setting PATH and LD_LIBRARY_PATH.