4 ms·

> For most of my use cases, I don't really care about rootless. See, and in almost all of my use-cases, I really do. I do HPC computing, which is almost always

> For most of my use cases, I don't really care about rootless. See, and in almost all of my use-cases, I really do. I do HPC computing, which is almost always a multi-tenant environment. This makes using Docker really hard to use, security wise. Unfortunately, more and more software/workflows are getting distributed as Docker containers (for very good reasons). This makes my life difficult. So, if I can set it up so that users can more easily work with containers on my HPC compute nodes, I'd be very happy. If the defacto solution ends up as podman (and rootless), then I'm happy. (Yes, I use Singularity too, but it would be nicer to be able to not have to convert containers). Now, I do very little with networking and containers, so those types of requirements... I don't care as much about. But I know that is a big feature set for a lot of people here.

elmolino89 5y ago
Docker is not an option on HPC clusters I have been using so far. For me it is easier to just put SIF file where all users can run it/programs from it. There are issues in really closed evironments (no sudo on any machine) when one has to jump hoops to tweak=> build=>SIF transfer, but this is nuisance, not a problem. BTW, are there out there any on premises multi-user HPC clusters with Docker running on the nodes?
- AitchEmArsey 5y ago
  > BTW, are there out there any on premises multi-user HPC clusters with Docker running on the nodes? The vendor ClusterVision (EMEA, went bankrupt then returned to life) used to offer a cluster deployment option based on OpenStack+Docker; OpenStack for defining the cluster boundary on top of your hardware then Docker serving as the "image" on each compute node layered on top of the regular OS. Not at all a typical use-case for HPC containers, and with hindsight it is fairly obvious how that Byzantine stack resulted in too much complexity for them to support cost-effectively.
moonbug 5y ago
No lover of Docker, but I'd have much more confidence in the quality of the docker Daemon code than any hpc batch system's local execs.
mindwok 5y ago
Yeah fair enough, if you're in a situation where you have several unprivileged users sharing a VM or something than it makes sense. I haven't come across that yet personally.
rad_gruchalski 5y ago
> See, and in almost all of my use-cases, I really do. I do HPC computing, which is almost always a multi-tenant environment. Maybe you need firecracker with something along the lines of https://github.com/combust-labs/firebuild https://github.com/combust-labs/firebuild?

elmolino89 5y ago

Docker is not an option on HPC clusters I have been using so far. For me it is easier to just put SIF file where all users can run it/programs from it. There are issues in really closed evironments (no sudo on any machine) when one has to jump hoops to tweak=> build=>SIF transfer, but this is nuisance, not a problem. BTW, are there out there any on premises multi-user HPC clusters with Docker running on the nodes?

AitchEmArsey 5y ago
> BTW, are there out there any on premises multi-user HPC clusters with Docker running on the nodes? The vendor ClusterVision (EMEA, went bankrupt then returned to life) used to offer a cluster deployment option based on OpenStack+Docker; OpenStack for defining the cluster boundary on top of your hardware then Docker serving as the "image" on each compute node layered on top of the regular OS. Not at all a typical use-case for HPC containers, and with hindsight it is fairly obvious how that Byzantine stack resulted in too much complexity for them to support cost-effectively.

moonbug 5y ago

No lover of Docker, but I'd have much more confidence in the quality of the docker Daemon code than any hpc batch system's local execs.

mindwok 5y ago

Yeah fair enough, if you're in a situation where you have several unprivileged users sharing a VM or something than it makes sense. I haven't come across that yet personally.

rad_gruchalski 5y ago

> See, and in almost all of my use-cases, I really do. I do HPC computing, which is almost always a multi-tenant environment. Maybe you need firecracker with something along the lines of https://github.com/combust-labs/firebuild https://github.com/combust-labs/firebuild?