Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add --no-mount to override (disable) singularity.conf mount options #5697

Merged
merged 3 commits into from
Nov 6, 2020
Merged

Add --no-mount to override (disable) singularity.conf mount options #5697

merged 3 commits into from
Nov 6, 2020

Conversation

dtrudg
Copy link
Contributor

@dtrudg dtrudg commented Nov 5, 2020

NOTE: This is proposed as an alternative to the single --no-hostfs in #5086, but I'm very open to any of:

  1. Merging this --no-mount approach.
  2. Adding the single requested --no-hostfs by re-opening Add --no-hostfs actions flag #5086
  3. Adding all of the individual --no-xxx flags for each mount xxx config option by modifying this PR.

My opinion r.e. the previous discussion in #5086 is that as we have an existing --no-xxx pattern for flags, the proposal in #5086 comments of a --mount ^xxxx negation syntax is confusing. Also if we allow positive overrides via a --mount we need to worry about precedence / behavior when user binds are disabled etc. For positive overrides (mounting things disabled in singularity.conf) --bind/-B is already available, with understood semantics.

Description of the Pull Request (PR):

It has been requested that users can turn off mount options set to yes
in singularity.conf as they may interfere with some containers -
especially when mount hostfs = yes is set.

In #5086 a single --no-hostfs flag was introduced but concern was
raised that we should be able to disable all, and this would lead to a
proliferation of flags. Another viewpoint is that we should have all of
the --no-xxxxx flags.

This PR proposes a middle ground. Add a --no-mount flag that can take
one or more 'mounts' to disable, overriding the singularity.conf
value. I feel this is more clear / friendlier than using --mount ^hostfs
negation syntax.

Implemented through individual NoXXXX booleans on the EngineConfig so it'd
be trivial to add the --no-xxxx CLI flags later if we change our
minds.

This fixes or addresses the following GitHub issues:

Before submitting a PR, make sure you have done the following:

Attn: @singularity-maintainers

 - Fixes: #5081

It has been requested that users can turn off mount options set to `yes`
in `singularity.conf` as they may interfere with some containers -
especially when `mount hostfs = yes` is set.

In #5086 a single `--no-hostfs` flag was introduced but concern was
raised that we should be able to disable all, and this would lead to a
proliferation of flags. Another viewpoint is that we should have all of
the `--no-xxxxx` flags.

This PR proposes a middle ground. Add a `--no-mount` flag that can take
one or more 'mounts' to disable, overriding the `singularity.conf`
value. I feel this is more clear / friendlier than using `--mount ^hostfs`
negation syntax.

Implemented through individual NoXXXX booleans on the EngineConfig so it'd
be trivial to add the `--no-xxxx` CLI flags later if we change our
minds.
@dtrudg dtrudg added this to the 3.7.0 milestone Nov 5, 2020
@dtrudg dtrudg self-assigned this Nov 5, 2020
Note this does not test for `--no-mount hostfs` yet. See TODO in
`e2e/actions/actions.go`
@dtrudg dtrudg changed the title Add --no-mount to disable singularity.conf mount options Add --no-mount to override (disable) singularity.conf mount options Nov 5, 2020
@dtrudg dtrudg marked this pull request as ready for review November 5, 2020 21:21
Copy link
Collaborator

@cclerget cclerget left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall it looks good, disabling cwd could be nice too as actually it requires to execute singularity from a denied directory like / to disable it

@dtrudg dtrudg requested a review from cclerget November 6, 2020 15:11
@dtrudg
Copy link
Contributor Author

dtrudg commented Nov 6, 2020

Overall it looks good, disabling cwd could be nice too as actually it requires to execute singularity from a denied directory like / to disable it

Added a cwd exclude in ac2aa0c

Copy link
Collaborator

@cclerget cclerget left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dtrudg dtrudg merged commit e66ae65 into apptainer:master Nov 6, 2020
@dtrudg dtrudg deleted the issue5081-take2 branch November 6, 2020 15:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Ability to disable "mount hostfs" in command line
2 participants