From af77d53a9815510fb7486c5221d397a0edfcb8a1 Mon Sep 17 00:00:00 2001 From: GodloveD Date: Thu, 5 Jan 2017 20:30:48 -0500 Subject: [PATCH 1/3] clarified user binding --- pages/docs/admin-docs/advanced-config.md | 4 ++-- pages/docs/user-docs/docs-bind-paths.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pages/docs/admin-docs/advanced-config.md b/pages/docs/admin-docs/advanced-config.md index 8d0a013..3c78d61 100644 --- a/pages/docs/admin-docs/advanced-config.md +++ b/pages/docs/admin-docs/advanced-config.md @@ -44,9 +44,9 @@ The syntax for this consists of a bind path source and an optional bind path des ### USER BIND CONTROL (boolean, default='yes') -In addition to the system bind points as specified within this configuration file, you may also allow users to define their own bind points inside the container. This feature is used via multiple command line arguments (e.g. `--bind`, `--scratch`, and `--home`) so disabling user bind control will also disable those command line options. +In addition to the system bind points as specified within this configuration file, you may also allow users to define their own bind points inside the container. This feature is used via multiple command line arguments (e.g. `--bind`, `--scratch`, and `--home`) so disabling user bind control will also affect/disable those command line options. -Singularity will automatically disable this feature if the host does not support the prctl option `PR_SET_NO_NEW_PRIVS`. +Singularity will automatically disable this feature if the host does not support the prctl option `PR_SET_NO_NEW_PRIVS`. In addition, `enable overlay` must be set to `yes` and the host system must support overlayFS (generally kernel versions 3.18 and later). ## Logging diff --git a/pages/docs/user-docs/docs-bind-paths.md b/pages/docs/user-docs/docs-bind-paths.md index 2063b8a..0a0d7be 100644 --- a/pages/docs/user-docs/docs-bind-paths.md +++ b/pages/docs/user-docs/docs-bind-paths.md @@ -38,7 +38,7 @@ The system administrator has the ability to define what bind points will be incl #### User defined bind points -If the system administrator has enabled user control of binds (via `user bind control = yes` in `/etc/singularity/singularity.conf`), you will be able to request your own bind points within your container processes. The most typical example of this is the `--bind` option and here is an example binding `/tmp` to `/scratch` (which again does not exist within the container): +If the system administrator has enabled user control of binds and file system overlays (via `user bind control = yes` and `enable overlay = yes` in `/etc/singularity/singularity.conf`), you will be able to request your own bind points within your container processes. The most typical example of this is the `--bind` option and here is an example binding `/tmp` to `/scratch` (which again does not exist within the container). This feature may not be supported on older host systems: ```bash $ singularity shell -B /tmp:/scratch /tmp/Centos7-ompi.img From 24d5038afe853dabcba0e8a8b82d51bf0648223e Mon Sep 17 00:00:00 2001 From: GodloveD Date: Thu, 5 Jan 2017 21:40:17 -0500 Subject: [PATCH 2/3] realized that some of my clarification was obfuscation and tried again --- pages/docs/admin-docs/advanced-config.md | 4 ++-- pages/docs/user-docs/docs-bind-paths.md | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/pages/docs/admin-docs/advanced-config.md b/pages/docs/admin-docs/advanced-config.md index 3c78d61..0849ccf 100644 --- a/pages/docs/admin-docs/advanced-config.md +++ b/pages/docs/admin-docs/advanced-config.md @@ -44,9 +44,9 @@ The syntax for this consists of a bind path source and an optional bind path des ### USER BIND CONTROL (boolean, default='yes') -In addition to the system bind points as specified within this configuration file, you may also allow users to define their own bind points inside the container. This feature is used via multiple command line arguments (e.g. `--bind`, `--scratch`, and `--home`) so disabling user bind control will also affect/disable those command line options. +In addition to the system bind points as specified within this configuration file, you may also allow users to define their own bind points inside the container. This feature is used via multiple command line arguments (e.g. `--bind`, `--scratch`, and `--home`) so disabling user bind control will also disable those command line options. -Singularity will automatically disable this feature if the host does not support the prctl option `PR_SET_NO_NEW_PRIVS`. In addition, `enable overlay` must be set to `yes` and the host system must support overlayFS (generally kernel versions 3.18 and later). +Singularity will automatically disable this feature if the host does not support the prctl option `PR_SET_NO_NEW_PRIVS`. In addition, `enable overlay` must be set to `yes` and the host system must support overlayFS (generally kernel versions 3.18 and later) for users to bind host directories to bind points that do not already exist in the container. ## Logging diff --git a/pages/docs/user-docs/docs-bind-paths.md b/pages/docs/user-docs/docs-bind-paths.md index 0a0d7be..86c62dc 100644 --- a/pages/docs/user-docs/docs-bind-paths.md +++ b/pages/docs/user-docs/docs-bind-paths.md @@ -38,7 +38,11 @@ The system administrator has the ability to define what bind points will be incl #### User defined bind points -If the system administrator has enabled user control of binds and file system overlays (via `user bind control = yes` and `enable overlay = yes` in `/etc/singularity/singularity.conf`), you will be able to request your own bind points within your container processes. The most typical example of this is the `--bind` option and here is an example binding `/tmp` to `/scratch` (which again does not exist within the container). This feature may not be supported on older host systems: +If the system administrator has enabled user control of binds (via `user bind control = yes` in `/etc/singularity/singularity.conf`), you will be able to request your own bind points within your container. + +Further, if the administrator has enabled the user of file system overlays (via `enable overlay = yes` in `/etc/singularity/singularity.conf`), you can bind host system directories to directories that do not exist within the container. Singularity will dynamically create the necessary bind points in your container on demand. This feature may not be supported on older host systems. + +Here's an example of using the `--bind` option and binding `/tmp` to `/scratch` (which again does not exist within the container): ```bash $ singularity shell -B /tmp:/scratch /tmp/Centos7-ompi.img From 136998928aba8f99ddf5f019a97f912b93e9ae3b Mon Sep 17 00:00:00 2001 From: GodloveD Date: Thu, 5 Jan 2017 22:27:22 -0500 Subject: [PATCH 3/3] modified the example for successful binding --- pages/docs/user-docs/docs-bind-paths.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pages/docs/user-docs/docs-bind-paths.md b/pages/docs/user-docs/docs-bind-paths.md index 86c62dc..1e5f53c 100644 --- a/pages/docs/user-docs/docs-bind-paths.md +++ b/pages/docs/user-docs/docs-bind-paths.md @@ -40,14 +40,14 @@ The system administrator has the ability to define what bind points will be incl #### User defined bind points If the system administrator has enabled user control of binds (via `user bind control = yes` in `/etc/singularity/singularity.conf`), you will be able to request your own bind points within your container. -Further, if the administrator has enabled the user of file system overlays (via `enable overlay = yes` in `/etc/singularity/singularity.conf`), you can bind host system directories to directories that do not exist within the container. Singularity will dynamically create the necessary bind points in your container on demand. This feature may not be supported on older host systems. +Further, if the administrator has enabled the use of file system overlay (via `enable overlay = yes` in `/etc/singularity/singularity.conf`), you can bind host system directories to directories that do not exist within the container. Singularity will dynamically create the necessary bind points in your container on demand. This feature may not be supported on older host systems. -Here's an example of using the `--bind` option and binding `/tmp` to `/scratch` (which again does not exist within the container): +Here's an example of using the `--bind` option and binding `/tmp` to `/scratch` (which may not already exist within the container if file system overlay is enabled): ```bash $ singularity shell -B /tmp:/scratch /tmp/Centos7-ompi.img -WARNING: Skipping user bind, non existant bind point (directory) in container: '/scratch' Singularity: Invoking an interactive shell within container... -Singularity.Centos7-ompi.img> +Singularity.Centos7-ompi.img> ls /scratch +ssh-7vywtVeOez systemd-private-cd84c81dda754fe4a7a593647d5a5765-ntpd.service-12nMO4 ```