Minimizing privilege for building HPC containers
Reid Priedhorsky (1), R. Shane Canon (2, 3), Timothy Randles (1),, Andrew J. Younge (4) ((1) High Performance Computing Division, Los Alamos, National Laboratory, (2) National Energy Research Scientific Computing, Center, (3) Lawrence Berkeley National Laboratory

TL;DR
This paper advocates for low-privilege Linux containers in HPC to enhance security, flexibility, and user productivity, by analyzing kernel features and comparing implementations like Podman and Charliecloud.
Contribution
It introduces a new taxonomy of container privilege levels and demonstrates the feasibility of low-privilege container builds on HPC systems.
Findings
Low-privilege containers are feasible on HPC resources.
Comparison shows Podman and Charliecloud enable unprivileged container builds.
Minimizing privileges improves security and user workflow.
Abstract
HPC centers face increasing demand for software flexibility, and there is growing consensus that Linux containers are a promising solution. However, existing container build solutions require root privileges and cannot be used directly on HPC resources. This limitation is compounded as supercomputer diversity expands and HPC architectures become more dissimilar from commodity computing resources. Our analysis suggests this problem can best be solved with low-privilege containers. We detail relevant Linux kernel features, propose a new taxonomy of container privilege, and compare two open-source implementations: mostly-unprivileged rootless Podman and fully-unprivileged Charliecloud. We demonstrate that low-privilege container build on HPC resources works now and will continue to improve, giving normal users a better workflow to securely and correctly build containers. Minimizing…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
