Singularity running as root inside an unprivileged Kubernetes pod fails to extract images

[stxue1]

Singularity running as root inside an unprivileged Kubernetes pod fails to extract images

[dtrudg]

First, a note that if this specific issue is fixed, you'll still hit problems further on. Singularity is going to need to create namespaces, perform mount syscalls etc. later on in container execution. You will need to grant enough privileges for this to happen.

We don't often see people attempting to run inside kubernetes, and don't actively test this workflow. However, you may find some useful information in the podman documentation page linked below... Singularity is going to require broadly the same privileges as other runtimes. It is not possible to run a container runtime inside a pod without granting any additional privileges.

https://www.redhat.com/sysadmin/podman-inside-kubernetes

As an aside - it'd be good to understand the workflow here. Given that you can run an OCI container natively under kubernetes, what are the circumstances that require you to run under singularity inside k8s?

With regard specifically to the detection of the ability to apply xattrs - we already attempt to detect a rootless (unprivileged) situation, and filesystems that do not support setting xattrs:

singularity/internal/pkg/image/unpacker/squashfs.go

Line 110 in 74feead

// First we try unsquashfs with appropriate xattr options. If we are in

Clearly this is not working in the kubernetes case. If you are able to experiment with the detection process to identify the cause then we'd welcome a patch, or further information that would allow us to create a patch for this situation.