I am not very experienced with the finer details of Singularity containers yet and I was wondering if an admin on a system can create Singularity containers which they can let ordinary users run, but preventing them from running with root privileges? Normal practice on our system is to let users build their own Singularity containers inside which they are the king of their own castle. Now I am investigating the possibility of offering some pre-defined Singularity containers which are configured by an admin and which the users are allowed to instantiate themselves, but where they cannot have root privileges inside.
1 Answers
The default in singularity is that the images are run as/with the permissions of the user executing them and not as root. If you provide a pre-built image, that should be the case. The images themselves are RO (unless using sandboxes) and /etc/passwd and /etc/group are mounted in to ensure they're run based on the host account privs rather than any user that was created when the image was being built.
How are you giving them full privs in the singularity containers currently? You can allow sudo access to just the singularity build command, which will let them build whatever containers they want, but when they run the containers they will have to do it as their current user. Example line from /etc/sudoers:
singularity-build ALL=(ALL) SETENV: /usr/bin/singularity build *, /usr/bin/singularity --debug build *, /usr/bin/singularity --verbose build *
SETENV allows the users to sudo -E singularity build, which is useful when using the special SINGULARITY_* variables instead of command line params.
If they're currently building sandbox / writable images with sudo, you can also add entries for singularity (--debug|--verbose) (run|exec|shell) --writable *. Using --writable with a read only image will cause a fatal error, so they will be unable to run pre-built images you provide with root privileges. That said, I would recommend against allowing users sudo privs with any singularity commands other than build. Privilege escalation is fairly trivial if they mount the host filesystem into a container they're running as root inside.
Related