@@ -78,7 +78,11 @@ job or any given plugin).</li>
78
78
79
79
<h2 id="prereq">Prerequisites<a class="slurm_link" href="#prereq"></a></h2>
80
80
<p>The host kernel must be configured to allow user land containers:</p>
81
- <pre>$ sudo sysctl -w kernel.unprivileged_userns_clone=1</pre>
81
+ <pre>
82
+ sudo sysctl -w kernel.unprivileged_userns_clone=1
83
+ sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
84
+ sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
85
+ </pre>
82
86
83
87
<p>Docker also provides a tool to verify the kernel configuration:
84
88
<pre>$ dockerd-rootless-setuptool.sh check --force
@@ -353,6 +357,62 @@ exit $rc
353
357
</pre>
354
358
</p>
355
359
360
+ <h3 id="multiple-runtimes">Handling multiple runtimes
361
+ <a class="slurm_link" href="#multiple-runtimes"></a>
362
+ </h3>
363
+
364
+ <p>If you wish to accommodate multiple runtimes in your environment,
365
+ it is possible to do so with a bit of extra setup. This section outlines one
366
+ possible way to do so:</p>
367
+
368
+ <ol>
369
+ <li>Create a generic oci.conf that calls a wrapper script
370
+ <pre>
371
+ IgnoreFileConfigJson=true
372
+ RunTimeRun="/opt/slurm-oci/run %b %m %u %U %n %j %s %t %@"
373
+ RunTimeKill="kill -s SIGTERM %p"
374
+ RunTimeDelete="kill -s SIGKILL %p"
375
+ </pre>
376
+ </li>
377
+ <li>Create the wrapper script to check for user-specific run configuration
378
+ (e.g., /opt/slurm-oci/run)
379
+ <pre>
380
+ #!/bin/bash
381
+ if [[ -e ~/.slurm-oci-run ]]; then
382
+ ~/.slurm-oci-run "$@"
383
+ else
384
+ /opt/slurm-oci/slurm-oci-run-default "$@"
385
+ fi
386
+ </pre>
387
+ </li>
388
+ <li>Create a generic run configuration to use as the default
389
+ (e.g., /opt/slurm-oci/slurm-oci-run-default)
390
+ <pre>
391
+ #!/bin/bash --login
392
+ # Parse
393
+ CONTAINER="$1"
394
+ SPOOL_DIR="$2"
395
+ USER_NAME="$3"
396
+ USER_ID="$4"
397
+ NODE_NAME="$5"
398
+ JOB_ID="$6"
399
+ STEP_ID="$7"
400
+ TASK_ID="$8"
401
+ shift 8 # subsequent arguments are the command to run in the container
402
+ # Run
403
+ apptainer run --bind /var/spool --containall "$CONTAINER" "$@"
404
+ </pre>
405
+ </li>
406
+ <li>Add executable permissions to both scripts
407
+ <pre>chmod +x /opt/slurm-oci/run /opt/slurm-oci/slurm-oci-run-default</pre>
408
+ </li>
409
+ </ol>
410
+
411
+ <p>Once this is done, users may create a script at '~/.slurm-oci-run' if
412
+ they wish to customize the container run process, such as using a different
413
+ container runtime. Users should model this file after the default
414
+ '/opt/slurm-oci/slurm-oci-run-default'</p>
415
+
356
416
<h2 id="testing">Testing OCI runtime outside of Slurm
357
417
<a class="slurm_link" href="#testing"></a>
358
418
</h2>
@@ -458,11 +518,16 @@ scrun being isolated from the network and not being able to communicate with
458
518
the Slurm controller. The container is run by Slurm on the compute nodes which
459
519
makes having Docker setup a network isolation layer ineffective for the
460
520
container.</li>
461
- <li><pre>docker exec</pre> command is not supported.</li>
462
- <li><pre>docker compose</pre> command is not supported.</li>
463
- <li><pre>docker pause</pre> command is not supported.</li>
464
- <li><pre>docker unpause</pre> command is not supported.</li>
465
- <li><pre>docker swarm</pre> command is not supported.</li>
521
+ <li><code>docker exec</code> command is not supported.</li>
522
+ <li><code>docker swarm</code> command is not supported.</li>
523
+ <li><code>docker compose</code>/<code>docker-compose</code> command is not
524
+ supported.</li>
525
+ <li><code>docker pause</code> command is not supported.</li>
526
+ <li><code>docker unpause</code> command is not supported.</li>
527
+ <li><code>docker swarm</code> command is not supported.</li>
528
+ <li>All <code>docker</code> commands are not supported inside of containers.</li>
529
+ <li><a href="https://docs.docker.com/reference/api/engine/">Docker API</a> is
530
+ not supported inside of containers.</li>
466
531
</ol>
467
532
468
533
<h3>Setup procedure</h3>
@@ -580,9 +645,16 @@ configuration.</li>
580
645
<li>All containers must use
581
646
<a href="https://github.com/containers/podman/blob/main/docs/tutorials/basic_networking.md">
582
647
host networking</a></li>
583
- <li><pre>podman exec</pre> command is not supported.</li>
584
- <li><pre>podman kube</pre> command is not supported.</li>
585
- <li><pre>podman pod</pre> command is not supported.</li>
648
+ <li><code>podman exec</code> command is not supported.</li>
649
+ <li><code>podman-compose</code> command is not supported, due to only being
650
+ partially implemented. Some compositions may work but each container
651
+ may be run on different nodes. The network for all containers must be
652
+ the <code>network_mode: host</code> device.</li>
653
+ <li><code>podman kube</code> command is not supported.</li>
654
+ <li><code>podman pod</code> command is not supported.</li>
655
+ <li><code>podman farm</code> command is not supported.</li>
656
+ <li>All <code>podman</code> commands are not supported inside of containers.</li>
657
+ <li>Podman REST API is not supported inside of containers.</li>
586
658
</ol>
587
659
588
660
<h3>Setup procedure</h3>
@@ -875,6 +947,6 @@ Overview slides of Sarus are
875
947
876
948
<hr size=4 width="100%">
877
949
878
- <p style="text-align:center;">Last modified 08 October 2024</p>
950
+ <p style="text-align:center;">Last modified 27 November 2024</p>
879
951
880
952
<!--#include virtual="footer.txt"-->
0 commit comments