| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: apptainer-sle16 | Distribution: openSUSE Tumbleweed |
| Version: 1.4.5 | Vendor: openSUSE |
| Release: 3.3 | Build date: Tue Feb 10 11:04:31 2026 |
| Group: Productivity/Clustering/Computing | Build host: reproducible |
| Size: 1462 | Source RPM: apptainer-1.4.5-3.3.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://apptainer.org | |
| Summary: Apptainer Definition File Templates for SLE 16 | |
The package provides a definition file template for Apptainer containers based on SUSE Linux Enterprise 16.
BSD-3-Clause-LBNL AND OpenSSL
* Tue Feb 10 2026 Egbert Eich <eich@suse.com>
- Fix HTML parser misimplementation of a part of the HTML
specification for table related tags (CVE-2025-58190,
GO-2026-4441, bsc#1258048).
- Fix issue where the HTML parser takes a very long time or
even never returns (CVE-2025-47911, GO-2026-4440, bsc#1258047).
* Tue Jan 06 2026 Egbert Eich <eich@suse.com>
- Update ot 1.4.5
* Fix for moderate severity GO-2025-4176 / CVE-2025-65105 /
GHSA-j3rw-fx6g-q46j (bsc#1255462):
Ineffective application of selinux / apparmor --security option.
Updates of a few dependent go libraries for related security fixes.
* Other fix
Run FUSE processes in a separate process group. This detaches them
from the main process so they don't receive signals such as interrupts
sent to a terminal there. This was not a problem with interactive
shells because they start their own group, but was a problem with
some programs with interactive Read/Eval/Print/Loops such as python.
An interrupt there would kill the FUSE processes.
- From 1.4.4
* By applying patches to the bundled fuse2fs, allow again the possibility
of using a non-writable ext3 image file as an overlay. Fixes regression
introduced in 1.4.3.
* If an overlay or bound data image is asked to be mounted writable but
the user has no write access to the image, show a warning message
instead of silently switching to readonly.
* Avoid a fatal error when starting fakeroot from suid mode while
in an NFS directory.
* Fix 32-bit builds which were accidentally broken by a library
upgrade that was done for a minor security issue.
- Fix CVEs:
* GO-2025-4135 - CVE-2025-47914
Malformed constraint may cause denial of service in
golang.org/x/crypto/ssh/agent.
* GO-2025-4134 - CVE-2025-58181 - bsc#1253924
Unbounded memory consumption in golang.org/x/crypto/ssh.
* GO-2025-4116 - CVE-2025-47913
Potential denial of service in golang.org/x/crypto/ssh/agent.
* GO-2025-3595 - CVE-2025-22872
Incorrect Neutralization of Input During Web Page Generation
in x/net.
* GO-2025-3503 - CVE-2025-22870
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net.
* GO-2025-3487 - CVE-2025-22869
Potential denial of service in golang.org/x/crypto.
* GO-2025-3485 - CVE-2025-27144
DoS in go-jose Parsing in github.com/go-jose/go-jose.
* GO-2025-3754 - CVE-2025-8556
CIRCL-Fourq: Missing and wrong validation can lead to
incorrect results in github.com/cloudflare/circl.
* Tue Oct 21 2025 Guillaume GARDET <guillaume.gardet@opensuse.org>
- No need for binutils-gold for aarch64
* Thu Oct 02 2025 Christian Goll <cgoll@suse.com>
- Update to 1.4.3
* Corrected the mconfig -s option for statically building apptainer
and starter binaries.
* Resolved an issue where the Makefile generated by mconfig -b
failed when the build directory was not a subdirectory of the
Apptainer source code.
* Fixed %files in definition files to correctly copy symlinks
pointing above the destination directory but within the
destination stage root filesystem.
* Addressed a typo in nvliblist.conf ( libnvoptix.so.1 was
corrected to libnvoptix.so).
* Prevented timeouts during cleanup after building
gocryptfs-encrypted SIF files.
* Fixed a bug that prevented build with --passphrase or --pem-path
(without --encrypt) from implying fakeroot.
* Resolved a hang when copying files between build stages while
using suid mode without user namespaces.
* Fixed issues with running and building containers of different
architectures than the host via binfmt_misc when using rootless
fakeroot.
* Corrected "target: no such file or directory" errors when
extracting layers from certain OCI images that manipulate hard
links across layers.
* Fixed a crash when executing a privilege-encrypted container as
root.
* Improved documentation for the remote list command.
* Removed the fakerootcallback functionality.
* Updated the default pacman confURL for Bootstrap: arch container
builds.
* Updated bundled fuse programs to their latest releases.
* Changed the default message level from silent to normal in
nested apptainer executions of a build's %post section, and
suppressed an unnecessary warning.
* Invalid environment variables are now ignored when pulling
oci/docker containers.
- Add definition file for SLE 16 (SLE-16.def).
- Remove definition files for SLE15 SP5 (SLE-15SP5.def) and
SP6 (SLE-15SP6.def).
* Sun Sep 07 2025 Andrea Manzini <andrea.manzini@suse.com>
- Update to 1.4.2
* Restore looking for registry mirrors in /etc/containers/registry.conf
and related files. This had been inadvertently dropped beginning in 1.4.0.
* Fix use of the image cache when the home directory contains @ characters.
Previously it would assume that it was the start of a digest in the oci-dir.
* Fix signature verification failures on unsigned images.
* Add additional .deb packages to the release assets that include the label
trixie+ to indicate that they are for installing on Debian 13 or later.
Those packages are necessary to work with the new libfuse3 library in
Debian13. They also support libsubid, unlike the default packages because
they are built on Debian 11 which doesn't have that library.
* Add automatic triggering of Ubuntu PPA builds whenever there's a new
apptainer release.
* Mon Jun 02 2025 Christian Goll <cgoll@suse.com>
- Update to 1.4.1
* Fix the use of libsubid which had been broken by the revision
applied in 1.4.0-rc.2.
* Fix a bug introduced in 1.4.0 that caused arm64 to be
mis-converted to arm64v8 and resulted in a failure when pulling
OCI containers.
* Fix user database lookup in master process preventing instance
from starting correctly on systems using winbind.
* Check for existence of `/run/systemd/system` when verifying
cgroups can be used via systemd manager.
* Add a clear error message if someone tries to use privileged
network options while not using setuid mode.
* Allow multi-arch oci-archive files that have a nested index
with the manifest. This is the default format (both for Docker
and OCI) when using `nerdctl save`.
* Test if docker-archive is actually an oci-archive (since Docker
version 25), and if it is oci then use the OCI parser to avoid
bugs in the Docker parser. Save the daemon-daemon references
to a temporary docker-archive, to benefit from the same
improvements also for those references. Parse as oci-archive.
- New Features & Functionality in from ineherited 1.4.0
* Add new build option `--mksquashfs-args` to pass additional
arguments to the `mksquashfs` command when building SIF files.
If a compression method other than gzip is selected, the SIF
file might not work with older installations of Apptainer
or Singularity, so an INFO message about that is printed. On
the other hand, an INFO message that was printed (twice) when
running an image with non-gzip compression has been removed.
* If the `mksquashfs` version is new enough (version 4.6 in
Leaep 16.0), then show a percentage progress bar (with ETA)
during SIF creation in the default log level. If the `mksquashfs`
version is older, then in verbose or debug log level show the
output of mksquashfs with its own progress bar.
* Statistics are now normally available for instances that are
started by non-root users on cgroups v2 systems. The instance
will be started in the current cgroup. Information about
configuration issues that prevent collection of statistics are
displayed as INFO messages by default.
* Add a `--sandbox` option to `apptainer pull`.
* Add configuration file binding to the `--nv` option. Files
that are recognized in the NVIDIA Container Toolkit, including
files for EGL ICD, were added to the default `nvliblist.conf`.
* It is now possible to use multiple environment variable files
using the `--env-file` flag. Files can be specified as a
comma-separated list or by using the flag multiple times.
Variables defined in later files take precedence over earlier
files.
* The registry login and registry logout commands now support a
`--authfile <path>` option, which causes OCI credentials to be
written to / removed from a custom file located at `<path>`
instead of the default location (`$HOME/.apptainer/docker-config.json`).
The commands `pull`, `push`, `run`, `exec`, `shell` and
instance start can now also be passed a `--authfile <path>`
option, to read OCI registry credentials from this custom file.
* A new `--netns-path` option takes a path to a network
namespace to join when starting a container. The root user
may join any network namespace. An unprivileged user can only
join a network namespace specified in the new `allow netns
paths` directive in `apptainer.conf`, if they are also listed
in `allow net users` / `allow net groups` and apptainer is
installed with setuid privileges. Not supported with
`--fakeroot`.
* `apptainer.conf` now accepts setting the following options:
`allow ipc ns` -- Default value is `yes`; when set to `no`,
it will disable the use of the `--ipc` flag.
`allow uts ns` -- Default value is `yes`; when set to `no`,
it will invalidate the use of the `--uts` and `--hostname`
flags.
`allow user ns` -- Default value is `yes`; when set to
`no`, it will disable creation of user namespaces. Note
that this will prevent execution of containers with the
`--userns` or `--fakeroot` flags and with unprivileged
installations of Apptainer.
- Changed defaults / behaviours
* Label the starter process seen in `ps` with the image filename,
for example: Apptainer runtime parent: `example.sif`.
* Remove runtime and compute libraries from `rocmliblist.conf`.
They should instead be provided by the container image.
* Allow overriding the build architecture with `--arch` and
`--arch-variant`, to build images for another architecture
than the current host arch. This requires that the host has
been set up to support multiple architectures (`binfmt_misc`).
* Complete the previously partial support for the riscv64
architecture.
* Show a warning message if changing directory to the cwd
fails, instead of silently switching to the home directory
or `/`.
* Write starter messages to stderr when an instance fails to
start. Previously they were incorrectly written to stdout.
* Skip attempting to bind inaccessible mount points when
handling the `mount hostfs = yes` configuration option.
* Fix storage of credentials for `docker.io` to behave the same
as for `index.docker.io`.
* Change message log level from warning to debug when environment
variables set inside a container or by `APPTAINERENV` have a
different value than the environment variable on the host.
* Change the default message level from silent to the normal
level in the nested apptainer that executes a build's `%post`
section, and suppress an unnecessary warning message.
* Ignore invalid environment variables when pulling oci/docker
containers.
* Remove the little-known `fakerootcallback` functionality.
* Update the default pacman confURL for `Bootstrap: arch`
container builds.
* Update the bundled fuse programs to their latest releases.
- Bug fixes
* Fix the `mconfig -s` option to build the apptainer and starter
binaries statically as documented.
* `%files from` in a definition file will now correctly copy
symlinks that `%point` to a target above the destination
directory but inside the `%destination` stage root filesystem.
* Fixed typo in `nvliblist.conf` (`libnvoptix.so.1` -> `libnvoptix.so`).
* Avoid timeouts when cleaning up from building gocryptfs-encrypted
SIF files.
* Fix bug that prevented build with `--passphrase` or
`--pem-path` but without `--encrypt` from implying fakeroot.
* Fix hang when copying files between build stages while using
suid mode without user namespaces.
* Fix running and building containers of different architectures
than the host via binfmt_misc when using rootless fakeroot.
* Fix `target: no such file or directory` error when extracting
layers from certain OCI images that manipulate hard links
across layers.
* Fix the crash that happened when executing a privilege-encrypted
container as root.
* Tue Mar 18 2025 Egbert Eich <eich@suse.com>
- Fix CVE-2024-45338, CVE-2025-22870, CVE-2024-45337, CVE-2025-22869, CVE-2025-27144 CVE-2024-41110
* GO-2024-3333 CVE-2024-45338 (bsc#1234794)
GO-2025-3503 CVE-2025-22870 (bsc#1238611):
Update to: golang.org/x/net@v0.36.0
* GO-2024-3321 CVE-2024-45337 (bsc#1234595)
GO-2025-3487 CVE-2025-22869 (bsc#1239341):
Update to: golang.org/x/crypto@v0.35.0
* GO-2025-3485 CVE-2025-27144 (bsc#1237679):
Update to: github.com/go-jose/go-jose/v3@v3.0.4
* GO-2024-3005 CVE-2024-41110 (bsc#1228324):
Update to: github.com/docker/docker@v25.0.6+incompatible
* Wed Jan 29 2025 Egbert Eich <eich@suse.com>
- Update golang.org/x/net to v0.23 to fix CVE-2023-45288
(bnc#1236528).
* Fri Jan 03 2025 Egbert Eich <eich@suse.com>
- Update to version 1.3.6
* Avoid using kernel overlayfs when the lower layer is a sandbox
on an incompatible filesystem type such as GPFS or Lustre.
For those cases use fuse-overlayfs instead. This fixes a
regression introduced in 1.3.0. The regression didn't much
impact Lustre because kernel overlayfs refused to try to use
it and Apptainer proceeded to use fuse-overlayfs anyway, but
with GPFS the kernel overlayfs allowed mounting but returned
stale file handle errors.
- Version 1.3.5
* Fix a regression introduced in 1.3.4 that overwrote existing
standard `/.singularity.d` files such as `runscript` in
container images even if they had been modified.
* Skip attempting to bind inaccessible mount points when
handling the `mount hostfs = yes` configuration option.
* Support parsing nested variables defined inside `%arguments`
section of definition files.
* Ignore invalid environment variables when pulling oci/docker
containers.
- Version 1.3.4
* Fixed sif-embedded overlay partitions for containers that are
larger than 2 gigabytes.
* Fixed the failure when starting apptainer with
`instance --fakeroot`.
* `apptainer build -B ...` can now be used to mount custom
resolv.conf and hosts files from non-standard outside locations.
This can be used to run `apptainer build` in a nix-build sandbox
that has no `/etc/resolv.conf`.
* Fixed failing builds from local images that have symbolic links
for paths that are part of the base container environment (e.g.
/var/tmp -> /tmp).
* Show info messages suggesting to use
`enable underlay = preferred` or the `--underlay` flag when
overlay is implied for bind mounts but the kernel is too old
to support fuse mounts in user namespaces and so tries to use
fusermount.
* When someone uses a `yum` bootstrap to build a container
without using subuid-based fakeroot or root, warn that it is
unlikely to work.
* Allow a writable `--overlay` to be used with `--nvccli` instead
of `--writable-tmpfs`.
* If an error "no descriptor found for reference" is seen while
getting an oci container, retry the operation up to five times.
* Make fakeroot Recommended for SUSE rpms instead of Required.
* Allow bind mounts onto existing files on r/o NFS filesystems.
* If an error is seen in the %post section when building a
container using fakeroot mode 3 (with the fakeroot command)
then show a message suggesting using `--ignore-fakeroot-command`
and referring to the documentation about how to install and use
it inside the container definition file.
* Show a more helpful error message when using fakeroot in suid
mode and there's an `/etc/subuid` mapping even though user
namespaces are not available (user namespaces are required for
`/etc/subuid` mapping).
- Version 1.3.3
* Added libcudadebugger.so to nvliblist.conf to support cuda-gdb
in CUDA 12+.
* Ensure opened/kept file descriptors in stage 1 are not closed
during the Go garbage collection to avoid "bad file descriptor"
errors at startup.
* Fixed a segmentation violation issue when running Apptainer
checkpoint.
* Fixed an issue that Apptainer won't read default docker
credentials.
- Version 1.3.2
* Fix for
[CVE-2024-3727](https://bugzilla.suse.com/show_bug.cgi?id=1224114)
in a dependent library which describes a flaw that can allow
attackers to trigger unexpected authenticated registry accesses
due to object digest values not being validated in all cases.
* Fixed the issue when nesting `apptainer instance start` inside
a container on cgroups-v2 capable host.
* Fixed the issue that oras download progress bar gets stuck
when downloading large images.
- Version 1.3.1
* Make 'apptainer build' work with signed Docker containers.
* Fixed regression introduced in 1.3.0 that prevented closing
cryptsetup and the corresponding loop device after running
an encrypted sif container file in suid mode.
* Stopped binding over the default timezone in the container
with the host's timezone, which led to unexpected behavior if
the application changed timezones.
* Added progress bars for `oras://` push and pull.
* Hide `Instance stats will not be available` message under
`--sharens` mode.
* Fix problem where credentials locally stored with
`registry login` command were not usable in some execution
flows. Run `registry login` again with latest version to ensure
credentials are stored correctly.
* Make runscript timeout configurable.
* Return invalid bind path mount options during bind path
parsing.
* Make the INFO message more helpful when a running background
process at exit time causes a FUSE mount to not shut down
cleanly.
* Fixed the wrong mediaType in the oras push manifest.
- Add Apptainer definition template for SLE15-SP7.
- Obsoleted:
* Remove-signatures-from-Docker-images.patch
* Bump-github.com-containers-image-v5-from-5.30.0-to-5.30.1.patch
- Make sure, build is reproducible by setting the GNU build ID to one
derived from the Go one. See https://pkg.go.dev/cmd/link.
- Use go-jose version with fix for CVE-2024-28180 (bsc#1235211).
* Mon May 13 2024 Egbert Eich <eich@suse.com>
- Make sure, digest values handled by the Go library
github.com/opencontainers/go-digest and used throughout the
Go-implemented containers ecosystem are always validated. This
prevents attackers from triggering unexpected authenticated
registry accesses.
* Bump-github.com-containers-image-v5-from-5.30.0-to-5.30.1.patch
(CVE-2024-3727, bsc#1224114).
* Fri Mar 15 2024 Christian Goll <cgoll@suse.com>
- Updated apptainer to version 1.3.0
* FUSE mounts are now supported in setuid mode, enabling full
functionality even when kernel filesystem mounts are insecure due to
unprivileged users having write access to raw filesystems in
containers. When allow `setuid-mount extfs = no` (the default) in
apptainer.conf, then the fuse2fs image driver will be used to mount
ext3 images in setuid mode instead of the kernel driver (ext3 images
are primarily used for the `--overlay` feature), restoring
functionality that was removed by default in Apptainer 1.1.8 because
of the security risk.
The allow `setuid-mount squashfs` configuration option in
`apptainer.conf` now has a new default called `iflimited` which allows
kernel squashfs mounts only if there is at least one `limit container`
option set or if Execution Control Lists are activated in ecl.toml.
If kernel squashfs mounts are are not allowed, then the squashfuse
image driver will be used instead.
`iflimited` is the default because if one of those limits are used
the system administrator ensures that unprivileged users do not have
write access to the containers, but on the other hand using FUSE
would enable a user to theoretically bypass the limits via `ptrace()`
because the FUSE process runs as that user.
The `fuse-overlayfs` image driver will also now be tried in setuid
mode if the kernel overlayfs driver does not work (for example if
one of the layers is a FUSE filesystem). In addition, if `allow
setuid-mount encrypted = no` then the unprivileged gocryptfs format
will be used for encrypting SIF files instead of the kernel
device-mapper. If a SIF file was encrypted using the gocryptfs
format, it can now be mounted in setuid mode in addition to
non-setuid mode.
* Change the default in user namespace mode to use either kernel
overlayfs or fuse-overlayfs instead of the underlay feature for the
purpose of adding bind mount points. That was already the default in
setuid mode; this change makes it consistent. The underlay feature
can still be used with the `--underlay` option, but it is deprecated
because the implementation is complicated and measurements have
shown that the performance of underlay is similar to overlayfs and
fuse-overlayfs.
For now the underlay feature can be made the default again with a
new `preferred` value on the `enable underlay` configuration option.
Also the `--underlay` option can be used in setuid mode or as the
root user, although it was ignored previously.
* Prefer again to use kernel overlayfs over fuse-overlayfs when a
lower layer is FUSE and there's no writable upper layer, undoing the
change from 1.2.0. Another workaround was found for the problem that
change addressed. This applies in both setuid mode and in user
namespace mode.
* `--cwd` is now the preferred form of the flag for setting the
container's working directory, though `--pwd` is still supported for
compatibility.
* The way `--home` is handled when running as root (e.g. sudo apptainer)
or with `--fakeroot` has changed. Previously, we were only modifying
the `HOME` environment variable in these cases, while leaving the
container's `/etc/passwd` file unchanged (with its homedir field
pointing to `/root`, regardless of the value passed to `--home`). With
this change, both value of HOME and the contents of `/etc/passwd` in
the container will reflect the value passed to `--home` if the
container is readonly. If the container is writable, the
`/etc/passwd` file is left alone because it can interfere with
commands that want to modify it.
* The `--vm` and related flags to start apptainer inside a VM have been
removed. This functionality was related to the retired Singularity Desktop
/ SyOS projects.
* The keyserver-related commands that were under `remote` have been moved to
their own, dedicated `keyserver` command. Run `apptainer help keyserver`
for more information.
* The commands related to OCI/Docker registries that were under `remote` have
been moved to their own, dedicated `registry` command. Run
`apptainer help registry` for more information.
* The the `remote list` subcommand now outputs only remote endpoints (with
keyservers and OCI/Docker registries having been moved to separate
commands), and the output has been streamlined.
* Adding a new remote endpoint using the `apptainer remote add` command will
now set the new endpoint as default. This behavior can be suppressed by
supplying the `--no-default` (or `-n`) flag to `remote add`.
* Skip parsing build definition file template variables after comments
beginning with a hash symbol.
* The global `/tmp` directory is no longer used for gocryptfs mountpoints.
- New Features & Functionality
* The `remote status` command will now print the username, realname, and
email of the logged-in user, if available.
* Add monitoring feature support, which requires the usage of an
additional tool named `apptheus`, this tool will put apptainer starter
into a newly created cgroup and collect system metrics.
* A new `--no-pid` flag for `apptainer run/shell/exec` disables the PID
namespace inferred by `--containall` and `--compat`.
* Added `--config` option to `keyserver` commands.
* Honor an optional remoteName argument to the `keyserver list` command.
* Added the `APPTAINER_ENCRYPTION_PEM_DATA` env var to allow for
encrypting and running encrypted containers without a PEM file.
* Adding `--sharens` mode for `apptainer exec/run/shell`, which enables to
run multiple apptainer instances created by the same parent using
the same image in the same user namespace.
- Make 'gocryptfs' an optional dependency.
- Make apptainer definition templates version dependent.
* Wed Mar 13 2024 Egbert Eich <eich@suse.com>
- Fix 'apptainer build' using signed packages from the SUSE
Registry (bsc#1221364).
* Remove-signatures-from-Docker-images.patch
* Wed Jan 31 2024 Egbert Eich <eich@suse.com>
- Updated apptainer to version 1.2.5
* Added `libnvidia-nvvm` to `nvliblist.conf`. Newer NVIDIA
Drivers (known with >= 525.85.05) require this lib to compile
OpenCL programs against NVIDIA GPUs, i.e. `libnvidia-opencl`
depends on `libnvidia-nvvm`.
* Disable the usage of cgroup in instance creation when
`--fakeroot` is passed.
* Disable the usage of cgroup in instance creation when `hidepid`
mount option on `/proc` is set.
* Fixed a regression introduced in 1.2.0 where the user's
password file information was not copied in to the container
when there was a parent root-mapped user namespace (as is the
case for example in `cvmfsexec`).
* Added the upcoming NVIDIA driver library `libnvidia-gpucomp.so`
to the list of libraries to add to NVIDIA GPU-enabled
containers. Fixed missing error handling during the creation
of an encrypted image that lead to the generation of corrupted
images.
* Use `APPTAINER_TMPDIR` for temporary files during privileged
image encryption.
* If rootless unified cgroups v2 is available when starting an
image but `XDG_RUNTIME_DIR` or `DBUS_SESSION_BUS_ADDRESS` is
not set, print an info message that stats will not be available
instead of exiting with a fatal error.
* Allow templated build arguments to definition files to have
empty values.
- Package .def templates separately for different SPs.
* Tue Oct 24 2023 Egbert Eich <eich@suse.com>
- Do not build squashfuse, require it as a dependency.
Removed: squashfuse-0.1.105.tar.gz, 70.patch
- Replace awkward 'Obsoletes: singularity-*' as well as the
'Provides: Singularity' by 'Conflicts:' and drop the provides -
the versioning scheme does not match and we do not automatically
migrate from one to the other.
- Exclude platforms which do not provide all build dependencies.
* Wed Sep 27 2023 Christian Goll <cgoll@suse.com>
- removed CRYPTOGAMS license as not known in OBS and OpenSSL is
also valid
* Mon Sep 25 2023 Christian Goll <cgoll@suse.com>
- updated to 1.2.3 with following changes:
* The apptainer push/pull commands now show a progress bar for the oras
protocol like there was for docker and library protocols.
* The --nv and --rocm flags can now be used simultaneously.
* Fix the use of APPTAINER_CONFIGDIR with apptainer instance start and action
commands that refer to instance://.
* Fix the issue that apptainer would not read credentials from the Docker
fallback path ~/.docker/config.json if missing in the apptainer
credentials.
* Tue Aug 29 2023 Lubos Kocman <lubos.kocman@suse.com>
- Update license for the package to cover also OpenSSL and CRYPTOGAMS
part of chacha_ppc64le.s
* Fri Jul 28 2023 Christian Goll <cgoll@suse.com>
- updated to 1.2.2 with following changes:
* Fix $APPTAINER_MESSAGELEVEL to correctly set the logging level.
* Fix build failures when in setuid mode and unprivileged user namespaces are
unavailable and the --fakeroot option is not selected.
* Wed Jul 26 2023 Christian Goll <cgoll@suse.com>
- updated to 1.2.1 to fix CVE-2023-38496 although not relevant as package is
compiled with setuid
* Wed Jun 14 2023 Christian Goll <cgoll@suse.com>
- update to 1.2.0 with following changes:
* binary is built reproducible which disables plugins
* Create the current working directory in a container when it doesn't exist.
This restores behavior as it was before singularity 3.6.0. As a result,
using --no-mount home won't have any effect when running apptainer from a
home directory and will require --no-mount home,cwd to avoid mounting that
directory.
* Handle current working directory paths containing symlinks both on the host
and in a container but pointing to different destinations. If detected, the
current working directory is not mounted when the destination directory in
the container exists.
* Destination mount points are now sorted by shortest path first to ensure
that a user bind doesn't override a previous bind path when set in
arbitrary order on the CLI. This is also applied to image binds.
* When the kernel supports unprivileged overlay mounts in a user namespace,
the container will be constructed by default using an overlay instead of an
underlay layout for bind mounts. A new --underlay action option can be used
to prefer underlay instead of overlay.
* sessiondir maxsize in apptainer.conf now defaults to 64 MiB for new
installations. This is an increase from 16 MiB in prior versions.
* The apptainer cache is now architecture aware, so the same home directory
cache can be shared by machines with different architectures.
* Overlay is blocked on the panfs filesystem, allowing sandbox directories to
be run from panfs without error.
* Lookup and store user/group information in stage one prior to entering any
namespaces, to fix an issue with winbind not correctly looking up
user/group information when using user namespaces.
- New features / functionalities
* Support for unprivileged encryption of SIF files using gocryptfs. This is
not compatible with privileged encryption, so containers encrypted by root
need to be rebuilt by an unprivileged user.
* Templating support for definition files. Users can now define variables in
definition files via a matching pair of double curly brackets. Variables of
the form {{ variable }} will be replaced by a value defined either by a
variable=value entry in the %arguments section of the definition file or
through new build options --build-arg or --build-arg-file.
* Add a new instance run command that will execute the runscript when an
instance is initiated instead of executing the startscript.
* The sign and verify commands now support signing and verification with
non-PGP key material by specifying the path to a private key via the --key
flag.
* The verify command now supports verification with X.509 certificates by
specifying the path to a certificate via the --certificate flag. By
default, the system root certificate pool is used as trust anchors unless
overridden via the --certificate-roots flag. A pool of intermediate
certificates that are not trust anchors, but can be used to form a
certificate chain, can also be specified via the
- -certificate-intermediates flag.
* Support for online verification checks of X.509 certificates using OCSP
protocol via the new verify --ocsp-verify option.
* The instance stats command displays the resource usage every second. The
- -no-stream option disables this interactive mode and shows the
point-in-time usage.
* Instances are now started in a cgroup by default, when run as root or when
unified cgroups v2 with systemd as manager is configured. This allows
apptainer instance stats to be supported by default when possible.
* The instance start command now accepts an optional --app <name> argument
which invokes a start script within the %appstart <name> section in the
definition file. The instance stop command still only requires the instance
name.
* The instance name is now available inside an instance via the new
APPTAINER_INSTANCE environment variable.
* The --no-mount flag now accepts the value bind-paths to disable mounting of
all bind path entries in apptainer.conf.
Support for DOCKER_HOST parsing when using docker-daemon://
DOCKER_USERNAME and DOCKER_PASSWORD supported without APPTAINER_ prefix.
Add new Linux capabilities CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE.
* The remote get-login-password command allows users to retrieve a remote's
token. This enables piping the secret directly into docker login while
preventing it from showing up in a shell's history.
* Define EUID in %environment alongside UID.
* In --rocm mode, the whole of /dev/dri is now bound into the container when
- -contain is in use. This makes /dev/dri/render devices available, required
for later ROCm versions.
* Tue Jun 13 2023 Christian Goll <cgoll@suse.com>
- update to 1.1.9 with following changes:
* Remove warning about unknown xino=on option from fuse-overlayfs, introduced
in 1.1.8.
* Ignore extraneous warning from fuse-overlayfs about a readonly /proc.
* Fix dropped "n" characters on some platforms in definition file stored as
part of SIF metadata.
* Remove duplicated group ids.
* Fix not being able to handle multiple entries in LD_PRELOAD when binding
fakeroot into container during apptainer startup for --fakeroot with
fakeroot command.
* Thu Apr 27 2023 Christian Goll <cgoll@suse.com>
- Included a fix for CVE-2023-30549 which is a vulnerability in setuid-root
installations of Apptainer iwhich was not active in the recent openSUSE
packages. Still this is included for completenss. The fix adds allow
setuid-mount configuration options encrypted, squashfs, and extfs, and makes
the default for extfs be "no". That disables the use of extfs mounts
including for overlays or binds while in the setuid-root mode, while leaving
it enabled for unprivileged user namespace mode. The default for encrypted
and squashfs is "yes".
- Other bug fixes:
* Fix loop device 'no such device or address' spurious errors when using shared
loop devices.
* Add xino=on mount option for writable kernel overlay mount points to fix
inode numbers consistency after kernel cache flush (not applicable to
fuse-overlayfs).
* Wed Mar 29 2023 Christian Goll <cgoll@suse.com>
- updated to 1.1.7 with following changes:
* removed simpler-sif-building.patch as this was incoperated upstream
* Allow gpu options such as --nv to be nested by always inheriting all
libraries bound in to a parent container's /.singularity.d/libs.
* Map the user's home directory to the root home directory by default in the
non-subuid fakeroot mode like it was in the subuid fakeroot mode, for both
action commands and building containers from definition files.
* Make the error message more helpful in another place where a remote is
found to have no library client.
* Avoid incorrect error when requesting fakeroot network.
* Pass computed LD_LIBRARY_PATH to wrapped unsquashfs. Fixes issues where
unsquashfs on host uses libraries in non-default paths.
* Fri Feb 24 2023 Christian Goll <cgoll@suse.com>
- added simple sif building for SLE systems via suseconnect-container
- added files:
* simpler-sif-building.patch
* SLE-12SP5.def
* leap.def
* Wed Feb 15 2023 Christian Goll <cgoll@suse.com>
- update to 1.1.6 with following changes:
* Included a fix for CVE-2022-23538 which potentially leaked user credentials
to a third-party S3 storage service when using the library:// protocol. See
the https://github.com/sylabs/scs-library-client/security/advisories/GHSA-7p8m-22h4-9pj7
for details.
* Make PS1 environment variable changeable via %environment section on
definition file that used to be only changeable via APPTAINERENV_PS1
outside of container. This makes the container's prompt customizable.
* Fix the passing of nested bind mounts when there are multiple binds
separated by commas and some of them have colons separating sources and
destinations.
* Hide messages about SINGULARITY variables if corresponding APPTAINER
variables are defined. Fixes a regression introduced in 1.1.4.
* Print a warning if extra arguments are given to a shell action, and show in
the run action usage that arguments may be passed.
* Check for the existence of the runtime executable prefix, to avoid issues
when running under Slurm's srun. If it doesn't exist, fall back to the
compile-time prefix.
* Increase the timeout on image driver (that is, FUSE) mounts from 2 seconds
to 10 seconds. Instead, print an INFO message if it takes more than 2
seconds.
* If a remote is defined both globally (i.e. system-wide) and individually,
change apptainer remote commands to print an info message instead of
exiting with a fatal error and to give precedence to the individual
configuration.
* Wed Jan 11 2023 Christian Goll <cgoll@suse.com>
- Update to 1.1.5 with following changes:
* Fix the use of fakeroot, faked, and libfakeroot.so if they are not suffixed
by -sysv, as is for instance the case on Gentoo Linux.
* Prevent the use of a --libexecdir or --bindir mconfig option from making
apptainer think it was relocated and so preventing use of suid mode. The
bug was introduced in v1.1.4.
* Add helpful error message for build --remote option.
* Add more helpful error message when no library endpoint found.
* Avoid cleanup errors on exit when mountpoints are busy by doing a lazy
unmount if a regular unmount doesn't work after 10 tries.
* Make messages about using SINGULARITY variables less scary.
/usr/share/apptainer/templates/SLE-16.def
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Jul 24 16:18:25 2026