Charliecloud: Unprivileged Containers for User-Defined Software Stacks in HPC
summary
Charliecloud uses Linux user and mount namespaces to run industry-standard Docker images on HPC without privileged daemons, claiming a minimal trusted runtime of 900 lines of code. Workflow builds images locally with Docker, converts them with docker-to-tar then CH tar/tutor, uploads a single exploded tree and runs with ch-run, preserving near-native performance and InfiniBand/GPU access for MPI jobs. Tests show performance differences are negligible versus native, while Docker overlayfs layering is avoided to prevent file I/O slowdown.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:11History of HPC
- 1:43Parallel Applications
- 5:46Bring Your Own Environment
- 7:14Compile Yourself
- 8:44Environment Manager
- 11:51Virtualization
- 13:52Containers
- 16:16Challenges
- 17:10What are containers
- 19:25What are namespaces
- 25:58The container landscape
- 31:30Other components
- 33:09Security
- 37:01Live Demo
- 40:22Performance
- 40:42Resources
- 42:17Questions
related talks
30mContainers and Security on Planet X
34mUnprivileged Image Builds: What are the Challenges and Where are we Today?
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
50mConfidential Containers: Why, How, and Where Are We?
40m"Willy Wonka and the Secure Container Factory"
27mTrust No One: Bringing Confidential Computing to Containers
31mYour Containers Aren’t Alone: Demystifying Container Isolation
47mContainers - the little Linux feature revolutionizing apps