Installing Apptainer

Installing Apptainer

https://github.com/apptainer/apptainer/blob/main/INSTALL.md#apparmor-profile-ubuntu-2404

Installing Apptainer Since you are reading this from the Apptainer source code, it will be assumed that you are building/compiling from source.

For more complete instructions on installation options, including options that install Apptainer from pre-compiled binaries, please check the installation section of the admin guide.

Install system dependencies You must first install development tools and libraries to your host.

On Debian-based systems, including Ubuntu:

Ensure repositories are up-to-date

sudo apt-get update

Install debian packages for dependencies

sudo apt-get install -y
build-essential
libseccomp-dev
uidmap
fakeroot
cryptsetup
tzdata
dh-apparmor
curl wget git Including for libsubid support (requires at least Ubuntu Noble or Debian Bookworm):

sudo apt-get install -y libsubid-dev On RHEL or its derivatives or Fedora:

Install basic tools for compiling

sudo dnf groupinstall -y ‘Development Tools’

Ensure EPEL repository is available

sudo dnf install -y epel-release

Install RPM packages for dependencies

sudo dnf install -y
libseccomp-devel
fakeroot
cryptsetup
wget git For including libsubid support, use –enablerepo=devel for el8 and el9 but not for el10 or fedora:

sudo dnf –enablerepo=devel install -y shadow-utils-subid-devel On SLE/openSUSE

Install RPM packages for dependencies

sudo zypper install -y
libseccomp-devel
libuuid-devel
openssl-devel
fakeroot
cryptsetup sysuser-tools
diffutils wget which git

Install basic tools for compiling

–replacefiles is needed to avoid pam conflict on Tumbleweed

sudo zypper install -y –replacefiles –allow-downgrade -t pattern devel_basis For libsubid support (requires openSUSE Tumbleweed):

sudo zypper install -y –allow-downgrade libsubid-devel Install Go Apptainer is written in Go, and may require a newer version of Go than is available in the repositories of your distribution. We recommend installing the latest version of Go from the official binaries.

First, download the Go tar.gz archive to /tmp, then extract the archive to /usr/local.

NOTE: if you are updating Go from a older version, make sure you remove /usr/local/go before reinstalling it.

export GOVERSION=1.25.3 OS=linux ARCH=amd64 # change this as you need

wget -O /tmp/go${GOVERSION}.${OS}-${ARCH}.tar.gz
https://dl.google.com/go/go${GOVERSION}.${OS}-${ARCH}.tar.gz sudo tar -C /usr/local -xzf /tmp/go${GOVERSION}.${OS}-${ARCH}.tar.gz Finally, add /usr/local/go/bin to the PATH environment variable:

echo ‘export PATH=$PATH:/usr/local/go/bin’ » ~/.bashrc source ~/.bashrc Install golangci-lint If you will be making changes to the source code, and submitting PRs, you should install golangci-lint, which is the linting tool used in the Apptainer project to ensure code consistency.

Every pull request must pass the golangci-lint checks, and these will be run automatically before attempting to merge the code. If you are modifying Apptainer and contributing your changes to the repository, it’s faster to run these checks locally before uploading your pull request.

In order to download and install the latest version of golangci-lint, you can run:

curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s – -b $(go env GOPATH)/bin v2.3.1 Add $(go env GOPATH) to the PATH environment variable:

echo ‘export PATH=$PATH:$(go env GOPATH)/bin’ » ~/.bashrc source ~/.bashrc Clone the repo With the adoption of Go modules you no longer need to clone the Apptainer repository to a specific location.

Clone the repository with git in a location of your choice:

git clone https://github.com/apptainer/apptainer.git cd apptainer By default your clone will be on the main branch which is where development of Apptainer happens. To build a specific version of Apptainer, check out a release tag before compiling, for example:

git checkout v1.4.5 Compiling Apptainer You can configure, build, and install Apptainer using the following commands:

./mconfig cd $(/bin/pwd)/builddir make sudo make install Now you can check your Apptainer version by running:

apptainer –version The mconfig command accepts options that can modify the build and installation of Apptainer. For example, to build in a different folder and to set the install prefix to a different path:

./mconfig -b ./buildtree -p /usr/local If you want a setuid-installation (formerly the default) use the –with-suid option.

See the output of ./mconfig -h for available options.

Compiling dependent FUSE-based packages In most cases Apptainer uses FUSE-based packages in order to mount filesystems. Often some of these packages are available in Linux distributions but are out of date for Apptainer needs, so they need to be compiled and installed with Apptainer following these directions.

First, make sure that additional required packages are installed. On Debian:

sudo apt-get install -y autoconf automake libtool pkg-config libfuse3-dev
zlib1g-dev liblzo2-dev liblz4-dev liblzma-dev libzstd-dev On RHEL or derivatives:

sudo dnf install -y fuse3-devel lzo-devel lz4-devel On SLE/openSUSE:

sudo zypper install -y –allow-downgrade gzip fuse3-devel
lzo-devel liblz4-devel xz-devel libzstd-devel To download the source code from the top level of the Apptainer source tree do:

./scripts/download-dependencies Then to compile and install do this:

./scripts/compile-dependencies sudo ./scripts/install-dependencies Apparmor Profile (Ubuntu 23.10+) Beginning with the 23.10 release and including the 24.04 LTS release, Ubuntu does not permit applications to create unprivileged user namespaces by default.

If you install Apptainer from a GitHub release .deb package then an apparmor profile will be installed that permits Apptainer to create unprivileged user namespaces.

If you install Apptainer from source you must either configure apparmor or disable the restriction on unprivileged user namespaces. To create an apparmor profile:

sudo tee /etc/apparmor.d/apptainer « ‘EOF’

Permit unprivileged user namespace creation for apptainer starter

abi <abi/4.0>, include <tunables/global> profile apptainer /usr/local/libexec/apptainer/bin/starter{,-suid} flags=(unconfined) { userns, # Site-specific additions and overrides. See local/README for details. include if exists <local/apptainer> } EOF Modify the path beginning /usr/local if you specified a non-default –prefix when configuring and installing Apptainer.

Reload the system apparmor profiles after you have created the file:

sudo systemctl reload apparmor Apptainer will now be able to create unprivileged user namespaces on your system.

If instead you want to allow unprivileged users to create any unprivileged user namespace do the following:

sudo sh -c ‘echo kernel.apparmor_restrict_unprivileged_userns=0
>/etc/sysctl.d/90-disable-userns-restrictions.conf’ sudo sysctl -p /etc/sysctl.d/90-disable-userns-restrictions.conf Building & Installing from RPM On a RHEL / Fedora /SUSE machine you can build an Apptainer into rpm packages, and install it from them. This is useful if you need to install Apptainer across multiple machines, or wish to manage all software via dnf (or zypper for SUSE).

To build the rpms, in addition to the system dependencies and the extra required packages needed for dependent FUSE-based packages, also install these extra packages:

sudo dnf install -y rpm-build golang or on SLE/openSUSE:

sudo zypper install -y rpm-build go The rpm build will use the OS distribution or EPEL version of Go, or it will use a different installation of Go, whichever is first in $PATH. If the first go found in $PATH is too old, then the rpm build uses that older version to compile the newer go toolchain from source. This mechanism is necessary for rpm build systems that do not allow downloading anything from the internet. In order to make use of this mechanism, use the mconfig –only-rpm option to skip the minimum version check. mconfig will then create a .spec file that looks for a go source tarball in the rpm build’s current directory. If you need it, download the go tarball:

wget https://dl.google.com/go/go$(scripts/get-min-go-version).src.tar.gz Then download the latest apptainer release tarball:

VERSION=1.4.5 # this is the apptainer version, change as you need

Fetch the source

wget https://github.com/apptainer/apptainer/releases/download/v${VERSION}/apptainer-${VERSION}.tar.gz Next download the source for the FUSE-based dependencies:

tar xvf apptainer-${VERSION}.tar.gz apptainer-${VERSION}/scripts tar xvf apptainer-${VERSION}.tar.gz apptainer-${VERSION}/dist/rpm cd apptainer-${VERSION} ./scripts/download-dependencies .. cd .. rm -rf apptainer-${VERSION} Then build the rpms from the tarball:

rpmbuild -tb apptainer-${VERSION}.tar.gz

Install Apptainer using the resulting rpm

RPMVERSION=”$(scripts/rpm-version “${VERSION}”)” sudo rpm -Uvh ~/rpmbuild/RPMS/x86_64/apptainer-${RPMVERSION}-1.el8.x86_64.rpm

(Optionally) Install the setuid-root portion

sudo rpm -Uvh ~/rpmbuild/RPMS/x86_64/apptainer-suid-${RPMVERSION}-1.el8.x86_64.rpm

(Optionally) Remove the build tree, source, and dependencies

rm -rf ~/rpmbuild apptainer-${VERSION}.tar.gz ./scripts/clean-dependencies Alternatively, to build RPMs from the latest source code you can clone the repo as detailed above, and run ./mconfig. Then use the rpm make target to build Apptainer as rpm packages, for example like this if you already have a new enough golang first in your PATH:

./mconfig ./scripts/download-dependencies make -C builddir rpm VERSION=”$(scripts/get-version)” RPMVERSION=”$(scripts/rpm-version ${VERSION})” sudo rpm -ivh ~/rpmbuild/RPMS/x86_64/apptainer-${RPMVERSION}-1.x86_64.rpm

(Optionally) Install the setuid-root portion

sudo rpm -ivh ~/rpmbuild/RPMS/x86_64/apptainer-suid-${RPMVERSION}-1.x86_64.rpm

(Optionally) Remove the build tree, source, and dependency sources

rm -rf ~/rpmbuild apptainer-${VERSION}.tar.gz ./scripts/clean-dependencies By default, the rpms will be built so that Apptainer is installed in standard Linux paths under /.

To build rpms with an alternative install prefix set RPMPREFIX on the make step, for example:

make -C builddir rpm RPMPREFIX=/opt/apptainer For more information on installing/updating/uninstalling RPMs, check out our admin docs.

Debian Package Information on how to build Debian packages can be found in dist/debian/DEBIAN_PACKAGE.md.

Run E2E tests To run the E2E test suite see e2e/README.md.