Lockdown your Dockerized build environments --- Because privileged mode is insecure, you should restrict your CI/CD environments to known users and projects. If this isn't feasible, then instead of using Docker, you could try using a standalone image builder like Buildah to eliminate the risk. Alternatively, configuring rootless Docker-in-Docker can mitigate some --- but not all --- of the security concerns... - Source: dev.to / 9 days ago

In my experience, not using docker to build docker images is a good idea. E.g. buildah[0] with chroot isolation can build images in a GitLab pipeline, where docker would fail. It can still use the same Dockerfile though. If you want to get rid of your Dockerfiles anyway, nix can also build docker images[1] with all the added benefits of nix (reproducibility, efficient building and caching, automatic layering,... - Source: Hacker News / 7 months ago

Buildah: This lightweight, open-source command-line tool for building and managing container images. It is an efficient alternative to Docker. With Buildah, you can build images in various ways, including using a Dockerfile, a podmanfile or by running commands in a container. Buildah is a flexible, secure and powerful tool for building container images. - Source: dev.to / 12 months ago

When I saw the title I thought it was going to be about `buildah` [1][2] Which allows you to create images using the command line to build them up step-by-step. [1] https://buildah.io/. - Source: Hacker News / over 1 year ago

Buildah is a "tool that facilitates building OCI images" of Containers. If it is not installed, podman system migrate will print out the warning:. - Source: dev.to / over 1 year ago

I highly recommend checking out Singularity for your computational software. Running your software within containers allows you a lot of freedom, although it does create some complexity in regards to MPI based parallelization. Source: almost 2 years ago

Use a singularity image to contain what you want to deploy and give access on the jump host to the image. Permissions flow from existing OS permissions. https://sylabs.io/singularity/. Source: over 2 years ago

Singularity This is a HPC focused container system that has large industry support. You can use this to package finicky software that only runs on specific linux distributions or only allows for RPM/Deb installations. It is also another mechanism for users to bring their own software and it integrates fairly well with both Slurm and HTCondor. Source: over 2 years ago

> and it was then when they came up with a pretty cool name for their new OS — Singularity. Or, it was then when they (intentionally?) ripped off the name of an existing, open source, OS-related project. https://sylabs.io/singularity/. - Source: Hacker News / over 2 years ago