BEGIN:VCALENDAR
VERSION:2.0
PRODID:Linklings LLC
BEGIN:VTIMEZONE
TZID:America/Chicago
X-LIC-LOCATION:America/Chicago
BEGIN:DAYLIGHT
TZOFFSETFROM:-0600
TZOFFSETTO:-0500
TZNAME:CDT
DTSTART:19700308T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0500
TZOFFSETTO:-0600
TZNAME:CST
DTSTART:19701101T020000
RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DTSTAMP:20211207T054801Z
LOCATION:220-221
DTSTART;TZID=America/Chicago:20211116T160000
DTEND;TZID=America/Chicago:20211116T163000
UID:submissions.supercomputing.org_SC21_sess145_pap337@linklings.com
SUMMARY:Minimizing Privilege for Building HPC Containers
DESCRIPTION:Paper\n\nMinimizing Privilege for Building HPC Containers\n\nP
 riedhorsky, Canon, Randles, Younge\n\nHPC centers face increasing demand f
 or software flexibility, and there is growing consensus that Linux contain
 ers are a promising solution. However, existing container build solutions 
 require root privileges and cannot be used directly on HPC resources. This
  limitation is compounded as supercomputer diversity expands and HPC archi
 tectures become more dissimilar from commodity computing resources. Our an
 alysis suggests this problem can best be solved with low-privilege contain
 ers. We detail relevant Linux kernel features, propose a new taxonomy of c
 ontainer privilege, and compare two open-source implementations: mostly-un
 privileged rootless Podman and fully-unprivileged Charliecloud. We demonst
 rate that low-privilege container build on HPC resources works now and wil
 l continue to improve, giving normal users a better workflow to securely a
 nd correctly build containers. Minimizing privilege in this way can improv
 e HPC user and developer productivity as well as reduce support workload f
 or exascale applications.\n\nTag: Reproducibility Badge, State of the Prac
 tice\n\nRegistration Category: Tech Program Reg Pass\n\nReproducibility Ba
 dges: Artifact Available, Artifact Functional, Results Reproduced
END:VEVENT
END:VCALENDAR