Guidance on Choosing Between Apptainer and SingularityCE for Computational Materials Science Applications.

[hongyi-zhao]

Hello Singularity Team,

I am a researcher in the field of computational materials science, frequently using tools such as VASP, CP2K, and LAMMPS for my computational studies. I am currently evaluating container solutions to enhance the reproducibility and portability of my research environments across different computing systems.

Given the close relationship and history between Apptainer and SingularityCE, I am seeking advice on which container solution would be more suitable for my specific use case. Here are some specific questions I have:

1. Are there any significant differences in performance or compatibility in HPC environments between Apptainer and SingularityCE when running applications like VASP, CP2K, and LAMMPS?
2. Has Apptainer introduced any new features or enhancements that are particularly beneficial for computational sciences, which might not be present in SingularityCE?
3. Considering the need for easy configuration and robustness, which platform would you recommend for someone primarily focused on computational materials science?

Your insights will be incredibly valuable to me and will greatly influence my decision on which technology to adopt for my research.

See here for the related discussion.

Thank you very much for your time and assistance.

Best regards,
Zhao

[dtrudg]

Hi @hongyi-zhao. I have transferred your issue to a discussion thread, as it is not a bug or feature request, but is a usage related question.

At this time, there are four main functional differences between SingularityCE and Apptainer, from my point of view as a SingularityCE maintainer:

• SingularityCE uses a setuid binary to create containers by default, while Apptainer uses unprivileged user namespaces by default. There are different security concerns for each approach. Some HPC sites favour user namespaces, and some setuid due to the different trade-offs. Some workflows require additional configuration when using unprivileged user namespaces. Some things only work in setuid mode, e.g. maintaining true membership of supplementary groups inside a container. Note that SingularityCE can be configured to use unprivileged user namespaces, and Apptainer can be configured to use setuid - so this is not a hard distinction between them.

• SingularityCE has introduced a new OCI-Mode, which aims for better compatibility with Docker containers, and improved integration with OCI-first workflows. It does this by storing OCI images more faithfully than the default 'native mode', and executing them with runc or crun as the low-level runtime. Apptainer has not implemented this OCI-Mode functionality at all.

• SingularityCE is configured to access the services at https://cloud.sylabs.io by default - a library for sharing containers, a remote build service for building containers, and a keystore for managing PGP signing keys. Apptainer can be manually configured to use the library, but cannot use the remote builder. The Apptainer developers chose to remove this functionality from their project.

• Apptainer allows unprivileged users to build containers with --fakeroot locally under more system configurations. This is beneficial to some, but others are confused because there are multiple approaches and various different limitations during container builds performed with the --fakeroot flag on different systems. SingularityCE generally focuses more on avoiding disparate behaviour between underlying systems to reduce user confusion. --fakeroot in Apptainer follows different code paths, depending on system configuration, which means that builds may fail in different ways on different systems. In SingularityCE --fakeroot always uses the same subuid/subgid approach that has specific requirements. An alternative that does not require subuid/subgid configuration, but has limitations, is implemented differently, outside of the --fakeroot mode. The remote build service (see above) also allows you to build containers from a system without root privileges.

I'd also like to stress that both projects are Open Source software, distributed under the BSD license. Although the main developers of SingularityCE are employed by Sylabs, it is not (as suggested in some material online) a proprietary commercial project. Both SingularityCE and Apptainer developers work with and accept contributions from the open source community.

A great way of verifying that SingularityCE is a true open source project, is to take a look at how much of the development work in SingularityCE has been imported by the Apptainer developers into their project.

With regard to your specific questions:

1. It is possible (depending on the specifics of your system) that it would be easier to execute MPI runs of applications in SingularityCE's default setuid mode, compared to Apptainer's default user namespace mode. However, since you can configure SingularityCE and Apptainer for either mode this is not a hard blocker. Otherwise there should be no significant compatibility or performance differences. If you are a heavy user of group-based access to files, you may also find that setuid mode is easier to work with.

2. I am not aware of any significant features that Apptainer has introduced, and which are missing from SingularityCE, that would beneficial. The OCI-Mode, present in SingularityCE but not Apptainer, may be beneficial if you need better compatibility with Docker / OCI containers than SingularityCE's native mode (or Apptainer) can provide.

3. I would recommend SingularityCE if you use Docker container images heavily, because of the availability of OCI-Mode that is absent in Apptainer. Otherwise, good questions to make a decision on are:

• Do systems I will need to use run SingularityCE or Apptainer?
• Which project seems like it would be more responsive to questions / issues I have.
• Is there anything planned in the future roadmap for SingularityCE, or the Apptainer milestones, which would be useful to me?
• Is access to the full set of cloud.sylabs.io services with SingularityCE more convenient than the alternatives that Apptainer may permit?

Edited 2024-05-29 to clarify unpriv build bullet point

[dtrudg]

Noting that I have edited the bullet point covering unprivileged builds to clarify it, per comment on the matching Apptainer issue - apptainer/apptainer#2248 (comment)