DOE OSTI · 1623366
A fully unprivileged CernVM-FS
Abstract
The CernVM File System provides the software and container distribution backbone for most High Energy and Nuclear Physics experiments. It is implemented as a file system in user-space (Fuse) module, which permits its execution without any elevated privileges. Yet, mounting the file system in the first place is handled by a privileged suid helper program that is installed by the Fuse package on most systems. The privileged nature of the mount system call is a serious hindrance to running CernVM-FS on opportunistic resource and supercomputers. Fortunately, recent developments in the Linux kernel and in the Fuse user-space libraries enabled fully unprivileged mounting for Fuse file systems (as of RHEL 8), or at least outsourcing the privileged mount system call to a custom, external process. This opens the door to several, very appealing new ways to use CernVM-FS, such as a generally usable “super pilot” consisting of the pilot code bundled with Singularity and CernVM-FS, or the on-demand instantiation of unprivileged, ephemeral containers to publish new CernVM-FS content from anywhere. In this contribution, we discuss the integration of these new Linux features with CernVM-FS and show some of its most promising, new applications.
Explore related subjects
Keep this discovery
Explore connections, maps & timelines
Blomer, Jakob, Dykstra, Dave, Ganis, Gerardo, Mosciatti, Simone, Priessnitz, Jan. 2020-11-16. A fully unprivileged CernVM-FS. https://doi.org/10.1051/epjconf%2F202024507012
Cite the original work for its findings. Save a collection to share your selection of sources.