Singularity is an open source container platform, designed to simplify, secure and fast. Singularity is optimized for EPC and HPC workloads, allowing untrusted users to run untrusted container in a credible way. 3.4.0 version has been released, this version emphasizes a feature: the ability to build and run an encrypted container.
The main new features of this version is the ability to build and run an encrypted container. These containers are at rest or in transit, even at runtime is encrypted.
In other words, Singularity container throughout its life cycle is still encrypted. When they were created, when they are at rest or in transmission around, even in the time to use them. Because they use the kernel space data decryption, decryption and therefore no cleaning rootfs upon termination. Specific updates are as follows:
- New support for the use of RSA keys and cryptographic libraries to build and run an encrypted container
- Add --pem-path based on the operation command option and RSA encryption in the build in container
- Add --passphrase options build in container-based encryption and password operation command
- Add SINGULARITY_ENCRYPTION_PEM_PATH and SINGULARITY_ENCRYPTION_PASSPHRASE environment variable to provide the same functionality as above
- When the environment variable contains a secret, adding --encrypt options in build to build an encrypted container
- The new flag --disable-cache prevents caching downloaded container
- Added support for multi-line variables Singularity def file
- Added support for "indexed" def file variables (such as arrays)
- Added support for SUSE SLE products
- Add a def-file variables: product, user, regcode, productpgp, registerurl, modules, otherurl (indexed)
- Scs support structure tag library system more
- Add --dry-run mark to cache clean
- Add SINGULARITY_SYPGPDIR environment variable specifies the location of the data pgp key
- When --vm runtime options, the option to add --nonet operation command to disable network
- Add a --long-list flag in order to retain key search
- Add a experimental, the hidden --fusemount flag, a command to transfer, in a container mounted on a file system 3 libfuse
Other changes :
- remote add command now automatically tries to log and add the --no-login flag to disable this behavior
- Download unsigned use the pull command vessel, no longer generates an error code
- When the --force option is not running, cache clean command prompts the user before clearing
- Shorten the default output key search command
- pull in --allow-unsigned command is no longer used, will be removed in the future
For details, see the release notes: