LoginSign Up
← Back to all sparks
A

Apptainer

INFRA · APIS
Velocity2.5

Container platform for high performance computing

apptainer.org ↗

Apptainer 1.5 adds CDI device support and builds SIF images straight from Dockerfiles.

containershpccdiacceleratorsunprivileged-buildsimage-formats
◆Current state
Apptainer shipped 1.5.0 in May after two release candidates, and has issued three point releases since. The major adds a subset of the Container Device Interface standard through --device and --cdi-dirs, selective mounting for Intel Gaudi accelerators, a buildkit: bootstrap that builds SIF images from a Dockerfile without Docker or Podman, and image pulls from an IPFS gateway. The point releases since have been almost entirely about the unprivileged build path — PRoot, mksquashfs and fuse2fs — plus a path-matching CVE in the suid limit container paths directive.
◆Where it's heading
The 1.5 line is Apptainer catching up to how accelerators are actually exposed in 2026: CDI is the standard NVIDIA, Intel and others have converged on, and adopting it replaces per-vendor mount logic with a declarative spec the container runtime reads. The Gaudi support is the first vendor-specific case built on that footing. Separately, the buildkit bootstrap attacks the other friction point — needing a Docker daemon to build an image for a cluster that deliberately does not run one. The point-release churn shows where the cost lands: the bundled PRoot and squashfs tooling that makes unprivileged builds work is fragile across distributions, and 1.5.1 quietly documents that PRoot is no longer built on ppc, s390 or riscv at all.
◆Prediction
Expect further CDI coverage as the obvious next step, since only a subset of the standard is implemented and each accelerator vendor currently needs its own flag. The unprivileged build path is the likely source of the next point release, given that three of the last three have been spent there.

◆Recent moves

  1. 18d ago

    1.5.3 works around missing ptrace and getopt on newer distros

    Two narrow compatibility fixes: skip PRoot when ptrace() is unavailable during unprivileged builds, and bind getopt from the host so fakeroot command mode works on EL10 and Fedora bases that no longer ship it. More evidence that the unprivileged build path is where this release line spends its maintenance.

    View source ↗
  2. 1mo ago

    1.5.2 extends the mksquashfs workaround and improves FIPS errors

    Build-level fixes: a wider mksquashfs segfault workaround for many-core machines, GOEXPERIMENT=strictfipsruntime on Red Hat golang builds so non-FIPS containers exit with a message instead of crashing, and PRoot skipped on Fedora 45 x86_64. Packaging maintenance rather than product change.

    View source ↗
  3. 2mo ago

    1.5.1 fixes a prefix-matching flaw in limit container paths

    Fixes a CVE where limit container paths matched on string prefixes, so listing /scratch also admitted images under /scratch2 — a real containment bypass on suid installations. Also adds a nonested flag for bind mounts and repairs several 1.5.0 regressions, including fakeroot overwriting root's username in /etc/passwd.

    View source ↗
  4. 3mo ago

    Apptainer 1.5 adopts CDI and adds a BuildKit image bootstrap

    ⚡ SPARK

    The release that resets what Apptainer can do: CDI device support, Intel Gaudi mounting, SIF builds from a Dockerfile via BuildKit, and IPFS image retrieval. Everything since has been point-release repair of the unprivileged build tooling this expanded surface leans on.

    View source ↗
  5. 3mo ago

    Second 1.5.0 candidate adds loong64 and a BuildKit host override

    A short candidate ahead of the major: loong64 architecture support, an APPTAINER_BUILDKIT_HOST variable for selecting the BuildKit backend, and an LD_LIBRARY_PATH pass-through for run-help under unprivileged installs. The BuildKit host override is a sign the new bootstrap needed configurability before shipping.

    View source ↗
  6. 4mo ago

    First 1.5.0 candidate previews CDI, BuildKit and IPFS support

    The candidate that first exposed the 1.5.0 feature set — CDI devices, Gaudi mounting, the buildkit: bootstrap, IPFS pulls, --no-env and --data — for testing. Its contents are a subset of what shipped in the final release two months later, not a separate body of work.

    View source ↗