LoginSign Up
← Back to all sparks
A

Apptainer

INFRA · APIS
Velocity5.0

Container platform for high performance computing

apptainer.org ↗

Apptainer 1.6 candidate adds delta images that rebuild only what changed.

containershpcoverlay-imagesorasregistries
◆Current state
Apptainer 1.6.0-rc.1 is the first feature drop since 1.5.0 in May. It adds overlay builds that store only the files changed against a base image, with a --basepath option that finds the base locally or in a registry at run time. It also builds data partitions from tar files, mounts archives directly, and turns ORAS registries into a managed target with multi-arch push, search, delete and tag. The 1.5 point releases in between were security and compatibility fixes, including a suid privilege escalation through CDI directories.
◆Where it's heading
After a 1.5 cycle spent patching, Apptainer is moving to cut image size and registry friction for HPC users: ship the delta, not the whole image, and manage SIF images in OCI registries without Docker tooling. ORAS is becoming its default distribution path.
◆Prediction
More release candidates should follow before a 1.6.0 final; the 1.5 pattern suggests point releases fixing suid-mode edge cases in the new overlay and archive-mount paths.

◆Recent moves

  1. 6d ago

    1.6.0-rc.1 adds delta overlay images and ORAS registry tools

    The 1.6 candidate adds overlay images holding only the changes against a recorded base, combined at run time via --basepath, plus tar-based data partitions, archive mounts and ORAS search, delete, tag and multi-arch push. The first broad feature set since 1.5.0, still at release-candidate stage.

    View source ↗
  2. 18d ago

    1.5.5 blocks compromised emSign CA certs via Go update

    Raises the minimum Go version to reject compromised emSign intermediate certificates and fixes absolute pull destinations and suid fakeroot mounts. Maintenance with one supply-chain motive.

    View source ↗
  3. 1mo ago

    1.5.4 fixes suid privilege escalation via --cdi-dirs

    Fixes a high-severity suid privilege escalation by barring non-root users from --cdi-dirs, adds a config default for CDI directories, and restores rootless builds on Ubuntu 24.04+. The security cost of 1.5's CDI support, resolved by moving control to the admin.

    View source ↗
  4. 3mo ago

    1.5.3 works around missing ptrace and getopt on newer distros

    Two narrow compatibility fixes: skip PRoot when ptrace() is unavailable during unprivileged builds, and bind getopt from the host so fakeroot command mode works on EL10 and Fedora bases that no longer ship it. More evidence that the unprivileged build path is where this release line spends its maintenance.

    View source ↗
  5. 4mo ago

    1.5.2 extends the mksquashfs workaround and improves FIPS errors

    Build-level fixes: a wider mksquashfs segfault workaround for many-core machines, GOEXPERIMENT=strictfipsruntime on Red Hat golang builds so non-FIPS containers exit with a message instead of crashing, and PRoot skipped on Fedora 45 x86_64. Packaging maintenance rather than product change.

    View source ↗
  6. 5mo ago

    1.5.1 fixes a prefix-matching flaw in limit container paths

    Fixes a CVE where limit container paths matched on string prefixes, so listing /scratch also admitted images under /scratch2 — a real containment bypass on suid installations. Also adds a nonested flag for bind mounts and repairs several 1.5.0 regressions, including fakeroot overwriting root's username in /etc/passwd.

    View source ↗