Apptainer build fails in CHTC

[agitter]

@nisthapanda ran into an error when converting an image to a .sif file in CHTC

FATAL: While making image from oci registry: error fetching image to cache: while building SIF from layers: while creating squashfs: /usr/libexec/apptainer/bin/mksquashfs command failed: exit status 1: proot error: ptrace(TRACEME): Operation not permitted
proot error: execve("/usr/libexec/apptainer/bin/mksquashfs"): Operation not permitted
proot info: It seems your kernel contains this bug: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1202161
To workaround it, set the env. variable PROOT_NO_SECCOMP to 1.
fatal error: see `proot --help`.

The workaround is to add --ignore-proot. The proot dependency is from a change in the Apptainer 1.5.0 release

Preserve owner and group information on files in containers downloaded from OCI registries when building SIF files, even for unprivileged users. This takes advantage of the fact that the library (umoci) that downloads containers preserves owner and group information in an extended attribute. Adds bundled tool proot which is modified from the upstream tool by the rootless-containers project to make the owner and group appear to be in the ordinary stat() information. That tool is now used when invoking mksquashfs to create the filesystem partition in a SIF file. It can be disabled with the hidden build option --ignore-proot.

--ignore-proot is only relevant for Apptainer build, not other commands like pull

If a local .sif file has been created, specifying it in the config file images: is a workaround. There is no longer a Docker to .sif conversion, so mksquashfs and proot are not invoked.

--ignore-proot and the related environment variable APPTAINER_IGNORE_PROOT=1 are hidden in the Apptainer CLI so they may be deprecated: https://github.com/apptainer/apptainer/blob/9dcd7eb95b7978dc6d7dd8d51d69a30c4266e67d/cmd/internal/cli/build.go#L318-L327

This could be documented in our HTCondor instructions.