{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,10]],"date-time":"2026-01-10T07:24:32Z","timestamp":1768029872122,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":62,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,11,13]],"date-time":"2021-11-13T00:00:00Z","timestamp":1636761600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000015","name":"U.S. Department of Energy","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000015","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021,11,14]]},"DOI":"10.1145\/3458817.3476187","type":"proceedings-article","created":{"date-parts":[[2021,10,21]],"date-time":"2021-10-21T05:10:34Z","timestamp":1634793034000},"page":"1-14","source":"Crossref","is-referenced-by-count":14,"title":["Minimizing privilege for building HPC containers"],"prefix":"10.1145","author":[{"given":"Reid","family":"Priedhorsky","sequence":"first","affiliation":[{"name":"Los Alamos National Laboratory"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"R. Shane","family":"Canon","sequence":"additional","affiliation":[{"name":"Lawrence Berkeley National Laboratory"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Timothy","family":"Randles","sequence":"additional","affiliation":[{"name":"Los Alamos National Laboratory"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrew J.","family":"Younge","sequence":"additional","affiliation":[{"name":"Sandia National Laboratories"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2021,11,13]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"2018. CVE-2018-7169 Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-7169  2018. CVE-2018-7169 Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-7169"},{"key":"e_1_3_2_2_2_1","unstructured":"2020. pseudo(1). https:\/\/manpages.debian.org\/testing\/pseudo\/pseudo.1.en.html  2020. pseudo(1). https:\/\/manpages.debian.org\/testing\/pseudo\/pseudo.1.en.html"},{"key":"e_1_3_2_2_3_1","unstructured":"Felix Abecassis and Jonathan Calmels. 2020. Distributed HPC applications with unprivileged containers. In Proc. FOSDEM. https:\/\/archive.fosdem.org\/2020\/schedule\/event\/containers_hpc_unprivileged\/attachments\/slides\/3711\/export\/events\/attachments\/containers_hpc_unprivileged\/slides\/3711\/containers_hpc_unprivileged.pdf  Felix Abecassis and Jonathan Calmels. 2020. Distributed HPC applications with unprivileged containers. In Proc. FOSDEM. https:\/\/archive.fosdem.org\/2020\/schedule\/event\/containers_hpc_unprivileged\/attachments\/slides\/3711\/export\/events\/attachments\/containers_hpc_unprivileged\/slides\/3711\/containers_hpc_unprivileged.pdf"},{"key":"e_1_3_2_2_4_1","volume-title":"Proc. Cloud Computing. 10","author":"Abraham Subil","year":"2020"},{"key":"e_1_3_2_2_5_1","unstructured":"Brian Austin et al. 2020. NERSC-10 workload analysis. Presentation slides. https:\/\/portal.nersc.gov\/project\/m888\/nersc10\/workload\/N10_Workload_Analysis.latest.pdf  Brian Austin et al. 2020. NERSC-10 workload analysis. Presentation slides. https:\/\/portal.nersc.gov\/project\/m888\/nersc10\/workload\/N10_Workload_Analysis.latest.pdf"},{"key":"e_1_3_2_2_6_1","volume-title":"Docker: Automated and consistent software deployments. InfoQ (March","author":"Avram Abel","year":"2013"},{"key":"e_1_3_2_2_7_1","volume-title":"Proc. ISC Workshops. 10","author":"Lucas"},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCC.2014.51"},{"key":"e_1_3_2_2_9_1","unstructured":"Jonathan Calmels et al. 2021. ENROOT. https:\/\/github.com\/NVIDIA\/enroot\/blob\/v3.3.0\/README.md  Jonathan Calmels et al. 2021. ENROOT. https:\/\/github.com\/NVIDIA\/enroot\/blob\/v3.3.0\/README.md"},{"key":"e_1_3_2_2_10_1","volume-title":"Proc. Computer Aided Verification. 10","author":"Cook Byron","year":"2018"},{"key":"e_1_3_2_2_11_1","volume-title":"joost witteven, and Clint Adams","author":"Dassen J.H.M","year":"2019"},{"key":"e_1_3_2_2_12_1","volume-title":"joost witteven, and Clint Adams","author":"Dassen J.H.M","year":"2019"},{"key":"e_1_3_2_2_13_1","unstructured":"Debian Project. 2021. fakeroot (GitLab repository). https:\/\/salsa.debian.org\/clint\/fakeroot  Debian Project. 2021. fakeroot (GitLab repository). https:\/\/salsa.debian.org\/clint\/fakeroot"},{"key":"e_1_3_2_2_14_1","unstructured":"Adam Di Carlo etal 2019. Release notes for Debian 9 (Stretch). Chapter 5.3.2.1. https:\/\/www.debian.org\/releases\/stretch\/amd64\/release-notes\/ch-information.en.html#apt-issues  Adam Di Carlo et al. 2019. Release notes for Debian 9 (Stretch). Chapter 5.3.2.1. https:\/\/www.debian.org\/releases\/stretch\/amd64\/release-notes\/ch-information.en.html#apt-issues"},{"key":"e_1_3_2_2_15_1","unstructured":"Docker Inc. 2021. Run the Docker daemon as a non-root user. https:\/\/docs.docker.com\/engine\/security\/rootless  Docker Inc. 2021. Run the Docker daemon as a non-root user. https:\/\/docs.docker.com\/engine\/security\/rootless"},{"key":"e_1_3_2_2_16_1","volume-title":"Proc. Performance Analysis of Systems and Software. 10","author":"Felter Wes","year":"2015"},{"key":"e_1_3_2_2_17_1","volume-title":"Proc. SC.","author":"Ferreira Kurt B.","year":"2008"},{"key":"e_1_3_2_2_18_1","volume-title":"Proc. SC. 10","author":"Todd"},{"key":"e_1_3_2_2_19_1","volume-title":"Proc. ISC. 10","author":"Gantikow Holger","year":"2020"},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1088\/1742-6596\/898\/8\/082021"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2017.01.007"},{"key":"e_1_3_2_2_22_1","volume-title":"Proc. Cloud Computing. 10","author":"Hendre Amit","year":"2015"},{"key":"e_1_3_2_2_23_1","unstructured":"William Henry. 2019. Podman and Buildah for Docker users. https:\/\/developers.redhat.com\/blog\/2019\/02\/21\/podman-and-buildah-for-docker-users\/  William Henry. 2019. Podman and Buildah for Docker users. https:\/\/developers.redhat.com\/blog\/2019\/02\/21\/podman-and-buildah-for-docker-users\/"},{"key":"e_1_3_2_2_24_1","volume-title":"Jacobsen and Richard Shane Canon","author":"Douglas","year":"2015"},{"key":"e_1_3_2_2_25_1","volume-title":"John Gilmore","author":"Jay Fenlason","year":"2021"},{"key":"e_1_3_2_2_26_1","volume-title":"Watson","author":"Kamp Poul-Henning","year":"2000"},{"key":"e_1_3_2_2_27_1","volume-title":"Namespaces in operation, part 1: Namespaces overview. Linux Weekly News (Jan","author":"Kerrisk Michael","year":"2013"},{"key":"e_1_3_2_2_28_1","volume-title":"Namespaces in operation, part 5: User namespaces. Linux Weekly News (Feb","author":"Kerrisk Michael","year":"2013"},{"key":"e_1_3_2_2_29_1","unstructured":"Michael Kerrisk et al. 2017. setresuid(2) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man2\/setresuid.2.html  Michael Kerrisk et al. 2017. setresuid(2) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man2\/setresuid.2.html"},{"key":"e_1_3_2_2_30_1","unstructured":"Michael Kerrisk et al. 2019. getgroups(2) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man2\/getgroups.2.html  Michael Kerrisk et al. 2019. getgroups(2) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man2\/getgroups.2.html"},{"key":"e_1_3_2_2_31_1","unstructured":"Michael Kerrisk et al. 2020. capabilities(7) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man7\/capabilities.7.html  Michael Kerrisk et al. 2020. capabilities(7) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man7\/capabilities.7.html"},{"key":"e_1_3_2_2_32_1","unstructured":"Michael Kerrisk et al. 2020. chown(2) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man2\/chown.2.html  Michael Kerrisk et al. 2020. chown(2) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man2\/chown.2.html"},{"key":"e_1_3_2_2_33_1","unstructured":"Michael Kerrisk et al. 2020. mount_namespaces(7) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man7\/mount_namespaces.7.html  Michael Kerrisk et al. 2020. mount_namespaces(7) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man7\/mount_namespaces.7.html"},{"key":"e_1_3_2_2_34_1","unstructured":"Michael Kerrisk etal. 2020. user_namespaces(7) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man7\/user_namespaces.7.html  Michael Kerrisk etal. 2020. user_namespaces(7) (5.10 ed.). https:\/\/man7.org\/linux\/man-pages\/man7\/user_namespaces.7.html"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0177459"},{"key":"e_1_3_2_2_36_1","volume-title":"Proc. PEARC. 10","author":"Le Emily","year":"2017"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-020-03518-1"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"crossref","unstructured":"Manoj Naik and Marc Eshel. 2017. File system extended attributes in NFSv4. Proposed standard RFC 8276. IETF. https:\/\/datatracker.ietf.org\/doc\/rfc8276\/  Manoj Naik and Marc Eshel. 2017. File system extended attributes in NFSv4. Proposed standard RFC 8276. IETF. https:\/\/datatracker.ietf.org\/doc\/rfc8276\/","DOI":"10.17487\/RFC8276"},{"key":"e_1_3_2_2_39_1","volume-title":"Proc. Cloud Computing and Services Science. 10","author":"Pahl Claus","year":"2016"},{"key":"e_1_3_2_2_40_1","volume-title":"Proc. SC. 10","author":"Kevin"},{"key":"e_1_3_2_2_41_1","volume-title":"Proc. SC. 10","author":"Petrini Fabrizio","year":"2003"},{"key":"e_1_3_2_2_42_1","volume-title":"Proc. SC. 10","author":"Priedhorsky Reid","year":"2017"},{"key":"e_1_3_2_2_43_1","volume-title":"Proc. Cloud Computing. 10","author":"Ling"},{"key":"e_1_3_2_2_44_1","unstructured":"Ajeet Raina. 2018. Under the hood: Demystifying Docker for Mac CE Edition. https:\/\/collabnix.com\/how-docker-for-mac-works-under-the-hood  Ajeet Raina. 2018. Under the hood: Demystifying Docker for Mac CE Edition. https:\/\/collabnix.com\/how-docker-for-mac-works-under-the-hood"},{"key":"e_1_3_2_2_45_1","unstructured":"Red Hat Inc. 2018. 7.6 release notes. https:\/\/access.redhat.com\/documentation\/en-us\/red_hat_enterprise_linux\/7\/html-single\/7.6_release_notes\/index#appe-7.6_Release_Notes-Revision_History  Red Hat Inc. 2018. 7.6 release notes. https:\/\/access.redhat.com\/documentation\/en-us\/red_hat_enterprise_linux\/7\/html-single\/7.6_release_notes\/index#appe-7.6_Release_Notes-Revision_History"},{"key":"e_1_3_2_2_46_1","unstructured":"Reventlov. 2015. Using the docker command to root the host (totally not a security issue). https:\/\/web.archive.org\/web\/20170614013206\/http:\/\/reventlov.com\/advisories\/using-the-docker-command-to-root-the-host  Reventlov. 2015. Using the docker command to root the host (totally not a security issue). https:\/\/web.archive.org\/web\/20170614013206\/http:\/\/reventlov.com\/advisories\/using-the-docker-command-to-root-the-host"},{"key":"e_1_3_2_2_47_1","unstructured":"Seebs. 2018. index: pseudo (GitLab repository). http:\/\/git.yoctoproject.org\/cgit\/cgit.cgi\/pseudo\/tree\/?h=pseudo-1.9.0  Seebs. 2018. index: pseudo (GitLab repository). http:\/\/git.yoctoproject.org\/cgit\/cgit.cgi\/pseudo\/tree\/?h=pseudo-1.9.0"},{"key":"e_1_3_2_2_48_1","unstructured":"Shemesh Shachar. 2019. Fakeroot NG. https:\/\/fakeroot-ng.lingnu.com\/index.php?title=Main_Page&oldid=2  Shemesh Shachar. 2019. Fakeroot NG. https:\/\/fakeroot-ng.lingnu.com\/index.php?title=Main_Page&oldid=2"},{"key":"e_1_3_2_2_49_1","unstructured":"shadow-utils project. 2020. newgidmap(1) (4.8.1 ed.). https:\/\/man7.org\/linux\/man-pages\/man1\/newgidmap.1.html  shadow-utils project. 2020. newgidmap(1) (4.8.1 ed.). https:\/\/man7.org\/linux\/man-pages\/man1\/newgidmap.1.html"},{"key":"e_1_3_2_2_50_1","unstructured":"shadow-utils project. 2020. newuidmap(1) (4.8.1 ed.). https:\/\/man7.org\/linux\/man-pages\/man1\/newuidmap.1.html  shadow-utils project. 2020. newuidmap(1) (4.8.1 ed.). https:\/\/man7.org\/linux\/man-pages\/man1\/newuidmap.1.html"},{"key":"e_1_3_2_2_51_1","unstructured":"Schacher Shemesh. 2016. Fakeroot Next Gen (SourceForge repository). https:\/\/sourceforge.net\/projects\/fakerootng  Schacher Shemesh. 2016. Fakeroot Next Gen (SourceForge repository). https:\/\/sourceforge.net\/projects\/fakerootng"},{"key":"e_1_3_2_2_52_1","volume-title":"Proc","author":"Sparks Jonathan","year":"2017"},{"key":"e_1_3_2_2_53_1","unstructured":"Sylabs Inc. 2021. Singularity Enterprise. https:\/\/sylabs.io\/singularity-enterprise  Sylabs Inc. 2021. Singularity Enterprise. https:\/\/sylabs.io\/singularity-enterprise"},{"key":"e_1_3_2_2_54_1","volume-title":"Proc. CANOPIE-HPC. https:\/\/conferences.computer.org\/sc19w\/2019\/pdfs\/CANOPIE-HPC2019-7nd7J7oXBlGtzeJIHi79mM\/4VQ694HccmYWPtiazfnGiz\/RirsVUUc5jhKx5UKJBlyT.pdf","author":"Torrez Alfred","year":"2019"},{"key":"e_1_3_2_2_55_1","volume-title":"linux-kernel mailing list (Feb","author":"Torvalds Linus","year":"2013"},{"key":"e_1_3_2_2_56_1","unstructured":"Dan Walsh. 2018. Reintroduction of Podman. https:\/\/www.projectatomic.io\/blog\/2018\/02\/reintroduction-podman\/  Dan Walsh. 2018. Reintroduction of Podman. https:\/\/www.projectatomic.io\/blog\/2018\/02\/reintroduction-podman\/"},{"key":"e_1_3_2_2_57_1","unstructured":"Dan Walsh et al. 2021. Basic setup and use of Podman in a rootless environment. https:\/\/github.com\/containers\/podman\/blob\/master\/docs\/tutorials\/rootless_tutorial.md  Dan Walsh et al. 2021. Basic setup and use of Podman in a rootless environment. https:\/\/github.com\/containers\/podman\/blob\/master\/docs\/tutorials\/rootless_tutorial.md"},{"key":"e_1_3_2_2_58_1","unstructured":"Lizhe Wang et al. 2010. Cloud computing: A perspective study. New Generation Computing (2010). 10.1007\/s00354-008-0081-5  Lizhe Wang et al. 2010. Cloud computing: A perspective study. New Generation Computing (2010). 10.1007\/s00354-008-0081-5"},{"key":"e_1_3_2_2_59_1","unstructured":"Peter Wienemann. 2021. Personal communication.  Peter Wienemann. 2021. Personal communication."},{"key":"e_1_3_2_2_60_1","volume-title":"Proc. Parallel, Distributed, and Network-Based Processing. 10","author":"Miguel","year":"2013"},{"key":"e_1_3_2_2_61_1","volume-title":"Proc. CloudCom. 10","author":"Andrew","year":"2017"},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.11578\/dc.20201109.3"}],"event":{"name":"SC '21: The International Conference for High Performance Computing, Networking, Storage and Analysis","location":"St. Louis Missouri","acronym":"SC '21","sponsor":["SIGHPC ACM Special Interest Group on High Performance Computing, Special Interest Group on High Performance Computing","IEEE CS"]},"container-title":["Proceedings of the International Conference for High Performance Computing, Networking, Storage and Analysis"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3458817.3476187","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3458817.3476187","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3458817.3476187","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:12:21Z","timestamp":1750191141000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3458817.3476187"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,13]]},"references-count":62,"alternative-id":["10.1145\/3458817.3476187","10.1145\/3458817"],"URL":"https:\/\/doi.org\/10.1145\/3458817.3476187","relation":{},"subject":[],"published":{"date-parts":[[2021,11,13]]}}}