Indico has been updated to v3.3. See our blog post for details on this release. (OTG0146394)

Nov 4 – 8, 2019
Adelaide Convention Centre
Australia/Adelaide timezone

A fully unprivileged CernVM-FS

Nov 7, 2019, 3:30 PM
Hall F (Adelaide Convention Centre)

Hall F

Adelaide Convention Centre

Poster Track 7 – Facilities, Clouds and Containers Posters


Jakob Blomer (CERN)


The CernVM File System provides the software and container distribution backbone for most High Energy and Nuclear Physics experiments. It is implemented as a file system in user-space (fuse) module, which permits its execution without any elevated privileges. Yet, mounting the file system in the first place is handled by a privileged suid helper program that is installed by the fuse package on most systems. The privileged nature of the mount system call is a serious hindrance to running CernVM-FS on opportunistic resource and supercomputers. Fortunately, recent developments in the Linux kernel and in the fuse user-space libraries enabled fully unprivileged mounting for fuse file systems (as of RHEL 8), or at least outsourcing the privileged mount system call to a custom, external process. This opens the door to several, very appealing new ways to use CernVM-FS, such as a generally usable "super pilot" consisting of the pilot code bundled with Singularity and CernVM-FS, or the on-demand instantiation of unprivileged, ephemeral containers to publish new CernVM-FS content from anywhere. In this contribution, we discuss the integration of these new Linux features with CernVM-FS and show some of its most promising, new applications.

Consider for promotion No

Primary authors

Jakob Blomer (CERN) Dave Dykstra (Fermi National Accelerator Lab. (US)) Gerardo Ganis (CERN) Radu Popescu (CERN)

Presentation materials