# Apptainer: containers where you keep the same uid you had outside

> Apptainer is the container platform for shared and HPC systems, where a rootless model matters more than image density: you are the same user inside the container as outside and cannot gain privilege by default. The image format is a single SIF file, and the README documents no commands at all, only where the install guides live.

**apptainer/apptainer** — Apptainer: Application containers for Linux

- Repository: https://github.com/apptainer/apptainer
- Website: https://apptainer.org
- Stars: 2,002 · Forks: 189
- Language: Go
- License: NOASSERTION
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/apptainer-apptainer

## You are the same user inside as outside, by design

The security model is stated in one sentence and it is the sentence to remember: you are the same user inside a container as outside, and you cannot gain additional privilege on the host system by default. That is the whole reason this runtime exists. Apptainer inverts it: no daemon, no uid mapping dance, files written inside a container are owned by you on the host, and the group and permission bits carry through. Integration over isolation is the phrase the README uses, and it is why an HPC job in a container can reach a GPU, a high speed network or a parallel filesystem without extra configuration.

## The SIF image is one file, and it can be signed and encrypted

The image format is described as immutable and single file, with support for cryptographic signatures and encryption, and the README names it the SIF format and emphasises that a single file is easy to transport and share. That portability is not a slogan, it is a file format property: a workflow container can sit next to the data on a shared filesystem, move to a laptop, and land on another cluster without a registry round trip. The dependencies show where the implementation lives. go.mod pulls github.com/apptainer/sif/v2 at v2.24.1 for the format itself, and github.com/sigstore/sigstore at v1.10.11 alongside github.com/sylabs/json-resp.

## Go 1.26.5 in go.mod sets the floor for building from source

The build is a Go project with its own configuration system rather than a plain go build. The module line and language version are declared explicitly:

```go
module github.com/apptainer/apptainer

go 1.26.5
```

Alongside go.mod the root carries mconfig and mlocal, which is the build configuration layer, plus cmd/, internal/, pkg/, makeit/, dist/ and test/. The README also states a policy: Apptainer aims to maintain support for the two most recent stable versions of Go, following the Go release maintenance and security policies so critical bug fixes and security patches are available for supported language versions. In practice, an institution building from source is chasing a fairly young Go toolchain and should expect to rebuild when the supported window rolls forward. The dependency list is long and includes runtime plumbing such as opencontainers/runc, opencontainers/selinux and seccomp/libseccomp-golang, which is what a setuid-free, unprivileged design still needs underneath.

## The README has no commands, so start from INSTALL.md and the guides

If you came here for an install line, the page does not have one. The Getting Started section points to INSTALL.md for building from source and to the administration guide at apptainer.org/docs/admin/main/installation.html for other installation options. Administrators get their own documentation for configuration, architecture and security features, and users are pointed at a separate user guide for running and building containers. That split is itself a signal about the audience: this is software installed by a site administrator and used by people who should not need to know how it was configured. Nothing is invented here to fill the gap. Read INSTALL.md and the admin guide before forming an opinion about deployment difficulty.

## The examples directory is the closest thing to a tutorial

With no commands on the README page, the examples/ directory carries the practical material. It is organised by base image and by technique: almalinux, arch, debian, fedora, opensuse, rocky and raspbian, each with amd64 and arm64 variants where applicable, plus busybox and scratch for minimal images. The technique directories are the interesting ones. The repository also includes docker/, buildkit/, multistage/, nested/, plugins/, instances/, library/ and apps/ directories. Read apps/ and instances/ first if your workload is a batch job on a cluster.

## Singularity is still in the names, the paths and the citations

Apptainer was formerly known as Singularity and is now part of the Linux Foundation, and the README still routes both audiences: admin migration documentation and user compatibility documentation. The project also points at container-key-client and container-library-client in go.mod, Sylabs libraries carried over from that lineage. For anyone with existing scripts, the rename is a compatibility question rather than a cosmetic one, and the compatibility documentation exists precisely because the answers are not all yes. The citation section is a reminder of the same thing: the project asks to be cited under its former name, using the Zenodo DOI 10.5281/zenodo.1310023 and the 2017 PLoS ONE paper describing scientific containers for mobility of compute.

## Against rootless Podman or a daemon runtime

The realistic alternative depends on what you are running. For a cluster job on a shared login node, Apptainer's model wins because a user can execute a single file against a node that someone else administers, with their own uid and their existing filesystem mounts. A third option is a virtual machine, which gives stronger isolation and costs startup time and the ability to use host hardware directly. The difference in approach comes down to the isolation versus integration trade: Apptainer gives up containment in exchange for touching the host's hardware, which is correct when the hardware is the reason you are on that machine and wrong when the workload is a service.

## Conclusion

Apptainer is the right choice for a cluster where users log in as themselves, need the GPU and the parallel filesystem, and cannot be given root, because integration over isolation is the feature it was designed around and nothing else in that environment offers the same model without a VM in the path. Skip it for a service deployment on Kubernetes, where a container runtime that expects a root daemon fits better. Before adopting, read INSTALL.md and the admin installation guide, because this README contains no command and every configuration question lives there, and confirm your Singularity era images still run, since the project ships separate admin migration and user compatibility documentation. The last push was on 2026-10-16, the newest release is v1.5.4 from 2026-09-22, and the repository is not archived.

## FAQ

### What is the difference between Apptainer and Singularity?

Apptainer was formerly known as Singularity and is now a part of the Linux Foundation. The README points administrators to singularity migration documentation and users to singularity compatibility documentation for existing setups.

### How do I install Apptainer?

The README contains no install command. It directs you to INSTALL.md for building from source and to the administration installation guide at apptainer.org/docs/admin/main/installation.html for other installation options.

### Does Apptainer run as root inside a container?

No. The README states you are the same user inside a container as outside and cannot gain additional privilege on the host system by default. That rootless model is why it works on shared and HPC systems.

## Sources

- [apptainer/apptainer on GitHub](https://github.com/apptainer/apptainer)
- [Issues](https://github.com/apptainer/apptainer/issues)
- [Project website](https://apptainer.org)
- [README](https://github.com/apptainer/apptainer/blob/main/README.md)
- [Releases](https://github.com/apptainer/apptainer/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/apptainer-apptainer