Docker UID Defaults

[apeltzer]

We should probably think about adding this here as default to the Docker scope:

docker.enabled = true
fixOwnership = true
runOptions = "-u \$(id -u):\$(id -g)"

[matq007]

Also, most of the clusters are cunning CentOS which requires z parameter as well for docker.
mountFlags = 'z'

[apeltzer]

Do you guys use Docker on a cluster? We cannot do that for "security reasons" here. Also, does that then work for everyone? I know that the fixOwnership and runOptions stuff will work pretty much everywhere (?) while the mountFlags might not (?)

[matq007]

We have isolated cluster where we have a docker. We are using local executor and the only way to actually run it correctly (CentOS security policy) I had to enable the mountFlags to z. It is also mentioned in the docs of nextflow.

[ewels]

I don't think that it should go in the template base config unless it works for everyone (at least, doesn't break stuff for those that don't need it). But why does nextflow itself not have these as defaults if that's the case?

[apeltzer]

Good question - @pditommaso can you share some insights on why this is not the "default" behaviour?

[pditommaso]

Good point, that was planned nextflow-io/nextflow#515. It was never merged because it could introduce a breaking change caused by the fact that -u alters the user HOME variable, tho rarely it could be a problem.

Maybe it's time to give it a try.

[gongyixiao]

it could introduce a breaking change caused by the fact that -u alters the user HOME variable, tho rarely it could be a problem.

This causes problem when running Spark in Docker.
nextflow-io/nextflow#515 (comment)

[ewels]

runOptions added to the template in #352

fixOwnership isn't added (yet) - does that need to be there as well?

[apeltzer]

I think not no

[maxulysse]

How important is it to keep this runOptions = "-u \$(id -u):\$(id -g)"?
It's making impossible to enable GATK Spark cf nf-core/sarek#76

[apeltzer]

I never had issues without it - so maybe it’s not required. We had people who had to use it though, which is something we should document / state in troubleshooting on the webpage maybe ?

[maxulysse]

Anyhow, I'll be removing that for Sarek, I'll keep everyone updated if any issue arise.