CVMFS container publishing/conversion system

[rptaylor]

We could deploy an automated container publishing/conversion system , called DUCC.

Some info:

• https://cvmfs.readthedocs.io/en/stable/cpt-ducc.html
• https://indico.cern.ch/event/885212/contributions/4120569/attachments/2181748/3685650/CVMFS%20Containers%20integration%20-%20CVMFS%20Workshop%202021.pdf

Basically takes a list of images in any external registry (Dockerhub, whatever) as input, and produces Singularity sandbox images on a CVMFS repo as output (as well as layers related to OCI format on CVMFS, which can be used by containerd and Docker, which is useful for Kubernetes).

I set up a PoC a couple years ago but haven't touched it recently. We could discuss whether it would be useful to have this as a production service.

[mboisson]

This has the backing of the RSNT (meeting 20200212).

[mboisson]

Following discussions, the CVMFS team will setup a repository for this as well as a VM to automatically populate the repository with container images. Once the mechanism is in place, the RSNT will work on the policy and mechanism to dictate which image gets pushed to CVMFS, probably through a list in a git repository and some mechanism around merge requests.

[mboisson]

Notes from the meeting :

- Companion tool to CVMFS
- Can run on a cron job
- Takes a list of images (dockerhub, gitlab, etc.), transforms them to singularity
- Can be versioned
- Example : `ls /cvmfs/unpacked.cern.ch/registry.hub.docker.com/atlas/  -l` 
- A VM would have publishing access to a separate repository. We would make a merge request to update the list of images to publish
- Paul: Does removing an image from the list remove it from CVMFS ?
- RT: no but there is a ducc garbage-collection command to remove layers not referenced by images in the current list anymore. Could automate with cron if needed.
- Paul: How do we make them usable by users, and how do we track usage ?
- RT: Singularity wrapper could be good idea to track
- Doug: Is there a way to put this in the hands of the users ? 
-- Maxime/Paul: Staff should have vetting. Some images could be private, some images could be too big, etc. 
-- RT: Could allow users to submit git issue or MR if you want (for RSNT approval)

[rptaylor]

For this we will have to wait until ~ CVMFS 2.11 for the Container Tools to support publishing via a gateway.