Skip to content

Initial draft virtualization (#69) #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ReinderVosDeWael wants to merge 1 commit into from
Closed

Initial draft virtualization (#69) #70

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
193 changes: 193 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,193 @@
# Your version: 0.6.0 Latest version: 0.6.0
# Generated by Neurodocker version 0.6.0
# Timestamp: 2020-02-19 19:32:31 UTC
#
# Thank you for using Neurodocker. If you discover any issues
# or ways to improve this software, please submit an issue or
# pull request on our GitHub repository:
#
# https://github.com/kaczmarj/neurodocker

FROM ubuntu:latest

Comment on lines +11 to +12
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using ubuntu:latest makes builds non-deterministic and can break unexpectedly over time (especially with versioned apt packages like libvtk6.3). Pin the base image to a specific Ubuntu release (or digest) that you’ve verified works.

Copilot uses AI. Check for mistakes.
ARG DEBIAN_FRONTEND="noninteractive"

ENV LANG="en_US.UTF-8" \
LC_ALL="en_US.UTF-8" \
ND_ENTRYPOINT="/neurodocker/startup.sh"
RUN export ND_ENTRYPOINT="/neurodocker/startup.sh" \
&& apt-get update -qq \
&& apt-get install -y -q --no-install-recommends \
apt-utils \
bzip2 \
ca-certificates \
curl \
locales \
unzip \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* \
&& sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen \
&& dpkg-reconfigure --frontend=noninteractive locales \
&& update-locale LANG="en_US.UTF-8" \
&& chmod 777 /opt && chmod a+s /opt \
&& mkdir -p /neurodocker \
&& if [ ! -f "$ND_ENTRYPOINT" ]; then \
echo '#!/usr/bin/env bash' >> "$ND_ENTRYPOINT" \
&& echo 'set -e' >> "$ND_ENTRYPOINT" \
&& echo 'export USER="${USER:=`whoami`}"' >> "$ND_ENTRYPOINT" \
&& echo 'if [ -n "$1" ]; then "$@"; else /usr/bin/env bash; fi' >> "$ND_ENTRYPOINT"; \
fi \
&& chmod -R 777 /neurodocker && chmod a+s /neurodocker
Comment on lines +32 to +40
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Dockerfile sets very permissive permissions (chmod 777) and sets the setuid bit on /opt and /neurodocker. That unnecessarily expands the attack surface of the image. Tighten permissions to the minimum required (e.g., owned by the intended user/group with 755/775 as appropriate) and avoid setuid unless there’s a concrete need.

Copilot uses AI. Check for mistakes.

ENTRYPOINT ["/neurodocker/startup.sh"]

RUN bash -c 'apt-get update'

RUN apt-get update -qq \
&& apt-get install -y -q --no-install-recommends \
git \
libsm6 \
libxext6 \
libgl1-mesa-dev \
libvtk6.3 \
xvfb \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*

USER root

RUN bash -c 'curl https://raw.githubusercontent.com/PeerHerholz/BrainSpace/initial_draft_virtualization/requirements.txt > requirements.txt && chmod 777 requirements.txt'

RUN test "$(getent passwd brainspace)" || useradd --no-user-group --create-home --shell /bin/bash brainspace
Comment on lines +59 to +61
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The generated Dockerfile fetches requirements.txt from a GitHub raw URL on a branch name and then installs BrainSpace from a git branch. This is not reproducible (cache won’t invalidate when the file changes) and is a supply-chain risk. Prefer copying the repo’s requirements.txt into the image (so builds track the checked-in file) and installing the package from the local source or from a pinned tag/commit hash.

Copilot uses AI. Check for mistakes.
USER brainspace

ENV CONDA_DIR="/opt/miniconda-latest" \
PATH="/opt/miniconda-latest/bin:$PATH"
RUN export PATH="/opt/miniconda-latest/bin:$PATH" \
&& echo "Downloading Miniconda installer ..." \
&& conda_installer="/tmp/miniconda.sh" \
&& curl -fsSL --retry 5 -o "$conda_installer" https://repo.continuum.io/miniconda/Miniconda3-latest-Linux-x86_64.sh \
&& bash "$conda_installer" -b -p /opt/miniconda-latest \
&& rm -f "$conda_installer" \
&& conda update -yq -nbase conda \
&& conda config --system --prepend channels conda-forge \
&& conda config --system --set auto_update_conda false \
&& conda config --system --set show_channel_urls true \
&& sync && conda clean --all && sync \
&& conda create -y -q --name brainspace \
&& conda install -y -q --name brainspace \
"python=3.7" \
"panel" \
"pyqt" \
"pyvista" \
"notebook" \
"ipython" \
&& sync && conda clean --all && sync \
&& bash -c "source activate brainspace \
&& pip install --no-cache-dir \
"-r" \
"requirements.txt" \
"git+https://github.com/PeerHerholz/BrainSpace.git@notebook_binder_support" \
"xvfbwrapper" \
"ipywidgets" \
"ipyevents" \
"jupytext" \
"seaborn"" \
&& rm -rf ~/.cache/pip/* \
&& sync \
&& sed -i '$isource activate brainspace' $ND_ENTRYPOINT

RUN mkdir -p ~/.jupyter && echo c.NotebookApp.ip = \"0.0.0.0\" > ~/.jupyter/jupyter_notebook_config.py

ENTRYPOINT ["/neurodocker/startup.sh"]

Comment on lines +100 to +103
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ENTRYPOINT is defined twice; the later one overrides the earlier and adds noise for future edits. Keep a single ENTRYPOINT declaration (and place it near the end once the entrypoint script is fully configured).

Copilot uses AI. Check for mistakes.
WORKDIR /opt/miniconda-latest/envs/brainspace/lib/python3.7/site-packages/brainspace/examples

RUN sed -i '$ijupytext --set-formats ipynb,py *.py && rm *.ipynb' $ND_ENTRYPOINT

CMD ["jupyter", "notebook"]

RUN echo '{ \
\n "pkg_manager": "apt", \
\n "instructions": [ \
\n [ \
\n "base", \
\n "ubuntu:latest" \
\n ], \
\n [ \
\n "run_bash", \
\n "apt-get update" \
\n ], \
\n [ \
\n "install", \
\n [ \
\n "git", \
\n "libsm6", \
\n "libxext6", \
\n "libgl1-mesa-dev", \
\n "libvtk6.3", \
\n "xvfb" \
\n ] \
\n ], \
\n [ \
\n "user", \
\n "root" \
\n ], \
\n [ \
\n "run_bash", \
\n "curl https://raw.githubusercontent.com/PeerHerholz/BrainSpace/initial_draft_virtualization/requirements.txt > requirements.txt && chmod 777 requirements.txt" \
\n ], \
\n [ \
\n "user", \
\n "brainspace" \
\n ], \
\n [ \
\n "miniconda", \
\n { \
\n "conda_install": [ \
\n "python=3.7", \
\n "panel", \
\n "pyqt", \
\n "pyvista", \
\n "notebook", \
\n "ipython" \
\n ], \
\n "pip_install": [ \
\n "-r", \
\n "requirements.txt", \
\n "git+https://github.com/PeerHerholz/BrainSpace.git@notebook_binder_support", \
\n "xvfbwrapper", \
\n "ipywidgets", \
\n "ipyevents", \
\n "jupytext", \
\n "seaborn" \
\n ], \
\n "create_env": "brainspace", \
\n "activate": true \
\n } \
\n ], \
\n [ \
\n "run", \
\n "mkdir -p ~/.jupyter && echo c.NotebookApp.ip = \\\"0.0.0.0\\\" > ~/.jupyter/jupyter_notebook_config.py" \
\n ], \
\n [ \
\n "entrypoint", \
\n "/neurodocker/startup.sh" \
\n ], \
\n [ \
\n "workdir", \
\n "/opt/miniconda-latest/envs/brainspace/lib/python3.7/site-packages/brainspace/examples" \
\n ], \
\n [ \
\n "add_to_entrypoint", \
\n "jupytext --set-formats ipynb,py *.py && rm *.ipynb" \
\n ], \
\n [ \
\n "cmd", \
\n [ \
\n "jupyter", \
\n "notebook" \
\n ] \
\n ] \
\n ] \
\n}' > /neurodocker/neurodocker_specs.json
193 changes: 193 additions & 0 deletions Singularity
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,193 @@
# Your version: 0.6.0 Latest version: 0.6.0
# Generated by Neurodocker version 0.6.0
# Timestamp: 2020-02-19 19:32:33 UTC
#
# Thank you for using Neurodocker. If you discover any issues
# or ways to improve this software, please submit an issue or
# pull request on our GitHub repository:
#
# https://github.com/kaczmarj/neurodocker

Bootstrap: docker
From: ubuntu:latest

Comment on lines +11 to +13
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using From: ubuntu:latest makes Singularity builds non-deterministic and can break unexpectedly as the upstream base changes. Pin to a specific Ubuntu release (or digest) that you’ve verified works with the required system packages.

Copilot uses AI. Check for mistakes.
%post
export ND_ENTRYPOINT="/neurodocker/startup.sh"
apt-get update -qq
apt-get install -y -q --no-install-recommends \
apt-utils \
bzip2 \
ca-certificates \
curl \
locales \
unzip
apt-get clean
rm -rf /var/lib/apt/lists/*
sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
dpkg-reconfigure --frontend=noninteractive locales
update-locale LANG="en_US.UTF-8"
chmod 777 /opt && chmod a+s /opt
mkdir -p /neurodocker
if [ ! -f "$ND_ENTRYPOINT" ]; then
echo '#!/usr/bin/env bash' >> "$ND_ENTRYPOINT"
echo 'set -e' >> "$ND_ENTRYPOINT"
echo 'export USER="${USER:=`whoami`}"' >> "$ND_ENTRYPOINT"
echo 'if [ -n "$1" ]; then "$@"; else /usr/bin/env bash; fi' >> "$ND_ENTRYPOINT";
fi
chmod -R 777 /neurodocker && chmod a+s /neurodocker

bash -c 'apt-get update'

apt-get update -qq
apt-get install -y -q --no-install-recommends \
git \
libsm6 \
libxext6 \
libgl1-mesa-dev \
libvtk6.3 \
xvfb
apt-get clean
rm -rf /var/lib/apt/lists/*

su - root

bash -c 'curl https://raw.githubusercontent.com/PeerHerholz/BrainSpace/initial_draft_virtualization/requirements.txt > requirements.txt && chmod 777 requirements.txt'
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Singularity recipe fetches requirements.txt from a GitHub raw URL on a branch name. This is not reproducible and is a supply-chain risk (and it also bypasses build cache invalidation semantics). Prefer embedding/copying the repository’s requirements.txt into the image build context or pinning to an immutable commit hash.

Suggested change
bash -c 'curl https://raw.githubusercontent.com/PeerHerholz/BrainSpace/initial_draft_virtualization/requirements.txt > requirements.txt && chmod 777 requirements.txt'
bash -c 'curl https://raw.githubusercontent.com/PeerHerholz/BrainSpace/abcdef1234567890abcdef1234567890abcdef12/requirements.txt > requirements.txt && chmod 777 requirements.txt'

Copilot uses AI. Check for mistakes.

test "$(getent passwd brainspace)" || useradd --no-user-group --create-home --shell /bin/bash brainspace
su - brainspace

export PATH="/opt/miniconda-latest/bin:$PATH"
echo "Downloading Miniconda installer ..."
conda_installer="/tmp/miniconda.sh"
curl -fsSL --retry 5 -o "$conda_installer" https://repo.continuum.io/miniconda/Miniconda3-latest-Linux-x86_64.sh
bash "$conda_installer" -b -p /opt/miniconda-latest
rm -f "$conda_installer"
conda update -yq -nbase conda
conda config --system --prepend channels conda-forge
conda config --system --set auto_update_conda false
conda config --system --set show_channel_urls true
sync && conda clean --all && sync
conda create -y -q --name brainspace
conda install -y -q --name brainspace \
"python=3.7" \
"panel" \
"pyqt" \
"pyvista" \
"notebook" \
"ipython"
sync && conda clean --all && sync
Comment on lines +52 to +78
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The %post section uses su - root / su - brainspace without -c, which relies on stdin/script parsing behavior and makes it harder to reason about which user runs subsequent commands. Consider replacing these with explicit su -c '...' brainspace (or runuser) blocks so user context is unambiguous and less brittle across build environments.

Suggested change
su - root
bash -c 'curl https://raw.githubusercontent.com/PeerHerholz/BrainSpace/initial_draft_virtualization/requirements.txt > requirements.txt && chmod 777 requirements.txt'
test "$(getent passwd brainspace)" || useradd --no-user-group --create-home --shell /bin/bash brainspace
su - brainspace
export PATH="/opt/miniconda-latest/bin:$PATH"
echo "Downloading Miniconda installer ..."
conda_installer="/tmp/miniconda.sh"
curl -fsSL --retry 5 -o "$conda_installer" https://repo.continuum.io/miniconda/Miniconda3-latest-Linux-x86_64.sh
bash "$conda_installer" -b -p /opt/miniconda-latest
rm -f "$conda_installer"
conda update -yq -nbase conda
conda config --system --prepend channels conda-forge
conda config --system --set auto_update_conda false
conda config --system --set show_channel_urls true
sync && conda clean --all && sync
conda create -y -q --name brainspace
conda install -y -q --name brainspace \
"python=3.7" \
"panel" \
"pyqt" \
"pyvista" \
"notebook" \
"ipython"
sync && conda clean --all && sync
bash -c 'curl https://raw.githubusercontent.com/PeerHerholz/BrainSpace/initial_draft_virtualization/requirements.txt > requirements.txt && chmod 777 requirements.txt'
test "$(getent passwd brainspace)" || useradd --no-user-group --create-home --shell /bin/bash brainspace
su - brainspace -c "export PATH=\"/opt/miniconda-latest/bin:\$PATH\"; echo \"Downloading Miniconda installer ...\"; conda_installer=\"/tmp/miniconda.sh\"; curl -fsSL --retry 5 -o \"\$conda_installer\" https://repo.continuum.io/miniconda/Miniconda3-latest-Linux-x86_64.sh; bash \"\$conda_installer\" -b -p /opt/miniconda-latest; rm -f \"\$conda_installer\"; conda update -yq -nbase conda; conda config --system --prepend channels conda-forge; conda config --system --set auto_update_conda false; conda config --system --set show_channel_urls true; sync && conda clean --all && sync; conda create -y -q --name brainspace; conda install -y -q --name brainspace python=3.7 panel pyqt pyvista notebook ipython; sync && conda clean --all && sync"

Copilot uses AI. Check for mistakes.
bash -c "source activate brainspace
pip install --no-cache-dir \
"-r" \
"requirements.txt" \
"git+https://github.com/PeerHerholz/BrainSpace.git@notebook_binder_support" \
"xvfbwrapper" \
"ipywidgets" \
"ipyevents" \
"jupytext" \
"seaborn""
rm -rf ~/.cache/pip/*
sync
sed -i '$isource activate brainspace' $ND_ENTRYPOINT


mkdir -p ~/.jupyter && echo c.NotebookApp.ip = \"0.0.0.0\" > ~/.jupyter/jupyter_notebook_config.py

cd /opt/miniconda-latest/envs/brainspace/lib/python3.7/site-packages/brainspace/examples

sed -i '$ijupytext --set-formats ipynb,py *.py && rm *.ipynb' $ND_ENTRYPOINT

echo '{
\n "pkg_manager": "apt",
\n "instructions": [
\n [
\n "base",
\n "ubuntu:latest"
\n ],
\n [
\n "_header",
\n {
\n "version": "generic",
\n "method": "custom"
\n }
\n ],
\n [
\n "run_bash",
\n "apt-get update"
\n ],
\n [
\n "install",
\n [
\n "git",
\n "libsm6",
\n "libxext6",
\n "libgl1-mesa-dev",
\n "libvtk6.3",
\n "xvfb"
\n ]
\n ],
\n [
\n "user",
\n "root"
\n ],
\n [
\n "run_bash",
\n "curl https://raw.githubusercontent.com/PeerHerholz/BrainSpace/initial_draft_virtualization/requirements.txt > requirements.txt && chmod 777 requirements.txt"
\n ],
\n [
\n "user",
\n "brainspace"
\n ],
\n [
\n "miniconda",
\n {
\n "conda_install": [
\n "python=3.7",
\n "panel",
\n "pyqt",
\n "pyvista",
\n "notebook",
\n "ipython"
\n ],
\n "pip_install": [
\n "-r",
\n "requirements.txt",
\n "git+https://github.com/PeerHerholz/BrainSpace.git@notebook_binder_support",
\n "xvfbwrapper",
\n "ipywidgets",
\n "ipyevents",
\n "jupytext",
\n "seaborn"
\n ],
\n "create_env": "brainspace",
\n "activate": true
\n }
\n ],
\n [
\n "run",
\n "mkdir -p ~/.jupyter && echo c.NotebookApp.ip = \\\"0.0.0.0\\\" > ~/.jupyter/jupyter_notebook_config.py"
\n ],
\n [
\n "entrypoint",
\n "/neurodocker/startup.sh"
\n ],
\n [
\n "workdir",
\n "/opt/miniconda-latest/envs/brainspace/lib/python3.7/site-packages/brainspace/examples"
\n ],
\n [
\n "add_to_entrypoint",
\n "jupytext --set-formats ipynb,py *.py && rm *.ipynb"
\n ]
\n ]
\n}' > /neurodocker/neurodocker_specs.json

%environment
export LANG="en_US.UTF-8"
export LC_ALL="en_US.UTF-8"
export ND_ENTRYPOINT="/neurodocker/startup.sh"
export CONDA_DIR="/opt/miniconda-latest"
export PATH="/opt/miniconda-latest/bin:$PATH"

%runscript
/neurodocker/startup.sh
Loading