Apptainer

Apptainer (the Linux Foundation's HPC container platform, formerly Singularity) packages container images as single SIF files that run without a root daemon, which makes it the preferred runtime on HPC clusters and shared multi-user systems. This guide covers installing Apptainer on an RLC Pro AI host and pulling the RLC Pro AI OCI image as a SIF file.

Prerequisites

• A CIQ Portal account with access to the RLC Pro AI product, and your credentials from the Portal access token page.
• An enrolled RLC Pro AI system (see the Post-Installation Guide).
• Roughly 15 GB of free disk space: the pull downloads the OCI layers to a local cache and then builds the SIF file from them.

Install Apptainer

CIQ distributes Apptainer through its own Depot product. Enable it alongside your existing entitlements:

sudo depot enable apptainer

Created DNF configuration: /etc/yum.repos.d/depot-apptainer.repo

Apptainer depends on the fakeroot package, which Rocky Linux family systems get from EPEL. Install epel-release first (it is available in the rocky-9-extras repository), then Apptainer:

sudo dnf install epel-release
sudo dnf install apptainer

Verify the installation:

apptainer --version

apptainer version 1.4.5-1.el9

Authenticate to the Depot registry

Apptainer reads registry credentials from environment variables during a pull:

export APPTAINER_DOCKER_USERNAME=<DEPOT_USERNAME>
export APPTAINER_DOCKER_PASSWORD=<TOKEN>

Alternatively, store the credentials with apptainer registry login --username <DEPOT_USERNAME> docker://depot.ciq.com.

Pull the image as a SIF file

apptainer pull rlc-pro-ai_9.sif docker://depot.ciq.com/rlc-ai-9/rlc-9-ai-oci-images/rlc-pro-ai:9

Apptainer downloads the OCI layers and converts them into a single rlc-pro-ai_9.sif file (roughly 3.8 GB; the conversion squashes and compresses the image). Unlike Podman or Docker, no daemon or system-wide image store is involved: the SIF file is a regular file you can copy to a cluster's shared filesystem, version, and checksum like any other artifact.

ls -lh rlc-pro-ai_9.sif

-rwxr-xr-x. 1 rocky rocky 3.8G Jul 17 01:37 rlc-pro-ai_9.sif

Run workloads from the SIF

Run the validated PyTorch stack from the image:

apptainer exec rlc-pro-ai_9.sif python3 -c "import torch; print(torch.__version__)"

2.8.0.post12

Or start an interactive shell inside the container:

apptainer shell rlc-pro-ai_9.sif

By default Apptainer runs as the invoking user and mounts the home directory into the container, which is usually what you want for working with datasets and scripts on the host.

GPU access

On a GPU-equipped host, add the --nv flag to expose the NVIDIA driver and devices inside the container:

apptainer exec --nv rlc-pro-ai_9.sif python3 -c "import torch; print(torch.cuda.is_available())"

See the Apptainer GPU documentation for details.

Troubleshooting

authentication required during pull. The Depot registry rejects unauthenticated pulls. Set the APPTAINER_DOCKER_USERNAME and APPTAINER_DOCKER_PASSWORD environment variables and retry.

Pull fails or hangs partway. Check free disk space. The OCI layer cache lives in ~/.apptainer/cache and the SIF build needs temporary workspace on top of it; a failed pull can be resumed and reuses already-cached layers. Clear the cache with apptainer cache clean if you need the space back.