leak less into singularity hosted containers

Author: mr-c

cwltool/singularity.py

@@ -151,7 +151,7 @@ def create_runtime(self, env, rm_container=True, record_container_id=False, cidf
                        cidfile_prefix="", **kwargs):
         # type: (MutableMapping[Text, Text], bool, bool, Text, Text, **Any) -> List
 
-        runtime = [u"singularity", u"--quiet", u"exec"]
+        runtime = [u"singularity", u"--quiet", u"exec", u"--contain"]
         runtime.append(u"--bind")
         runtime.append(
             u"%s:%s:rw" % (docker_windows_path_adjust(os.path.realpath(self.outdir)), self.builder.outdir))