You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: 01_assignment.qmd
+4-1Lines changed: 4 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -20,4 +20,7 @@ Try running it:
20
20
21
21
`./run_this.sh`
22
22
23
-
3. Take a look at `scripts/week1/rnorm.R` or `scripts/week1/random_num.py`. Load up the `fhR` or `fhPython` modules on `rhino` using `module load`. Run it on the command line with `Rscript` or `python3`. Did you need to make this script executable?
23
+
3. Take a look at `scripts/week1/rnorm.R` or `scripts/week1/random_num.py`. Load up the `fhR` or `fhPython` modules on `rhino` using `module load`. Run it on the command line with `Rscript` or `python3`.
24
+
25
+
Did you need to make this script executable before you ran it?
Copy file name to clipboardExpand all lines: 03_batch.qmd
+11-70Lines changed: 11 additions & 70 deletions
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ If we run this in our repository, we get something similar to this:
41
41
214 1314 8001 miscellaneous.qmd
42
42
```
43
43
44
-
The `*.qmd` (the wildcard operator, also known as a glob) can be used in various ways. For example, if our files are in a folder called `raw_data/`, we could specify:
44
+
The `*.qmd` (the wildcard operator, also known as a {{<glossaryglob>}}) can be used in various ways. For example, if our files are in a folder called `raw_data/`, we could specify:
45
45
46
46
```
47
47
for file in raw_data/*.fq
@@ -77,6 +77,11 @@ module purge
77
77
78
78
See page 12 in Bite Size Bash.
79
79
80
+
:::{.callout}
81
+
## Selecting files with complicated patterns: Regular Expressions
82
+
83
+
:::
84
+
80
85
### Using file manifests
81
86
82
87
One approach that I use a lot is using file manifests to process multiple sets of files. Each line of the file manifest will contain all of the related files I need to process.
@@ -106,6 +111,8 @@ unset IFS #<2>
106
111
1. Change IFS to be `""` (no space), to process a file line by line.
107
112
2. Reset IFS to original behavior.
108
113
114
+
115
+
109
116
## Batching on HPC
110
117
111
118
Now we can start to do more advanced things on the HPC: use one machine to process each file.
@@ -149,6 +156,7 @@ We are able to set some configuration on running our jobs.
149
156
150
157
Much more information about the kinds of directives that you can specify in a SLURM script is available here: <https://www.osc.edu/supercomputing/batch-processing-at-osc/slurm_directives_summary>
151
158
159
+
The most important directive you should be aware of is how
152
160
:::
153
161
154
162
### Job Arrays
@@ -235,73 +243,6 @@ scancel 26328834
235
243
236
244
This will cancel all sub jobs related to the parent job.
237
245
238
-
## Containers
239
-
240
-
We already learned about software modules (@sec-modules). There is an alternative way to use software: using a {{<glossary "container">}}.
241
-
242
-
### What is a Container?
243
-
244
-
A container is a self-contained unit of software. It contains everything needed to run the software on a variety of machines. If you have the container software installed on your machine, it doesn't matter whether it is MacOS, Linux, or Windows - the container will behave consistently across different operating systems and architectures.
245
-
246
-
The container has the following contents:
247
-
248
-
-**Software** - The software we want to run in a container. For bioinformatics work, this is usually something like an aligner like `bwa`, or utilities such as `samtools`
249
-
-**Software Dependencies** - various software packages needed to run the software. For example, if we wanted to run `tidyverse` in a container, we need to have `R` installed in the container as well.
250
-
-**Filesystem** - containers have their own isolated filesystem that can be connected to the "outside world" - everything outside of the container. We'll learn more about customizing these with bind paths (@sec-bindpaths).
251
-
252
-
In short, the container has everything needed to run the software. It is not a full operating system, but a smaller mini-version that cuts out a lot of cruft.
253
-
254
-
Containers are {{< glossary "ephemeral">}}. They leverage the the file system of their host to manage files. These are called both *Volumes* (the Docker term) and *Bind Paths* (the apptainer term).
255
-
256
-
### Docker vs. Apptainer
257
-
258
-
There are two basic ways to run Docker containers:
259
-
260
-
1. Using the Docker software
261
-
2. Using the Apptainer software (for HPC systems)
262
-
263
-
In general, Docker is used on systems where you have a high level of access to the system. This is because `docker` uses a special user group called `docker` that has essentially root level privileges. This is not something to be taken lightly.
264
-
265
-
This is not the case for HPC systems, which are shared and granting this level of access to many people is not practical. This is when we use {{< glossary "Apptainer">}} (which used to be called Singularity), which requires a much lower level of user privileges to execute tasks. For more info, see @sec-open-container .
266
-
267
-
:::{.callout-warning}
268
-
## Be Secure
269
-
270
-
Before we get started, security is always a concern when running containers. The `docker` group has elevated status on a system, so we need to be careful that when we're running them, these containers aren't introducing any system vulnerabilities. Note that on HPC systems, the main mechanism for running containers is `apptainer`, which is designed to be more secure.
271
-
272
-
These are mostly important when running containers that are web-servers or part of a web stack, but it is also important to think about when running jobs on HPC.
273
-
274
-
Here are some guidelines to think about when you are working with a container.
275
-
276
-
-**Use vendor-specific Docker Images when possible**.
277
-
-**Use container scanners to spot potential vulnerabilities**. DockerHub has a vulnerability scanner that scans your Docker images for potential vulnerabilities. For example, the WILDS Docker library employs a vulnerability scanner and the containers are regularly patched to prevent vulnerabilities.
278
-
-**Avoid kitchen-sink images**. One issue is when an image is built on top of many other images. It makes it really difficult to plug vulnerabilities. When in doubt, use images from trusted people and organizations. At the very least, look at the Dockerfile to see that suspicious software isn't being installed.
279
-
:::
280
-
281
-
### Common Containers for Bioinformatics
282
-
283
-
- GATK (the genome analysis toolkit) is one common container that we can use for analysis.
284
-
-
285
-
286
-
### The WILDS Docker Library
287
-
288
-
The Data Science Lab has a set of Docker containers for common Bioinformatics tasks available in the [WILDS Docker Library](https://hub.docker.com/u/getwilds). These include:
289
-
290
-
-`samtools`
291
-
-`bcftools`
292
-
-`manta`
293
-
-`cnvkit`
294
-
-`deseq2`
295
-
296
-
Among many others. Be sure to check it out before you start building your own containers.
297
-
298
-
### Pulling a Docker Container
299
-
300
-
Let's pull a docker container from the Docker registry. Note we have to specify `docker://` when we pull the container, because Apptainer has its own internal format called SIF.
Copy file name to clipboardExpand all lines: 04_containers_workflows.qmd
+6-162Lines changed: 6 additions & 162 deletions
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: "Containers and Workflows"
2
+
title: "Workflows"
3
3
---
4
4
5
5
## Learning Objectives
@@ -19,9 +19,9 @@ A good workflow manager will allow you to:
19
19
- Restart failed subjobs in the workflow
20
20
- Allow you to customize where intermediate and final outputs go
21
21
- Swap and customize modules in your workflow
22
-
- Adapt to different architectures
22
+
- Adapt to different computing architectures (HPC/cloud/etc)
23
23
24
-
Many bioinformaticists have used workflow managers to process and manage hundreds or thousands of files at a time.
24
+
Many bioinformaticists have used workflow managers to process and manage hundreds or thousands of files at a time. They are well worth learning.
25
25
26
26
Here is an overview of some of the common bioinformatics workflow managers. We will be using `cromwell`, which runs WDL files.
27
27
@@ -31,7 +31,7 @@ Here is an overview of some of the common bioinformatics workflow managers. We w
31
31
|Sprocket | WDL|Made for HPC Jobs|
32
32
|MiniWDL|WDL|Used for local testing of workflows|
33
33
|DNANexus|WDL/CWL|Used for systems such as AllOfUs|
34
-
|Nextflow|.nf files|Owned by seqera|
34
+
|Nextflow|`.nf` files|Owned by seqera|
35
35
|Snakemake|make files||
36
36
37
37
@@ -301,163 +301,7 @@ workflow SRA_STAR2Pass {
301
301
```
302
302
303
303
304
-
## Developing and Testing out scripts
304
+
## Where Next?
305
305
306
-
One of the hard things to understand is what can be run on a compute node versus the head node, and what file systems are accessible via a compute node.
306
+
Now that you understand the basics of working with Bash and WDL, you are now ready to start working with WDL workflows.
307
307
308
-
A lot of the issues you might have is because you need to understand the mental model of how cluster computing works. And the best way to understand that is to test your code on a compute node.
309
-
310
-
Let's explore how we can do that.
311
-
312
-
### Testing code on a compute node {#sec-grabnode}
313
-
314
-
Fred Hutch users have the advantage of `grabnode`, which is a custom command that lets you request an interactive instance of a compute node.
315
-
316
-
Why would you want to do this? A good part of this is about testing software and making sure that your paths are correct.
317
-
318
-
:::{.callout}
319
-
## Don't rely on `grabnode`/interactive mode for your work
320
-
321
-
We see users that will request a multicore node with higher memory, and do their processing on that node.
322
-
323
-
This doesn't take advantage of all of the machines that are available on a cluster, and thus is a suboptimal way to utilize the cluster.
324
-
325
-
The other disadvantage is that you may be waiting a very long time to get that multicore node, whereas if you batch across a bunch of nodes, you will get your work done much faster.
326
-
:::
327
-
328
-
## Working with containers {#sec-containers}
329
-
330
-
I think the hardest thing about working with containers is wrapping your head around the indirectness of them. You are running software with its own internal filesystem and the challenges are getting the container to read files in folders/paths outside of its own filesytem, as well as outputting files into those outside folders.
331
-
332
-
### Testing code in a container {#sec-open-container}
333
-
334
-
In this section, we talk about testing scripts in a container using `apptainer`. We use `apptainer` (formerly Singularity) in order to run Docker containers on a shared HPC system. This is because Docker itself requires root-level privileges, which is not secure on shared systems.
335
-
336
-
In order to do our testing, we'll first pull the Docker container, map our bind point (so our container can access files outside of its file system), and then run scripts in the container.
337
-
338
-
Even if you aren't going to frequently use Apptainer in your work, I recommend trying an interactive shell in a container at least once or twice to learn about the container filesystem and conceptually understand how you connect it to the external filesystem.
339
-
340
-
### Pulling a Docker Container
341
-
342
-
Let's pull a docker container from the Docker registry. Note we have to specify `docker://` when we pull the container, because Apptainer has its own internal format called SIF.
### Opening a Shell in a Container with `apptainer shell`
350
-
351
-
When you're getting started, opening a shell using Apptainer can help you test out things like filepaths and how they're accessed in the container. It's hard to get an intuition for how file I/O works with containers until you can see the limited view from the container.
352
-
353
-
By default, apptainers can see your current directory and navigate to the files in it.
354
-
355
-
You can open an Apptainer shell in a container using `apptainer shell`. Remember to use `docker://` before the container name. For example:
This will load the `apptainer` module, and then open a Bash shell in the container using `apptainer shell`. Once you're in the container, you can test code, especially seeing whether your files can be seen by the container (see @sec-bindpaths). 90% of the issues with using Docker containers has to do with bind paths, so we'll talk about that next.
363
-
364
-
Once you're in the shell, you can take a look at where `samtools` is installed:
365
-
366
-
```bash
367
-
which samtools
368
-
```
369
-
370
-
Note that the container filesystem is isolated, and we need to explicitly build connections to it (called bind paths) to get files in and out. We'll talk more about this in the next section.
371
-
372
-
Once we're done testing scripts in our containers, we can exit the shell and get back into the node.
373
-
374
-
```bash
375
-
exit
376
-
```
377
-
378
-
:::{.callout-note}
379
-
## Opening a Shell in a Docker Container with Docker
380
-
381
-
For the most part, due to security reasons, we don't use `docker` on HPC systems. In short, the `docker` group essentially has root-level access to the machine, and it's not a good for security on a shared resource like an HPC.
382
-
383
-
However, if you have admin level access (for example, on your own laptop), you can open up an interactive shell with `docker run -it`:
384
-
385
-
```bash
386
-
docker run -it biocontainers/samtools:v1.9-4-deb_cv1 /bin/bash
387
-
```
388
-
This will open a bash shell much like `apptainer shell`. Note that volumes (the docker equivalent of bind paths) are specified differently in Docker compared to Apptainer.
389
-
:::
390
-
391
-
:::{.callout-note}
392
-
## WDL makes this way easier
393
-
394
-
A major point of failure with Apptainer scripting is when our scripts aren't using the right bind paths. It becomes even more complicated when you are running multiple steps.
395
-
396
-
This is one reason we recommend writing WDL Workflows and a {{<glossary "workflow manager">}} (such as {{<glossary "Cromwell">}} or Sprocket) to run your workflows. You don't have to worry that your bind points are setup correctly, because they are handled by the workflow manager.
397
-
:::
398
-
399
-
### Testing in the Apptainer Shell
400
-
401
-
Ok, now we have a bind point, so now we can test our script in the shell. For example, we can see if we are invoking `samtools`in the correct way and that our bind points work.
Again, trying out scripts in the container is the best way to understand what the container can and can't see.
408
-
409
-
### Exiting the container when you're done
410
-
411
-
You can `exit`, like any shell you open. You should be out of the container. Confirm by using `hostname` to make sure you're out of the container.
412
-
413
-
### Testing outside of the container
414
-
415
-
Let's take everything that we learned and put it in a script that we can run on the HPC:
416
-
417
-
```bash
418
-
# Script to samtools view -c an input file:
419
-
# Usage: ./run_sam.sh <my_bam_file.bam>
420
-
# Outputs a count file: my_bam_file.bam.counts.txt
421
-
#!/bin/bash
422
-
module load Apptainer/1.1.6
423
-
apptainer run --bind /fh/fast/mydata:/mydata docker://biocontainers/samtools:v1.9-4-deb_cv1 samtools view -c /mydata/$1> /mydata/$1.counts.txt
424
-
#apptainer cache clean
425
-
module purge
426
-
```
427
-
428
-
We can use this script by the following command:
429
-
430
-
```
431
-
./run_sam.sh chr1.bam
432
-
```
433
-
434
-
And it will output a file called `chr1.bam.counts.txt`.
435
-
436
-
:::{.callout}
437
-
## Apptainer Cache
438
-
439
-
[The apptainer cache](https://apptainer.org/docs/user/1.0/build_env.html) is where your docker images live. They are translated to the native apptainer `.sif` format.
440
-
441
-
You can see what's in your cache by using
442
-
443
-
```
444
-
apptainer cache list
445
-
```
446
-
447
-
By default the cache lives at `~/.apptainer/cache`.
448
-
449
-
If you need to clear out the cache, you can run
450
-
451
-
```
452
-
apptainer cache clean
453
-
```
454
-
455
-
to clear out the cache.
456
-
457
-
There are a number of environment variables (@sec-environment) that can be set, including login tokens for pulling from a private registry. [More information is here](https://apptainer.org/docs/user/1.0/build_env.html#environment-variables).
458
-
:::
459
-
460
-
### More Info
461
-
- [Carpentries Section on Apptainer Paths](https://hsf-training.github.io/hsf-training-singularity-webpage/07-file-sharing/index.html) - this is an excellent resource if you want to dive deeper into undestanding container filesystems and bind points.
462
-
- [Apptainer Documentation on Bind Paths](https://apptainer.org/docs/user/main/bind_paths_and_mounts.html#bind-examples). There are a lot of good examples here on how to set up bind paths.
463
-
- [More about bind paths and other options](https://apptainer.org/docs/user/main/bind_paths_and_mounts.html).
0 commit comments