Avoid viewing my user host from the container

[migrau]

Description of issue
I don't wan't to see my local/host user from the container.

My Dockerfile:

FROM python:3.10.5
    
RUN apt-get update -y && apt-get upgrade -y
RUN pip install matplotlib numpy pandas

Once created, when doing

singularity exec mycontainer.img ls /home/

I see my local/host user, instead an empty folder.
I tried with --containall, --contain, --cleanenv and -B ../passwd:/etc/passwd

# content of .../passwd
user:x:1000:1000:,,,:/home/user:/bin/bash

But I still see my local/host user. The only way I don't see is when using --fakeroot, but I can't use it on our HPC.
What I am doing wrong? Thanks

[dtrudg]

Transferred to a Q&A discussion as this is usage focused rather than a bug / feature request.

You aren't doing anything wrong. This is the way that Singularity is designed, which is purposefully different from Docker:

https://docs.sylabs.io/guides/latest/user-guide/introduction.html

You are the same user inside a container as outside, and cannot gain additional privilege on the host system by default.

The only way you can be a different user in the container is via a Linux feature called user namespaces. --fakeroot uses user namespaces and subuid/subgid mapping, so that you can be a different user inside the container than you are on the host.

If you are unable to use --fakeroot then this would be because either user namespaces or subuid/subgid mapping is not configured, and there is no easy way around this.

Singularity's newer OCI-Mode tries to be closer to Docker etc. For example, it would respect the USER line in a Dockerfile. However it relies on the same Linux features as --fakeroot.

[dtrudg]

Note that if you just want to avoid seeing your home directory in the container, but don't mind being the same user in the container, you can use --no-mount home.

[migrau]

Many thanks for the explanation @dtrudg !