Athena in Ubuntu using Docker containers

Last update: 05 Jul 2023 [History] [Edit]

Install Docker

Detailed instruction for installing Docker in Ubuntu are found here:

Get Docker for Ubuntu

If you do not wish to execute docker as a super-user, you can create a docker user group on your machine as described in Manage Docker as a non-root user. In summary, to create the docker group and add a user:

  • Create the docker group 
    sudo groupadd docker
  • Add yourself to the docker group 
    sudo usermod -aG docker $USER
  • Log out and back in so that the changes are in effect.

In this case, it is recommended that you get acquainted with the security features of docker due to the issues discussed in Docker daemon attack surface.

Install CVMFS

ATLAS software is available inside the container via a local installation of CVMFS. Install cvmfs in Ubuntu following these steps:

  • In order to add the apt repository, run: 
    wget https://ecsft.cern.ch/dist/cvmfs/cvmfs-release/cvmfs-release-latest_all.deb
sudo dpkg -i cvmfs-release-latest_all.deb
rm -f cvmfs-release-latest_all.deb
sudo apt-get update
  • To install cvmfs, execute: 
    sudo apt-get install cvmfs cvmfs-config-default
  • Configure Cvmfs. Basically, edit /etc/cvmfs/default.local to set the following variables: 
    CVMFS_REPOSITORIES=atlas.cern.ch,atlas-condb.cern.ch,atlas-nightlies.cern.ch,sft.cern.ch
CVMFS_CACHE_BASE=/<path>/cache/cvmfs2 Not needed if you use /var/lib/cvmfs
CVMFS_QUOTA_LIMIT=<should be equal 90% of the partition size (in MB)>
CVMFS_HTTP_PROXY="< address of the squid server>"
  • Check the installation with: 
    sudo service autofs start
sudo cvmfs_config killall
sudo cvmfs_config setup
sudo cvmfs_config chksetup
  • Since you want to use CVMFS later inside a docker container use the instructions in CernVM-FS in Docker Containers to mount the ATLAS repositories manually 
    sudo service autofs stop
sudo mkdir -p /cvmfs/atlas.cern.ch
sudo mkdir -p /cvmfs/atlas-condb.cern.ch
sudo mkdir -p /cvmfs/atlas-nightlies.cern.ch
sudo mkdir -p /cvmfs/sft.cern.ch
sudo mount -t cvmfs atlas.cern.ch /cvmfs/atlas.cern.ch
sudo mount -t cvmfs atlas-condb.cern.ch /cvmfs/atlas-condb.cern.ch
sudo mount -t cvmfs atlas-nightlies.cern.ch /cvmfs/atlas-nightlies.cern.ch
sudo mount -t cvmfs sft.cern.ch /cvmfs/sft.cern.ch
  • Make sure that there is enough space available on the partition that mounts the CVMFS cache directory /var/lib/cvmfs.

Loading an image

Like similar virtualization programs docker uses images to setup and configure a new operating system environment. You can setup e.g. a new Scientific Linux image from scratch and use it on your local machine or distribute it to other machines. Pre-configured images can be stored in Docker Hub and be made available to other users.

Test your docker installation by launching the hello-world docker image:

docker run hello-world

Docker will first attempt to find the hello-world image in the local host. If it fails, it will download the image and run it to display a “Hello from Docker!” message.

X11 forwarding

To be able to run X11 applications from inside the docker container and export them to your Linux desktop, use the following steps:

  • To allow X11 connections, run the following command before starting the docker container:xhost +
  • Start the docker container with the following additional arguments: -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=$DISPLAY

Generic Docker images with HEP software

An example docker image is available that allows you to access ATLAS software over a local installation of CVMFS.

Pull the image to the local machine with:

docker pull atlas/atlas_external_cvmfs

Now run a docker container with that image with the following command:

docker run --net host -i -t -v /cvmfs:/cvmfs -v $HOME:$HOME -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=$DISPLAY atlas/atlas_external_cvmfs

Note the following options:

  • --net host: allows outbound internet access from the docker container
  • -v /cvmfs:/cvmfs: this mounts the previously created CVMFS mount points inside the docker container
  • -v $HOME:$HOME: allows access to the local home directory from inside the docker container
  • -v /tmp/.X11-unix:/tmp/.X11-unix: bind mounts the X11 socket residing in /tmp/.X11-unix on your local machine into /tmp/.X11-unix in the container
  • The default user inside the container is atlas, which has sudo rights

Start Athena similar to a session on lxplus:

setupATLAS
asetup main,latest,Athena,gcc62

You can now start a ROOT session or run a test job in the container:

mkdir run && cd run
Reco_tf.py --AMI q431 --outputESDFile myESD

Save and upload a Docker image

How to commit and push a docker image to a public repository is covered in the Save a Docker image section of Athena for Developers and other Commands.