AWS parallelcluster medium security documentation change
Summary
Added Ubuntu 24.04 workaround for AppArmor restrictions and section title change
Security assessment
Explicitly documents disabling AppArmor security restrictions (kernel.apparmor_restrict_unprivileged_userns) to enable functionality, which involves security configuration changes
Diff
diff --git a/parallelcluster/latest/ug/tutorials_11_running-containerized-jobs-with-pyxis.md b/parallelcluster/latest/ug/tutorials_11_running-containerized-jobs-with-pyxis.md index 2bac25ef2..1ab8f2cc8 100644 --- a//parallelcluster/latest/ug/tutorials_11_running-containerized-jobs-with-pyxis.md +++ b//parallelcluster/latest/ug/tutorials_11_running-containerized-jobs-with-pyxis.md @@ -96,0 +97,9 @@ Pyxis and Enroot must be configured on the head node by first creating the persi + # In Ubuntu24.04 Apparmor blocks the creation of unprivileged user namespaces, + # which is required by Enroot. So to run Enroot, it is required to disable this restriction. + # See https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces + source /etc/os-release + if [ "${ID}${VERSION_ID}" == "ubuntu24.04" ]; then + echo "kernel.apparmor_restrict_unprivileged_userns = 0" | sudo tee /etc/sysctl.d/99-pcluster-disable-apparmor-restrict-unprivileged-userns.conf + sudo sysctl --system + fi + @@ -120 +129 @@ AWS ParallelCluster UI Integration with Identity Center -AWS ParallelCluster troubleshooting +Creating a cluster with an EFA-enabled FSx Lustre