  Apptainer (formerly known as Singularity) since its beginning implemented
many of its container features with the assistance of a setuid-root program. It
still supports that mode, but as of version 1.1.0 it no longer uses setuid by
default. This is feasible because it now can mount squashfs filesystems, ext3
filesystems, and overlay filesystems using unprivileged user namespaces and
FUSE. It also now enables unprivileged users to build containers, even without
requiring system administrators to configure /etc/subuid and /etc/subgid unlike
other "rootless" container systems. As a result, all the unprivileged functions
can be used nested inside of another container, even if the container runtime
prevents any elevated privileges. As of version 1.2.0 Apptainer also supports
completely unprivileged encryption of Singularity Image Format (SIF) container
files. Performance with a particularly challenging HEP benchmark using the
FUSE-based mounts both with and without encryption is essentially identical to
the previous methods that required elevated privileges to use the Linux
kernel-based counterparts.
