DrDaveD

I don't see how that can happen unless the processes started by the container haven't all exited. Can you check to see if all the processes have exited? Can you...

I don't see how it could because there is a lot of production experience with running containers from jobs with unprivileged user namespaces, and no-one else has reported a similar...

The only cluster that I have access to with slurm on it is el7 and has different packages installed, and I don't have administrative access, so I doubt I will...

This command will exclude all the processes that don't have user namespaces: ``` ps -e -o pid,userns,args|grep -v '^[ ]*[1-9][0-9]*[ ]*-' ```

It looks like namespace information only shows up for your own processess. On the other hand, the namespace limits are supposed to be per-user. I don't know if slurm does...

Ok so something about MPI is causing namespaces to be held onto. Is there a long-running MPI-related process on the execute node? Is the MPI container used also as simple...

@e4t Does your SUSE host system contain configuration in /etc/containers, something like what is referred to in [this article](https://developers.redhat.com/blog/2019/10/29/verifying-signatures-of-red-hat-container-images)?

Ok so this shows how to reproduce the problem on any host operating system. > the way the container layers are stored for `apptainer build ..` does not allow for...

That's got to be something that can be overridden in the API.

Btw I expect that apptainer-1.4 won't use much `containers/image` code at all, because singularity-ce has converted their code to instead use go-containerregistry and I plan to do the same for...