Good practices when working with containers

[ReHoss]

Hi,

Given an image build from a Docker image.

I want to install complementary Python packages in the Python environment venv inside the container/image.

Is the best practice to construct a new .sif file bootstrapping from the .sif image issued from the Docker to SIF conversion and add the environment activation and package installation commands?

On an HPC and in general, the proper workflow is to develop code outside singularity and use the interpreter from the container to execute this code on the HPC? Hence, my Python is isolated, and I only use the container to get a stable working Python installation of the heavy Python framework installed in the container (firedrake)?

Thank you a lot for your help,
Best,

[ReHoss]

Some answers from @dtrudg on Slack:

If you are working with sandboxes, general advice would be build as the same user you run them as.
If you build as sudo, run with sudo
If you build without sudo, run without sudo
A sandbox isn’t intended to be absolutely transferrable between users. Because it is just files on the host then it is affected by permissions / ACLs / any issues with network filesystems etc.

If you are building to a SIF it is fine to build it with sudo, then run without sudo.
In fact, if you are building from a definition file, where you are adding packages, changing the image in a %post script etc. then you will often need to build as root, with sudo or --fakeroot.