Shifter

Spec sheet

Purpose

Shifter enables HPC systems to run end-user container images, including Docker images.Read 11 Oct 2026 · github.com

Support

The project README directs users to its Google Groups email list for updates and community support.Read 11 Oct 2026 · github.com

License

The repository license permits redistribution and use in source and binary forms subject to stated conditions and disclaimers.Read 11 Oct 2026 · github.com

Architecture

The project includes a compute-node utility, an image gateway that pulls and repacks registry images, and example scripts or plugins for batch scheduler integration.Read 11 Oct 2026 · github.com

Authentication

Access to the image gateway API requires authentication using Munge.Read 11 Oct 2026 · github.com

Batch integration

The repository includes example integrations for workload managers, and NERSC's usage documentation shows Shifter jobs submitted with Slurm.Read 11 Oct 2026 · github.com

Container images

Users can create their software environments typically with Docker, and Shifter supports sharing HPC software through Docker and the Docker Hub community.Read 11 Oct 2026 · github.com

Contribution channel

The README directs contributors to a Slack channel and says code can be submitted through GitHub pull requests.Read 11 Oct 2026 · github.com

Current status

NERSC says it still supports Shifter but eventually plans to phase it out in favor of podman-hpc.Read 11 Oct 2026 · docs.nersc.gov

How it works

Shifter has a compute-node utility, an image gateway that pulls and repacks registry images, and example scripts or plugins for batch schedulers.Read 11 Oct 2026 · github.com

Image format

The image gateway repacks images into a format suitable for the HPC system, typically squashfs.Read 11 Oct 2026 · github.com

Image limits

NERSC says images larger than about 20 GB will likely time out when uploaded to Docker Hub and recommends contacting support for images over 20 GB.Read 11 Oct 2026 · docs.nersc.gov

Image registries

NERSC documentation says users can pull images from Docker Hub or NERSC's private registry, which the image manager converts to a flattened format for compute nodes.Read 11 Oct 2026 · docs.nersc.gov

Intended outcomes

The project aims to simplify software deployment, enable portable environments, support repeatable science, and improve system utilization by optimizing software delivery and I/O bottlenecks.Read 11 Oct 2026 · github.com

MPI

NERSC documents an MPICH integration that swaps Cray libraries into images at runtime for multi-node communication, subject to image compatibility requirements.Read 11 Oct 2026 · docs.nersc.gov

Performance

NERSC says Shifter's loop-mount approach moves metadata operations to compute nodes and improves performance for workloads that load many shared libraries.Read 11 Oct 2026 · docs.nersc.gov

Runtime privilege

The security documentation says container processes are stripped of privileges after launch and should not be able to regain them.Read 11 Oct 2026 · github.com

Scheduler integration

The project provides example scripts and plugins for integrating Shifter with batch scheduler systems.Read 11 Oct 2026 · github.com

Security controls

The project documentation describes nosuid mounts, restricting process capabilities to the null set, and attempting to apply Linux no_new_privs on newer systems.Read 11 Oct 2026 · github.com

Security guidance

The documentation recommends avoiding privileged processes in containers and using the most recent Shifter version.Read 11 Oct 2026 · github.com

Security model

Shifter uses privileged operations to set up containers; its security documentation says processes launched in a container have privileges stripped and should not be able to re-escalate.Read 11 Oct 2026 · github.com

Volume mounts

Users can mount existing directories into an image with a volume option, including paths for data and job output.Read 11 Oct 2026 · docs.nersc.gov

Where Specifiction places it

• Container Engines#27 of 317.0