Releases: sylabs/singularity
SingularityCE 4.4.2
Security Related Fixes
- Fix for CVE-2026-47215 / GHSA-wqcr-7rf3-f64m Incorrect path matching for 'limit container paths' directive
Changed Defaults / Behaviours
Although SingularityCE does not aim to contain execution / prevent host modification when started as the host root user, the following changes have been adopted to permit finer control over the use of external binaries, with a modified default search path when singularity is run as the host root user:
- When started as host root, external binaries (except those with explicit configuration entries) are now found using the
root search pathinsingularity.conf. By default this excludes searching the environment$PATH. Add$PATH:to the start ofroot search pathinsingularity.confto restore previous behavior. - When started as non-root / fake root, external binaries (except those with explicit configuration entires) are now found using the
user search pathinsingularity.conf. By default this includes$PATH, so there is no effective behaviour change vs previous versions.
Thank you to @KoseceMehmet for suggesting this change.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.4.2.tar.gz download below to obtain and install SingularityCE 4.4.2. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.26.4
Upload-time immutable digests are now provided for release downloads by GitHub. A separate sha256sums file will no longer be provided.
SingularityCE 4.4.1
Bug Fixes
- Use lazy unmount for overlay items that are FUSE mounted, to prevent errors if unmount takes time due to the device being busy. We already use lazy (MNT_DETACH) for kernel mounted overlay items.
- Address FUSE unmount error that can occur with short-lived containers on busy systems.
- Fix spurious cleanup error message when cleanup is successful.
Requirements / Packaging
- Requires Go 1.25.7 or above, due to various dependencies.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.4.1.tar.gz download below to obtain and install SingularityCE 4.4.1. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.26.1
Upload-time immutable digests are now provided for release downloads by GitHub. A separate sha256sums file will no longer be provided.
SingularityCE 4.4.0
This is a new minor version, focused around modernisation of code and bugfix improvements as detailed below.
Bug Fixes
- Include the home directory in the
--workdiroption (which is a modifier of the--containoption). This has always been in the
--workdirusage description but the home directory has not actually been included at least since singularity-2. - Avoid a fatal error when starting fakeroot from suid mode while in an NFS directory.
- Support hosts that have
/etc/resolv.confpointing to a symlink under/run, such as those hosts that are runningsystemd-resolved. In this case, the symlink is copied into the container and the parent directory of the target of the symlink is bind-mounted from the host. The result is that even if the target of the symlink is replaced with a new file, the container sees the update in/etc/resolv.conf. - Correctly escape ENV vars when importing OCI containers to native SIF, so that they match podman / docker behaviour.
- Clarify error when trying to build --oci from a non-Dockerfile spec.
- When images are pulled implicitly by actions (run/shell/exec...), and the cache is disabled, correctly clean up the temporary files.
- Ensure singularity-buildkitd runs effective GC at the start of each run.
- Apply --debug flag to buildkit logging correctly.
- Avoid OOM by buffering
docker-daemon:images via a temporary file instead of memory. Note that the file is created in$TMPDIR- the dependency involved cannot be instructed to use$SINGULARITY_TMPDIRat this time.
New Features & Functionality
- Add
/etc/resolv.confto the list of host paths that can be prevented from automatic import into the container with the--no-mountoption.
Requirements / Packaging
- Requires Go 1.25.6 or above, due to various dependencies.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.4.0.tar.gz download below to obtain and install SingularityCE 4.4.0. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.26.0
SingularityCE 4.3.7
This is a patch release in the 4.3 series.
Bug Fixes
- Don't attempt to set
relatimeon workdir / scratch mounts in OCI-Mode.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.3.7.tar.gz download below to obtain and install SingularityCE 4.3.7. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.25.6
SingularityCE 4.3.6
This is a patch release in the 4.3 series, with security fixes.
Security Related Fixes
- Updates bundled CNI plugins to v1.9.0, to fix CVE-2025-67499 Portmap nftables backend can intercept non-local traffic.
- Dependencies updated.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.3.6.tar.gz download below to obtain and install SingularityCE 4.3.6. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.25.5
SingularityCE 4.3.5
This is a patch release in the 4.3 series, with security fixes.
Security Related Fixes
- Fix for CVE-2025-64750 / GHSA-wwrx-w7c9-rf87 Ineffective application of selinux / apparmor LSM process labels via the
--securityflag. - Dependencies updated.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.3.5.tar.gz download below to obtain and install SingularityCE 4.3.5. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.25.4
SingularityCE 4.3.4
This is a patch release in the 4.3 series,
Security Related Fixes
- GitHub release packages built using Go 1.25.3, due to large number of denial-of-service CVEs fixed in 1.25.2.
- All dependencies updated.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.3.4.tar.gz download below to obtain and install SingularityCE 4.3.4. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.25.3
SingularityCE 4.3.3
This is a patch release in the 4.3 series, with dependency updates and the following changes:
Requirements / Packaging
- Requires Go 1.24.3 or above, due to various dependencies.
- Bundled squashfuse is now 0.6.1.
Changed defaults / behaviours
- Use OCI Manifest Schema 1 for ORAS pushes. Addresses errors pushing to Quay,
which applies amust berestriction for theconfig.mediaTypevalue on
Docker Manifest Schema 2 (spec has a loosershould generally be).
Bug fixes
- Don't set ineffective
mode=777on workdir bind. Fixes error in OCI-mode with
--workdirand runc >= 1.2.0.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.3.3.tar.gz download below to obtain and install SingularityCE 4.3.3. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.25.0
SingularityCE 4.3.2
This is a patch release in the 4.3 series, with dependency updates and the following changes:
Requirements / Packaging
- Ubuntu 20.04 packages dropped - end-of-life.
- EL 10 (RHEL/AlmaLinux/Rocky Linux 10) packages introduced.
- Build bundled squashfuse against FUSE3 for all packages.
- Don't depend on
fuseon Ubuntu - installing this package on 22.04 can
cause conflicts with the Ubuntu Desktop package set.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.3.2.tar.gz download below to obtain and install SingularityCE 4.3.2. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
- RHEL/CentOS/AlmaLinux/Rocky 10 (el10)
These packages were built with Go 1.24.4
SingularityCE 4.3.1
This is a patch release in the 4.3 series.
Bug Fixes
- Update bundled squashfuse to 0.6.0, which includes
.,..entries ingetdents()results, fixing errors with some applications.
Thanks / Reporting Bugs
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Downloads
Source Code
Please use the singularity-ce-4.3.1.tar.gz download below to obtain and install SingularityCE 4.3.1. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Packages
RPM / DEB packages are provided for:
- Ubuntu 20.04 (focal)
- Ubuntu 22.04 (jammy)
- Ubuntu 24.04 (noble)
- RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
- RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
These packages were built with Go 1.24.2