Docker & Apptainer Containers

Kubernetes executes container images based on the Open Container Initiative (OCI) standard. You can build your images using Docker or Podman.

Example: Scientific Python & CUDA Dockerfile

Here is a recommended Dockerfile template with non-root user permissions and PyTorch GPU support:

# Use official NVIDIA PyTorch base image
FROM pytorch/pytorch:2.3.0-cuda12.1-cudnn8-runtime

# Install system utilities and scientific libraries
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    htop \
    rsync \
    libgl1-mesa-glx \
    && rm -rf /var/lib/apt/lists/*

# Install Python requirements
COPY requirements.txt /tmp/requirements.txt
RUN pip install --no-cache-dir -r /tmp/requirements.txt

# Create non-root research user (UID 1000)
RUN useradd -m -u 1000 scientist
USER scientist
WORKDIR /home/scientist

# Copy project source code
COPY --chown=scientist:scientist . /home/scientist/app

CMD ["python", "app/train.py"]

Building and Pushing to Berkelium Harbor

# Build the container image locally
docker build -t harbor.bk.lbl.gov/als-beamline/synchrotron-model:v1 .

# Log in and push
docker push harbor.bk.lbl.gov/als-beamline/synchrotron-model:v1

Container Registries & In-Pod Internet Access

Image Pulling (Automatic): Kubernetes downloads container base images directly from Docker Hub (docker.io), GitHub Container Registry (ghcr.io), NVIDIA NGC (nvcr.io), and Quay (quay.io) at the cluster node level.
In-Pod Operations (Automatic via NAT64): Because Berkelium provides transparent DNS64 and NAT64 (2620:83:8000:64::/96) routing alongside RFC 4193 ULA Pod IPv6 addresses (fdf5:542c:f102:92cf:1000::/100), both IPv6 and IPv4-only services like GitHub (github.com), PyPI, and Hugging Face work directly from inside running containers without any HTTP proxy configuration. See the Internet Egress & NAT64 Guide for details.