Containers and clusters

Package the same Go workers for a server or cluster. Declare the inputs, writable paths and one task; preserve the scientific replay boundary.

Available since ClonoLoom 0.8.0.

A small native image

The multi-stage Dockerfile pins the official Go builder by digest and produces a static program in a shell-free runtime. The image defaults to a non-root numeric user and help, with no browser or server startup. The allowlisted build context contains compilation inputs and embedded assets; the runtime contains the program and license notices. No registry publication is configured.

revision="$(git rev-parse HEAD)"
if test -n "$(git status --porcelain)"; then revision="${revision}-dirty"; fi
docker build --network=none --build-arg "REVISION=$revision" -t clonoloom:local .
image_id="$(docker image inspect clonoloom:local --format '{{.Id}}')"

The builder may require an initial download. Compilation has no module/toolchain network access. Keep the image ID and inspect record with the source revision; an operator-supplied revision is provenance, not authentication.

Explicit writable boundaries

The command helper prints the full policy for review and never executes it. It rejects overlapping input/output mounts, linked inputs, mutable image tags and existing destinations. Podman needs its explicit read-only-tmpfs setting; rootless ownership and SELinux labels depend on the site.

Select one replay task

A private bundle helper copies selected certificates without rewriting their bytes, pins each with size and SHA-256, and writes a versioned recipe plus an explicit task list. One array index selects one named certificate task. There is no implicit pooling or automatic restart.

node docs/examples/cluster-replay.mjs /absolute/new-bundle \
  batch-qc /absolute/qc/result.certificate.clz \
  motifs /absolute/motifs/result.certificate.clz
node docs/examples/container-run.mjs docker "$image_id" \
  /absolute/new-bundle replay.json task-000 \
  /absolute/existing-results replay-000

For Slurm, the included native batch script quotes paths, checks the index and preserves the native exit status. The operator chooses allocation and submits the job. Local tests exercise array selection without a scheduler. Apptainer conversion and site-specific launchers are not validated here; their mount, environment and signal behavior require separate checks.

Keep scientific evidence exact

Source computation remains limited to batch QC and motifs. Certificate replay covers those two kinds plus cohort features, comparisons and count models. Native/container scientific files are compared byte for byte. One-bit changes fail, unsupported methods remain unavailable, and no tolerance fallback is introduced.

Replay begins with captured evidence, not upstream source parsing or clonotyping. A container does not establish treatment effects, antigen specificity or independent replication. Methods, citations, source restrictions and identifiers stay with the evidence. Read the existing headless support matrix and replay limits.

Cancellation and incomplete output

SIGTERM reaches the native process directly. Handled cancellation reports exit 2 and a cancelled record, then cleans temporary snapshots. Hard kills, OOM and scheduler time limits can leave partial outputs. A directory or a matching checksum alone is not a successful scientific run; inspect the final record and exit status.

The complete container and cluster guide includes reproducible artificial-study commands, numeric ownership, scratch sizing, failure cases, tests and official runtime/scheduler references. No publication or scheduler submission is automatic.