Add documentation how to avoid data modification by tools#14239
Add documentation how to avoid data modification by tools#14239nsoranzo merged 6 commits intogalaxyproject:devfrom
Conversation
Co-authored-by: Marius van den Beek <m.vandenbeek@gmail.com>
| - Configure Galaxy to run jobs in a container and enable ``outputs_to_working_directory``. Then the tool will in an environment that allows write access only for the job working dir. All other paths will be accessible read only. | ||
| - Use pulsar to stage inputs and outputs | ||
|
|
||
| For both more information can be found in the [job configuration](jobs.md) documentatiion and see also [using a compute cluster](cluster.md). |
There was a problem hiding this comment.
| For both more information can be found in the [job configuration](jobs.md) documentatiion and see also [using a compute cluster](cluster.md). | |
| More information on pulsar configuration can be found in the [job configuration](jobs.md) documentation, and the other two are explained in [using a compute cluster](cluster.md). |
There was a problem hiding this comment.
I'm not sure it's enough information for the pulsar option, jobs.md doesn't really cover much right? Would it maybe be useful to link to https://training.galaxyproject.org/training-material/topics/admin/tutorials/interactive-tools/tutorial.html#securing-interactive-tools (or better, have us extract that pulsar bit and link to that?)
There was a problem hiding this comment.
I'm fine with both, but don't feel competent wrt pulsar to move the pulsar bit from GTN.
Co-authored-by: Helena <hxr@hx42.org>
Co-authored-by: Martin Cech <cech.marten@gmail.com>
|
It might be good to have a top level "Security Considerations" page that this goes on to? Otherwise, I like this a lot, it's something that some admins eventually learn but that we definitely should have been more explicit about up front. |
Co-authored-by: Nicola Soranzo <nicola.soranzo@gmail.com>
|
This PR was merged without a "kind/" label, please correct. |
6 participants
While working on #14235 I thought this might be a nice addition to the docs.
Not entirely sure if
real_system_usernamewill work for non DRMAA job runners?How to test the changes?
(Select all options that apply)
License