Add singularity.resourceLimits config option (#7352)

bentsherman · web-flow · commit 98e8573ed996 · 2026-07-23T13:45:45.000-05:00
Signed-off-by: Ben Sherman &lt;bentshermann@gmail.com&gt;
diff --git a/docs/reference/config.mdx b/docs/reference/config.mdx
@@ -139,6 +139,12 @@ The amount of time the Apptainer pull can last, exceeding which the process is t
 
 The registry from where Docker images are pulled. It should be only used to specify a private registry server. It should NOT include the protocol prefix i.e. `http://`.
 
+##### `apptainer.resourceLimits`
+
+<AddedInVersion version="26.10" />
+
+Apply the task `cpus` and `memory` directives as container resource limits using the `--cpus` and `--memory` flags (default: `false`).
+
 ##### `apptainer.runOptions`
 
 Specify extra command line options supported by `apptainer exec`.
@@ -1974,6 +1980,12 @@ The amount of time the Singularity pull can last, after which the process is ter
 
 The registry from where Docker images are pulled. It should be only used to specify a private registry server. It should NOT include the protocol prefix i.e. `http://`.
 
+##### `singularity.resourceLimits`
+
+<AddedInVersion version="26.10" />
+
+Apply the task `cpus` and `memory` directives as container resource limits using the `--cpus` and `--memory` flags (default: `false`).
+
 ##### `singularity.runOptions`
 
 Specify extra command line options supported by `singularity exec`.
diff --git a/modules/nextflow/build.gradle b/modules/nextflow/build.gradle
@@ -93,15 +93,6 @@ dependencies {
 test {
     minHeapSize = "512m"
     maxHeapSize = "4096m"
-    // Dev-mode plugin discovery reads plugins/*/build/resources/main/META-INF/MANIFEST.MF at
-    // runtime. Each plugin's copyPluginManifest task (re)writes that file by truncating and
-    // copying; when a full `gradle test` run schedules both, order this task after them so a
-    // manifest is never read mid-write, which otherwise surfaces intermittently as the pf4j
-    // error "Field 'id' cannot be empty". Ordering only (mustRunAfter), so running
-    // :nextflow:test on its own does not force every plugin to build.
-    mustRunAfter rootProject.subprojects
-            .findAll { it.path.startsWith(':plugins:') }
-            .collect { "${it.path}:copyPluginManifest" }
 }
 
 application {
diff --git a/modules/nextflow/src/main/groovy/nextflow/container/ApptainerBuilder.groovy b/modules/nextflow/src/main/groovy/nextflow/container/ApptainerBuilder.groovy
@@ -48,6 +48,8 @@ class ApptainerBuilder extends SingularityBuilder {
         if( config.engineOptions )
             this.addEngineOptions(config.engineOptions)
 
+        this.resourceLimits = config.resourceLimits
+
         if( config.runOptions )
             this.addRunOptions(config.runOptions)
     }
diff --git a/modules/nextflow/src/main/groovy/nextflow/container/ApptainerConfig.groovy b/modules/nextflow/src/main/groovy/nextflow/container/ApptainerConfig.groovy
@@ -89,6 +89,12 @@ class ApptainerConfig implements ConfigScope, ContainerConfig {
     """)
     final String registry
 
+    @ConfigOption
+    @Description("""
+        Apply the task `cpus` and `memory` directives as container resource limits using the `--cpus` and `--memory` flags (default: `false`).
+    """)
+    final boolean resourceLimits
+
     @ConfigOption
     @Description("""
         Specify extra command line options supported by `apptainer exec`.
@@ -109,6 +115,7 @@ class ApptainerConfig implements ConfigScope, ContainerConfig {
         ociAutoPull = opts.ociAutoPull as boolean
         pullTimeout = opts.pullTimeout as Duration ?: Duration.of('20min')
         registry = opts.registry
+        resourceLimits = opts.resourceLimits as boolean
         runOptions = opts.runOptions
     }
 
diff --git a/modules/nextflow/src/main/groovy/nextflow/container/SingularityBuilder.groovy b/modules/nextflow/src/main/groovy/nextflow/container/SingularityBuilder.groovy
@@ -41,6 +41,8 @@ class SingularityBuilder extends ContainerBuilder<SingularityBuilder> {
 
     private Boolean ociMode
 
+    protected boolean resourceLimits
+
     SingularityBuilder(String name) {
         this.image = name
         this.homeMount = defaultHomeMount()
@@ -84,6 +86,7 @@ class SingularityBuilder extends ContainerBuilder<SingularityBuilder> {
             this.addEngineOptions(config.engineOptions)
 
         this.ociMode = config.ociMode
+        this.resourceLimits = config.resourceLimits
 
         if( config.runOptions )
             this.addRunOptions(config.runOptions)
@@ -132,6 +135,13 @@ class SingularityBuilder extends ContainerBuilder<SingularityBuilder> {
         if( ociMode != null )
             result << (ociMode ? '--oci ' : '--no-oci ')
 
+        if( resourceLimits ) {
+            if( cpus )
+                result << "--cpus ${cpus} "
+            if( memory )
+                result << "--memory ${memory} "
+        }
+
         if( autoMounts ) {
             makeVolumes(mounts, result)
         }
diff --git a/modules/nextflow/src/main/groovy/nextflow/container/SingularityConfig.groovy b/modules/nextflow/src/main/groovy/nextflow/container/SingularityConfig.groovy
@@ -95,6 +95,12 @@ class SingularityConfig implements ConfigScope, ContainerConfig {
     """)
     final String registry
 
+    @ConfigOption
+    @Description("""
+        Apply the task `cpus` and `memory` directives as container resource limits using the `--cpus` and `--memory` flags (default: `false`).
+    """)
+    final boolean resourceLimits
+
     @ConfigOption
     @Description("""
         Specify extra command line options supported by `singularity exec`.
@@ -116,6 +122,7 @@ class SingularityConfig implements ConfigScope, ContainerConfig {
         ociMode = opts.ociMode as Boolean
         pullTimeout = opts.pullTimeout as Duration ?: Duration.of('20min')
         registry = opts.registry
+        resourceLimits = opts.resourceLimits as boolean
         runOptions = opts.runOptions
     }
 
diff --git a/modules/nextflow/src/test/groovy/nextflow/container/ApptainerBuilderTest.groovy b/modules/nextflow/src/test/groovy/nextflow/container/ApptainerBuilderTest.groovy
@@ -19,6 +19,7 @@ package nextflow.container
 import java.nio.file.Paths
 
 import nextflow.SysEnv
+import nextflow.util.MemoryUnit
 import spock.lang.Specification
 import spock.lang.Unroll
 /**
@@ -220,6 +221,21 @@ class ApptainerBuilderTest extends Specification {
         cmd == 'set +u; env - PATH="$PATH" ${TMP:+APPTAINERENV_TMP="$TMP"} ${TMPDIR:+APPTAINERENV_TMPDIR="$TMPDIR"} apptainer exec --no-home --pid -B "$NXF_TASK_WORKDIR" ubuntu.img /bin/sh -c "cd \\"$NXF_TASK_WORKDIR\\"; bwa --this --that file.fastq"'
     }
 
+    def 'should emit resource limits when enabled' () {
+        expect:
+        new ApptainerBuilder('busybox')
+                .setCpus(2)
+                .setMemory(new MemoryUnit('100M'))
+                .build()
+                .runCommand == 'set +u; env - PATH="$PATH" ${TMP:+APPTAINERENV_TMP="$TMP"} ${TMPDIR:+APPTAINERENV_TMPDIR="$TMPDIR"} apptainer exec --no-home --pid -B "$NXF_TASK_WORKDIR" busybox'
+
+        new ApptainerBuilder('busybox', new ApptainerConfig(resourceLimits: true))
+                .setCpus(2)
+                .setMemory(new MemoryUnit('100M'))
+                .build()
+                .runCommand == 'set +u; env - PATH="$PATH" ${TMP:+APPTAINERENV_TMP="$TMP"} ${TMPDIR:+APPTAINERENV_TMPDIR="$TMPDIR"} apptainer exec --no-home --pid --cpus 2 --memory 100m -B "$NXF_TASK_WORKDIR" busybox'
+    }
+
     @Unroll
     def 'test apptainer env'() {
 
diff --git a/modules/nextflow/src/test/groovy/nextflow/container/ApptainerConfigTest.groovy b/modules/nextflow/src/test/groovy/nextflow/container/ApptainerConfigTest.groovy
@@ -33,6 +33,7 @@ class ApptainerConfigTest extends Specification {
         expect:
         config.envWhitelist == []
         config.pullTimeout.toMillis() == 20 * 60 * 1000 //20 min
+        config.resourceLimits == false
     }
 
     def 'should create config with full map'(){
@@ -48,6 +49,7 @@ class ApptainerConfigTest extends Specification {
             ociAutoPull: false,
             pullTimeout: '50s',
             registry: 'http://registry.com',
+            resourceLimits: true,
             runOptions: '--contain --writable'
         ]
         def config = new ApptainerConfig(configMap)
@@ -61,9 +63,10 @@ class ApptainerConfigTest extends Specification {
         config.libraryDir == 'libraryDir'
         config.noHttps == false
         config.ociAutoPull == false
+        config.pullTimeout.toMillis() == 50_000 // 50s
         config.registry == 'http://registry.com'
+        config.resourceLimits == true
         config.runOptions == '--contain --writable'
-        config.pullTimeout.toMillis() == 50_000 // 50s
 
     }
 }
diff --git a/modules/nextflow/src/test/groovy/nextflow/container/SingularityBuilderTest.groovy b/modules/nextflow/src/test/groovy/nextflow/container/SingularityBuilderTest.groovy
@@ -19,6 +19,7 @@ package nextflow.container
 import java.nio.file.Paths
 
 import nextflow.SysEnv
+import nextflow.util.MemoryUnit
 import spock.lang.Specification
 import spock.lang.Unroll
 
@@ -221,6 +222,25 @@ class SingularityBuilderTest extends Specification {
         cmd == 'set +u; env - PATH="$PATH" ${TMP:+SINGULARITYENV_TMP="$TMP"} ${TMPDIR:+SINGULARITYENV_TMPDIR="$TMPDIR"} singularity exec --no-home --pid -B "$NXF_TASK_WORKDIR" ubuntu.img /bin/sh -c "cd \\"$NXF_TASK_WORKDIR\\"; bwa --this --that file.fastq"'
     }
 
+    def 'should emit resource limits when enabled' () {
+        expect:
+        new SingularityBuilder('busybox')
+                .setCpus(2)
+                .setMemory(new MemoryUnit('100M'))
+                .build()
+                .runCommand == 'set +u; env - PATH="$PATH" ${TMP:+SINGULARITYENV_TMP="$TMP"} ${TMPDIR:+SINGULARITYENV_TMPDIR="$TMPDIR"} singularity exec --no-home --pid -B "$NXF_TASK_WORKDIR" busybox'
+
+        new SingularityBuilder('busybox', new SingularityConfig(resourceLimits: true))
+                .setCpus(2)
+                .setMemory(new MemoryUnit('100M'))
+                .build()
+                .runCommand == 'set +u; env - PATH="$PATH" ${TMP:+SINGULARITYENV_TMP="$TMP"} ${TMPDIR:+SINGULARITYENV_TMPDIR="$TMPDIR"} singularity exec --no-home --pid --cpus 2 --memory 100m -B "$NXF_TASK_WORKDIR" busybox'
+
+        new SingularityBuilder('busybox', new SingularityConfig(resourceLimits: true))
+                .build()
+                .runCommand == 'set +u; env - PATH="$PATH" ${TMP:+SINGULARITYENV_TMP="$TMP"} ${TMPDIR:+SINGULARITYENV_TMPDIR="$TMPDIR"} singularity exec --no-home --pid -B "$NXF_TASK_WORKDIR" busybox'
+    }
+
     @Unroll
     def 'test singularity env'() {
 
diff --git a/modules/nextflow/src/test/groovy/nextflow/container/SingularityConfigTest.groovy b/modules/nextflow/src/test/groovy/nextflow/container/SingularityConfigTest.groovy
@@ -33,6 +33,7 @@ class SingularityConfigTest extends Specification {
         expect:
         config.envWhitelist == []
         config.pullTimeout.toMillis() == 20 * 60 * 1000 //20 min
+        config.resourceLimits == false
     }
 
     def 'should create config with full map'(){
@@ -48,6 +49,7 @@ class SingularityConfigTest extends Specification {
             ociAutoPull: false,
             pullTimeout: '50s',
             registry: 'http://registry.com',
+            resourceLimits: true,
             runOptions: '--contain --writable'
         ]
         def config = new SingularityConfig(configMap)
@@ -62,6 +64,7 @@ class SingularityConfigTest extends Specification {
         config.noHttps == false
         config.ociAutoPull == false
         config.registry == 'http://registry.com'
+        config.resourceLimits == true
         config.runOptions == '--contain --writable'
         config.pullTimeout.toMillis() == 50_000 // 50s
 
diff --git a/modules/nf-commons/src/main/nextflow/plugin/DevPluginManager.groovy b/modules/nf-commons/src/main/nextflow/plugin/DevPluginManager.groovy
@@ -18,6 +18,7 @@ package nextflow.plugin
 
 import java.nio.file.Path
 import java.nio.file.Paths
+import java.util.jar.Manifest
 
 import groovy.transform.CompileStatic
 import groovy.util.logging.Slf4j
@@ -52,7 +53,7 @@ class DevPluginManager extends CustomPluginManager {
 
     @Override
     protected PluginDescriptorFinder createPluginDescriptorFinder() {
-        return new ManifestPluginDescriptorFinder()
+        return new DevManifestFinder()
     }
 
     @Override
@@ -85,23 +86,52 @@ class DevPluginManager extends CustomPluginManager {
         return repo
     }
 
+    private static final Collection<String> CLASSES_DIRS = new DevPluginClasspath().getClassesDirectories()
+
     /**
-     * Accept only the plugin directories that have been built, that is those holding
-     * a manifest in one of the dev classpath directories.
+     * Resolve the built plugin manifest that actually carries a {@code Plugin-Id}, looking only in the
+     * dev classpath directories (derived from {@link DevPluginClasspath}) and in their fixed order.
      *
-     * The manifest locations are derived from {@link DevPluginClasspath} so they stay
-     * in sync with the directories used by the dev plugin class loader.
+     * This is deterministic on purpose: a built plugin dir can hold more than one {@code MANIFEST.MF}
+     * (e.g. a stray {@code build/tmp/jar/MANIFEST.MF} with no {@code Plugin-Id}), and pf4j's default
+     * recursive lookup picks an arbitrary one depending on filesystem listing order - which
+     * intermittently throws "Field 'id' cannot be empty". Returns null if none is found.
+     */
+    private static File builtManifest(File pluginDir) {
+        for( String dir : CLASSES_DIRS ) {
+            final f = new File(pluginDir, "$dir/META-INF/MANIFEST.MF")
+            if( f.isFile() && f.withInputStream { new Manifest(it).mainAttributes.getValue('Plugin-Id') } )
+                return f
+        }
+        return null
+    }
+
+    /**
+     * Accept only the plugin directories that have been built, that is those holding
+     * a valid (Plugin-Id bearing) manifest in one of the dev classpath directories.
      */
     @CompileStatic
     private static class BuiltPluginFilter implements FileFilter {
-
-        private static final Collection<String> CLASSES_DIRS = new DevPluginClasspath().getClassesDirectories()
-
         @Override
         boolean accept(File file) {
             if( !file.isDirectory() || file.isHidden() )
                 return false
-            return CLASSES_DIRS.any { new File(file, "$it/META-INF/MANIFEST.MF").isFile() }
+            return builtManifest(file) != null
+        }
+    }
+
+    /**
+     * Read the plugin manifest from the deterministic dev-build location instead of pf4j's
+     * default recursive first-match search over the whole plugin dir.
+     */
+    @CompileStatic
+    private static class DevManifestFinder extends ManifestPluginDescriptorFinder {
+        @Override
+        protected Manifest readManifestFromDirectory(Path pluginPath) {
+            final file = builtManifest(pluginPath.toFile())
+            if( !file )
+                return super.readManifestFromDirectory(pluginPath)
+            return file.withInputStream { new Manifest(it) } as Manifest
         }
     }
 

Original file line number	Diff line number	Diff line change
`@@ -48,6 +48,8 @@ class ApptainerBuilder extends SingularityBuilder {`
`48`	`48`	`if( config.engineOptions )`
`49`	`49`	`this.addEngineOptions(config.engineOptions)`
`50`	`50`
	`51`	`+ this.resourceLimits = config.resourceLimits`
	`52`	`+`
`51`	`53`	`if( config.runOptions )`
`52`	`54`	`this.addRunOptions(config.runOptions)`
`53`	`55`	`}`
Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,7 @@ class ApptainerConfigTest extends Specification {`
`33`	`33`	`expect:`
`34`	`34`	`config.envWhitelist == []`
`35`	`35`	`config.pullTimeout.toMillis() == 20 * 60 * 1000 //20 min`
	`36`	`+ config.resourceLimits == false`
`36`	`37`	`}`
`37`	`38`
`38`	`39`	`def 'should create config with full map'(){`
`@@ -48,6 +49,7 @@ class ApptainerConfigTest extends Specification {`
`48`	`49`	`ociAutoPull: false,`
`49`	`50`	`pullTimeout: '50s',`
`50`	`51`	`registry: 'http://registry.com',`
	`52`	`+ resourceLimits: true,`
`51`	`53`	`runOptions: '--contain --writable'`
`52`	`54`	`]`
`53`	`55`	`def config = new ApptainerConfig(configMap)`
`@@ -61,9 +63,10 @@ class ApptainerConfigTest extends Specification {`
`61`	`63`	`config.libraryDir == 'libraryDir'`
`62`	`64`	`config.noHttps == false`
`63`	`65`	`config.ociAutoPull == false`
	`66`	`+ config.pullTimeout.toMillis() == 50_000 // 50s`
`64`	`67`	`config.registry == 'http://registry.com'`
	`68`	`+ config.resourceLimits == true`
`65`	`69`	`config.runOptions == '--contain --writable'`
`66`		`- config.pullTimeout.toMillis() == 50_000 // 50s`
`67`	`70`
`68`	`71`	`}`
`69`	`72`	`}`