Apptainer / Singularity (SIF)

What it does

The Apptainer / Singularity (SIF) card scans images in the Singularity Image Format, the single-file images that Apptainer and SingularityCE run. Each image you select becomes a project. Every scan downloads the SIF, records its sha256, checks every signature in it (PGP, and x509 or PEM keys in DSSE envelopes), and builds the SBOM and the vulnerability findings of its root filesystem. Nothing in the image is run, mounted or unpacked: the scanner reads the squashfs root filesystem in place. Find the card under Integrations on the Project/Product tab.

It reads from two kinds of source:

• A library (library://): a Library API service, such as Singularity Enterprise or another Apptainer-compatible library. The Sylabs Cloud Library (cloud.sylabs.io) closes on 2026-10-22; Apptainer itself has no default library.
• An OCI registry holding SIF artifacts (oras://): images pushed with apptainer push image.sif oras://<registry>/<repository>:<tag>, in any registry that accepts OCI artifacts (GitHub Container Registry, Harbor, zot and others).

Images Apptainer runs from docker:// are ordinary OCI images. Connect their container registry instead (Docker Hub, GitHub Container Registry, Harbor and the others); it scans the same image. For SIF files on an HPC host or a shared file system, run safeguard sif scan there.

Public vs private

Supported auth methods

Permissions required

Safeguard only reads. It never pushes, deletes, signs or changes an image, tag or collection.

Library access token

Least privilege: create the token for a dedicated user that can read only the collections you want scanned. Library tokens carry the user's own access; there are no narrower scopes.

Registry token (ORAS)

Least privilege: a robot or service account with pull access to the SIF repositories only (for example a GitHub token with read:packages, or a Harbor robot account with pull permission).

Token types

Expiry: library tokens and registry tokens expire on the schedule the service sets. Rotate them before they expire, for example every 90 days. An expired token makes validation and scans fail with an authentication error.

What we never need: push or delete rights, a signing key, root on any host, or docker:// registry credentials (the registry integrations cover those).

Step-by-step setup

Create the credential in the library or registry

1. For a library: sign in to its web interface, open Access Tokens, and create a token for a user that can read the collections to scan.
2. For an ORAS registry: create a robot or service account with pull access to the SIF repositories, and a token for it.
3. To check a token before connecting: apptainer remote login (library) or apptainer registry login oras://<registry> (registry), then apptainer pull one image.

Or with the Safeguard CLI on the host

safeguard sif inspect image.sif                       # header, objects, architecture, definition file, labels
safeguard sif verify image.sif --key signer.asc       # PGP public key or PEM public key
safeguard sif verify image.sif --certificate leaf.pem --certificate-roots ca.pem
safeguard sif scan image.sif                          # SBOM, vulnerabilities, sha256 and signature status
safeguard scan image.sif                              # the same scan, from the scan command
SG_LIBRARY_TOKEN=... safeguard sif scan library://library.example.com/team/tools/app:1.2
SG_REGISTRY_PASSWORD=... safeguard sif scan oras://ghcr.io/acme/app:1.2 --registry-username bot

verify exits 0 when every object is verified, 2 when a signature or signed object is invalid, and 3 when the image is unsigned or not fully verified. Results stay on the machine. See CLI usage.

Connect it in Safeguard

1. Open Integrations and choose the Project/Product tab.
2. Click Connect on the Apptainer / Singularity (SIF) card.
3. Enter a Name, then choose the Source: Library or OCI registry, and the Access: Public or Private.
4. Enter the Library URL (such as https://library.example.com) or the Registry host (such as ghcr.io).
5. Under Images, add one image per line: entity/collection/container[:tag] for a library, repository/name[:tag] for a registry. For a library you can also add Entities or collections to list.
6. For Private, enter the Library access token, or the Registry username and Registry token or password.
7. Click Verify access, then Next, pick the images and tags to scan, and finish.

Webhooks and triggers

Libraries and registries send Safeguard no events for SIF images. Images are scanned when you connect them, on the schedule you set under Integrations > Scheduled, or when you rescan by hand.

What we read and store

• Read: for a library, /version, /v1/entities/<entity>, /v1/collections/<entity>/<collection>, /v1/tags/<container>, /v1/images/<container>:<tag> and the image file (from the library's OCI registry through /v1/oci-redirect, or /v1/imagefile); for a registry, /v2/_catalog, /v2/<repository>/tags/list, the manifest and the SIF layer (application/vnd.sylabs.sif.layer.v1.sif).
• Checked: the downloaded file against the hash the library names (sha256.<hex>), or the layer against the digest its manifest names. A mismatch fails the scan.
• Stored: the SBOM, the findings, the SIF's sha256 and the signature status of each scan. The token is encrypted at rest and never shown again after you save it.
• Not stored: the SIF file is deleted with the scan's working folder when the scan ends.
• No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Rotation and disconnect

• Rotate: create the new token, open the connection's edit dialog, enter it, click Verify access and save. Then revoke the old token in the library or registry.
• Disconnect: delete the connection under Integrations, then revoke the token. Nothing else was created on your side.

Limits

• Only the primary system partition (the root filesystem) is scanned. Overlay and data partitions are listed by safeguard sif inspect but not scanned. Encrypted SIFs cannot be scanned.
• Hosted scans check signatures against the public keys your workspace trusts; without them a signed image shows as signed but not verified. Legacy signatures (Singularity before 3.6) are checked only by the CLI with --legacy-insecure.
• When a DSSE signature fails with the keys you gave, Safeguard cannot tell a different key from an altered signature, so it reports the signature as not verifiable rather than invalid.
• The Library API returns whole lists, so listings are complete. A registry is listed in full only with catalog access.
• The signature status is recorded with each scan; showing it on the project page is rolling out.

Vendor references

• Apptainer: Signing and verifying containers, checked 2026-10-16.
• Apptainer: Library API registries, checked 2026-10-16.
• Apptainer: Remote endpoints, checked 2026-10-16.
• SingularityCE: Remote endpoints (Singularity Enterprise and compatible services), checked 2026-10-16.
• sylabs/sif (format and integrity package), checked 2026-10-16.
• sylabs/scs-library-client (Library API client), checked 2026-10-16.
• Apptainer ORAS client (SIF media types), checked 2026-10-16.