NeuroDesk Portable: Containerized NeuroImaging across platforms with no installation.
Poster No:
1848
Submission Type:
Abstract Submission
Authors:
Joshua Scarsbrook1, Erin Goddard2, Aswin Narayanan3, Thuy Dao1, Steffen Bollmann4
Institutions:
1University of Queensland, Brisbane, Queensland, 2University of New South Wales, Sydney, New South Wales, 3Australian National Imaging Facility, Brisbane, Queensland, 4The University of Queensland, Brisbane, Queensland
First Author:
Co-Author(s):
Introduction:
Neurodesk has made a significant difference in the accessibility of neuroimaging research by providing access to more than 100 tools and pipelines on any operating system. NeuroDesktop provides a full Linux desktop interface integrated with a Jupyterlab system to make a complete NeuroDesk workstation just a docker/podman run away. However, docker and podman both require elevated privileges for installation limiting accessibility for some users. In this work, we developed a solution for removing the dependency on docker/podman and expanding NeuroDesk to more environments and users.
Methods:
Docker is a sandboxing solution for running Linux applications in a self-contained environment with minimal overhead by leveraging namespaces in the Linux kernel. These namespaces allow splitting one Linux kernel into multiple virtual kernels with independent filesystem and network configurations and a private process tree.
An inherent limitation is that the Docker engine will only run on the Linux kernel. We currently use Docker Desktop Linux, a commercial solution for running a virtual machine containing the Docker engine or Podman, an open-source solution. Both Docker and Podman require system administrator permissions to install, making it impractical for a subset of our users desiring to use NeuroDesk on their computers.
An inherent limitation is that the Docker engine will only run on the Linux kernel. We currently use Docker Desktop Linux, a commercial solution for running a virtual machine containing the Docker engine or Podman, an open-source solution. Both Docker and Podman require system administrator permissions to install, making it impractical for a subset of our users desiring to use NeuroDesk on their computers.
Results:
Portable NeuroDesk solves this by bringing its own virtual machine, which can directly run Docker containers across Windows, macOS, and Linux. In addition, this software runs without administrative privileges and does not require installation.
How is this possible? Portable NeuroDesk uses Qemu under the hood (https://github.com/tinyrange/tinyrange), which removes the need for an installed background service and utilizes user-space networking. Networking is the most problematic gap to overcome for unprivileged containers and virtual machines. The main issue is Layer 2 traffic because virtual machines and containers expect to send low-level networking traffic, which requires administrator privileges on Windows, macOS, and Linux. User-mode networking is a valuable tradeoff that translates Layer 2 traffic into ordinary TCP sockets that can be created with ordinary privileges. The main downside is lower performance, making it unsuitable for high-performance computing but sufficient for users running on local systems. We show this in Figure 2.
Another barrier to running in an unprivileged environment is hardware acceleration. Virtual machines rely on hardware acceleration to reach native CPU performance. This hardware is commonplace on modern CPUs, and Windows, macOS, and Linux all provide APIs to make it accessible to software. All three platforms support running accelerated virtual machines without administrator privileges, with macOS supporting it without additional configuration, Windows supporting it with the "Windows Hypervisor Platform" feature added to Windows, and Linux makes it accessible depending on the distribution with system administrators being able to enable it in all instances.
How is this possible? Portable NeuroDesk uses Qemu under the hood (https://github.com/tinyrange/tinyrange), which removes the need for an installed background service and utilizes user-space networking. Networking is the most problematic gap to overcome for unprivileged containers and virtual machines. The main issue is Layer 2 traffic because virtual machines and containers expect to send low-level networking traffic, which requires administrator privileges on Windows, macOS, and Linux. User-mode networking is a valuable tradeoff that translates Layer 2 traffic into ordinary TCP sockets that can be created with ordinary privileges. The main downside is lower performance, making it unsuitable for high-performance computing but sufficient for users running on local systems. We show this in Figure 2.
Another barrier to running in an unprivileged environment is hardware acceleration. Virtual machines rely on hardware acceleration to reach native CPU performance. This hardware is commonplace on modern CPUs, and Windows, macOS, and Linux all provide APIs to make it accessible to software. All three platforms support running accelerated virtual machines without administrator privileges, with macOS supporting it without additional configuration, Windows supporting it with the "Windows Hypervisor Platform" feature added to Windows, and Linux makes it accessible depending on the distribution with system administrators being able to enable it in all instances.
·TinyRange Architecture Diagram
Conclusions:
Portable NeuroDesk runs across Windows, macOS, and Linux systems (Figure 1), including lower hardware specifications that run on as little as 16GB of RAM. Portable NeuroDesk is documented and released publicly to make neuroimaging research and tools more accessible.
·Screenshot of NeuroDesktop running in TinyRange
Modeling and Analysis Methods:
Methods Development
Neuroinformatics and Data Sharing:
Workflows 1
Informatics Other 2
Keywords:
Computational Neuroscience
Computing
Data analysis
Data Organization
Design and Analysis
Open Data
Open-Source Code
Open-Source Software
Workflows
1|2Indicates the priority used for review
Abstract Information
By submitting your proposal, you grant permission for the Organization for Human Brain Mapping (OHBM) to distribute your work in any format, including video, audio print and electronic text through OHBM OnDemand, social media channels, the OHBM website, or other electronic publications and media.
The Open Science Special Interest Group (OSSIG) is introducing a reproducibility challenge for OHBM 2025. This new initiative aims to enhance the reproducibility of scientific results and foster collaborations between labs. Teams will consist of a “source” party and a “reproducing” party, and will be evaluated on the success of their replication, the openness of the source work, and additional deliverables. Click here for more information. Propose your OHBM abstract(s) as source work for future OHBM meetings by selecting one of the following options:
Please indicate below if your study was a "resting state" or "task-activation” study.
Healthy subjects only or patients (note that patient studies may also involve healthy subjects):
Was this research conducted in the United States?
Were any human subjects research approved by the relevant Institutional Review Board or ethics panel? NOTE: Any human subjects studies without IRB approval will be automatically rejected.
Were any animal research approved by the relevant IACUC or other animal research panel? NOTE: Any animal studies without IACUC approval will be automatically rejected.
Please indicate which methods were used in your research:
For human MRI, what field strength scanner do you use?
Which processing packages did you use for your study?
Provide references using APA citation style.
Merkel, D. (2014). Docker: Lightweight Linux containers for consistent development and deployment. Linux Journal, 2014(239), 2.