Enabling soft links for Dockerized jobs

[pmalshe]

• Cromwell does not support soft links for dockerized jobs by design
• I guess that's because symlinks are a big challenge with Docker. They do not work inside Docker container unless both the directories are mounted (dir with symlink - Cromwell's tmp execution dir and original dir where input files are present), plus, mounts inside the container should have the same name/path as that of the host file system. Since Cromwell has information about original input files, they can be mounted along with the tmp execution dir (where symlinks will be created), to the Docker container
• This possesses a threat (of being modified inside a Docker container), to input files, which can be circumvented by using read only access to the input files (similar threat is also applicable to hard linked input files, in case of current behavior)
• Also given the nature of hard-links, they can be completely eliminated

Benefits of using symlinks over hard-links:

• Hard links can't cross file systems; soft links can
• OS user which runs Cromwell requires to have a write access to input files in order for hard-links to work, this is not a requirement for soft links
• When hard-links do not work in case of Docker jobs (when necessary conditions - write access, same device requirement, aren't satisfied), Cromwell falls back to copy option, which takes a significant performance hit as the input files could be huge

[cpavanrun]

With the new caching heuristic for generating File input hashes (path+modtime) relies on soft-linking for it to work correctly. Having soft-links disabled by design when containerizing a task makes this option mood.

I consider it weird that a config option has a hard-override within cromwell... leave it up to users to configure their backend.

[rhpvorderman]

With the new caching heuristic for generating File input hashes (path+modtime) relies on soft-linking for it to work correctly. Having soft-links disabled by design when containerizing a task makes this option mood.

The hash is calculated based on the original path. Not on the relocalized path. So this should not be an issue.