Process writes to host home directory which is mounted in the container

Hi, within the epitopeprediction pipeline, the tool mhcflurry tries to create a folder within the HOME directory to store some downloaded data:

• With the Docker profile on Mac this causes a permission denied error, because mhcflurry tries to create the folder /.local(I am not sure, why in this case it does not use the home directory, @apeltzer mentioned it could be a Mac specific problem). In the past, for some pipelines the same problem was addressed by uncommenting the docker.runOptions = '-u \$(id -u):\$(id -g)' line in the nextflow.config (https://github.com/nf-core/tools/pull/351, https://github.com/nf-core/mhcquant/pull/104). By this, the commands will be executed as root again, preventing this particular permission denied error, but maybe also giving raise to other errors again (https://github.com/nf-core/tools/pull/351). (Another solution for this particular problem is https://github.com/nf-core/epitopeprediction/pull/52)

• With Singularity the folder .local is created in the actual host HOME directory, and everything seems smooth on the first view.

However, the fact that the host HOME directory is included into the container, allowing tools to actually write to and read from it, potentially unnoticed, is from a reproducibility perspective not ideal and should probably be avoided.

See also a longer discussion by @lkuchenb, @drpatelh, @pontus and @pditommaso about this topic on the slack help channel.

Start with the Docker profile and the docker.runOptions setting in nextflow.config, then compare its behavior with Singularity and the linked epitopeprediction solution. Done means containerized tools cannot unexpectedly read from or write to the host HOME directory while the affected pipeline still runs reproducibly.