7.2 Container Isolation and Resource Limits

Downstream Tools run within the task boundary. Key isolation requirements include:

• Container networking is disabled by default with network none.
• Extra capabilities are dropped to avoid unnecessary privilege escalation.
• Stage inputs and task reproducibility material are mounted read-only; the analysis directory is writable for task outputs.
• CPU, memory, disk, and optional GPU requirements come from the exact Tool version’s config/summary and the host environment.
• Upstream resources are managed by the BioLine Flow and cloud platform; local container settings cannot override them.
• After a task, image cleanup is limited to images eligible under that task’s pull ledger. It does not remove pre-existing, changed-identity, shared, or in-use images, and never runs a broad prune.

Check the Tool version, resource requirements, and host runtime before execution. Stop and report a gap when the required resources or isolation cannot be provided.