Resources to create and use a Docker Image and an Apptainer containing the LANDIS-II model and its extensions, for use on almost any environment, including supercomputing clusters.

Docker is an open-source platform designed for creating, deploying, and managing applications using what are called "containers".

Containers can be seen as a kind of special file that contain an entire computer environment, including an OS (like Linux or Windows) and as many programs, packages or libraries as you want to install in it.

Docker containers are created, managed and run on your computer using the Docker Engine (which you have to install), and can be interacted with easily. But when run, what's happening in the container is separated from what goes on in the rest of your computer. However, you can make some files from your computer available in the container (like LANDIS-II scenario files), as we'll see later in this readme.

Using a Docker container to run LANDIS-II has many advantages :

• It's easy to install (see below; one program to install in your computer + one command in a terminal)
• You will be able to run LANDIS-II on any platform (Mac OS, Windows, Linux, etc.) with no compatibility issue.
  • The only exception is for High Performance Computing (HPC) environment, like supercomputing clusters. In that case, use Apptainer (see below)
• Your LANDIS-II simulations will be highly replicable, since they will not depend on the environment of your own work computer (e.g. R and Python packages you have, etc.); but only on what you define in the Dockerfile (the file that will generate your Docker container)
• You can easily deploy different LANDIS-II environments (sets of extensions + R or Python packages) on your computer without having conflicts or problems between them.
• You ensure that LANDIS-II will always have the right dependencies to function.

To learn more about Docker, you can check one of the many videos explaining the concept.

Apptainer (formerly called "Singularity") is a program that creates "containers" similar to Docker. These containers contain an entire operating system (OS) like Ubuntu, along with every program or dependencies you might want to install in it. As for Docker containers, and Apptainer can still edit and modify files that are "outside" of the Apptainer if they are made available inside of the Apptainer through a special command. See below for more.

The differences between Docker containers and Apptainer are very technical; for example, Docker has a "layering" system that allows different Docker containers running on the same machine to use the same files that they share with each other. But the only thing that will certainly matter to you as a LANDIS-II user is that Apptainers are made to be run on a High Performance Computing environment, where the security standards are much greater, and where Docker containers are often forbidden from use for different reasons.

The biggest advantage of Apptainers is that just like Docker Containers, they will ensure that LANDIS-II always have all of the necessary dependencies to run anywhere, especially on supercomputing clusters. This is crucial, as supercomputing clusters tend to restrain the programs/modules/packages/dependencies one can load inside your session. This can create hair-pulling scenarios where any update of the global environment in the clusters breaks your LANDIS-II installation, as it cannot access the right dependencies anymore.

💡 While Docker containers are often forbiden on High Performance Computing environments, they are generaly safe to use on your computer. They can be used, like almost any program, to hurt your computer; especially if they contain older version of packages or programs that contain known vulnerabilities, and if they are run in ways that make them accessible to attakers. In case of doubt, use Docker Scout to analyze a container before running a container. You can find more information about the security of Docker Containers here. While several vulnerabilities exist in the Docker containers that you can create with this repository, they should not cause problems to your computer as long as you run the containers for LANDIS-II simulations and with LANDIS-II scenario files that you trust.

We provide several "flavours" of images, contributed by users with different use cases and needs. Simply select an image that best suits your needs - you can use "as is" or simply as a starting point for further customizations.

💡 If you want to use LANDIS-II on a HPC environment (e.g. supercomputing clusters), then you can simply download one of the Apptainer files available in the Releases section of this repository and follow the instruction below to run it with the right command. However, we recommend that you familiarize yourself with the rest of the instructions to learn how to edit and customize them for your own research purposes.

New to Docker? Start here: download and use a pre-built image — no build step required (see Get a pre-built image below).

v7 vs v8?

• Use v8 unless you have a specific reason not to — it is the current recommended version.
• Use v7 if your scenario is not yet compatible with v8, or if you need extensions not available in v8 (e.g., BFOLDS Fire, DGS Succession, Biomass Browse). See the UCL bug warning at the top of this page for v8 caveats.

landis-ii-v8-release vs landis-ii-v8-uclv2-release?

• landis-ii-v8-release includes the full set of v8-compatible extensions. Some extensions have a known bug in the Universal Cohort Library (UCL) — see the warning at the top of this page.
• landis-ii-v8-uclv2-release includes extensions updated for UCL v2, which fixes that bug. Some extensions are still pending update and are not yet included in this image.

These images provide a minimal LANDIS-II installation, including GDAL, plus a Python installation.

💡 The Clean_Docker_* images hardcode the extensions and their specific commits directly in the Dockerfile, whereas the others refer to a .yaml file (e.g., extensions-v8-release.yaml) to define the versions used. When customizing multiple images, it is easier to use these shared sets of extensions, especially when important updates (like bug fixes) are made to the extensions and images need to be updated and rebuilt.

LANDIS-II v7 images

LANDIS-II v8 images

These images are based on the generic images and add R and/or a running RStudio Server instance.

LANDIS-II v8 images

LANDIS-II v8 images

Pre-built images are publicly available on the GitHub Container Registry and do not require authentication to download.

## replace <imagename> with one from the tables above (e.g., landis-ii-v8-release)
docker pull ghcr.io/landis-ii-foundation/<imagename>:ubuntu-latest

💡 Image tags: All images provide the following tags:

• :ubuntu-latest — most recent Ubuntu LTS build (recommended)
• :latest — alias for :ubuntu-latest
• :main — alias for :ubuntu-latest, kept for backwards compatibility
• :ubuntu-<version> — pinned to a specific Ubuntu version (e.g. :ubuntu-24.04, :ubuntu-26.04); useful for reproducibility or if a newer OS version introduces unexpected behaviour

💡 You can also skip the docker pull step entirely: if you use an image name in a docker run command and the image is not already on your computer, Docker will download it automatically.

If you need to access a private image, you must authenticate with GitHub first.

1. Set up a personal access token following these instructions;

2. Log in with Docker:

   export GHCR_PAT=YOUR_TOKEN
   echo $GHCR_PAT | docker login ghcr.io -u USERNAME --password-stdin

💡 A Docker image is simply a "template" to initialize a Docker container. You can initialize and run many Docker Containers from one Docker image. Imagine that the Docker image is a blueprint for a house or a "demo" house, while Docker containers are houses where people actually live. You first need to make the Docker image before creating a Docker container.

• Download Docker Desktop on your computer. You can also install Docker through a command prompt if you are on Linux.

  • On Windows, Docker Desktop will ask you by default to be integrated with what is called "WSL", the Windows Subsystem for Linux. The WSL can be seen as a "Linux emulator" for Windows, and it can help for a lot of things. It's recommended that you use the WSL integration; however, you might need to enable the WSL before starting Docker Desktop, or you'll get an error at launch. To enable the WSL, simply open a Powershell command prompt and use wsl --install as a command. Then restart your computer.

• Launch Docker Desktop. This will start the Docker Engine on your computer.

• Download the entire contents of this repository (several files needed to build are shared among multiple images);

• Open a terminal on your computer (e.g., a Powershell command prompt if you're on Windows) and change your working directory to that of your local copy of this repository.

• Select an image flavour to build / use, and follow the specific build instructions found in the README.md in that flavour's subdirectory.

  💡 Generally, the build command will look like the following:

  docker build <directory> -f <path/to/Dockerfile> -t <my_image_name>

  • <directory> specifies the Docker 'build context', which determines the set of local files the bulid process has access to. If <directory> is specified as the root directory of the repository, then shared files or directories (e.g., extension_files/, scripts/, and any *.yaml files can be passed to the build process. Whereas, if <directory> is specified as one of the repository subdirectories (e.g., Clean_Docker_LANDIS-II_8_AllExtensions), then the build will only use the files contained in that subdirectory.
  • <path/to/Dockerfile> specifies the relative path to the Dockerfile used to build the image. A Dockerfile is simply a text file, so you can view it with any text editor. It contains a set of Linux commands to set up the container environment (e.g., install software dependencies) and download the code to build and run LANDIS-II.
  • <my_image_name> is simply a name to give to your image (e.g., landis-ii or whatever works best for you).

HTTP request sent, awaiting response... 429 Too Many Requests`

The Docker images we have created contain the minimal set of the components necessary to run LANDIS-II in the container, and cover several important use cases (but not all!). If the images provided don't meet all of your needs, feel free to customize with additional components as needed for your study. Everything you put in your Docker image can be made available to other research groups looking to replicate, improve or update your methodology if you share the Dockerfile you used to create it. As such, we recommend that you take full advantage of it. The sky is the limit!

1. Make a copy of one of the 'flavour' subdirectories and give it a custom name;
2. Edit the Dockerfile with any text editor to add additional build steps using the Docker RUN command (see the Dockerfile syntax documentation);

💡 Example: install additonal Python packages

Add the following build step to your Dockerfile:

RUN pip install numpy rasterio pandas

3. Edit the README.md file to update the docker build command for your image, by editing the paths used for build context and/or the Dockerfile, and the name of your image;
4. Build your image;
5. (Optional) Push your newly build image to a container registry to share with others (e.g., Docker Hub or GitHub);

💡 You can also share the Dockerfile you created (and any additional files needed to build the image), rather than needing to share the built image. The Dockerfile is very light as it is only a text file, and can be shared in any way you like.

6. Start a container instance based on your new image following the documentation in the README.md;

There are several ways to run a Docker container:

• You can run it "interactively" via the -it argument, which will allow you to interact with your container in your command prompt. From there, you can look at the files that are inside the container, run a LANDIS-II scenario, etc.
• Or, you can run it in a non-interactive way and specify a couple of commands to execute. When the commands are done (or if they fail), the container will simply shut down. This approach is useful for running a single LANDIS-II simulation (or other workflow). Multiple isolated and independent runs can be run concurrently using this approach (depending on the computational resources available on the local host machine).

In both cases, you can create a "bind", which will allow your container to access and edit files that are on your computer, outside of the container. This is most likely what you will want to do to run a LANDIS-II simulation on your computer; the container will then be able to read the scenario files, run LANDIS-II, and create the output files in the same folder.

To run an interactive Docker container with a bind, use the following command :

docker run -it \
  --cpus=4 \
  --memory=64g \
  --mount type=bind,src="<SCENARIO_FOLDER_FULL_PATH_ON_COMPUTER>",dst=/scenarioFolder \
  --name <MY_LANDIS_CONTAINER_NAME> \
  <LANDIS_DOCKER_IMAGE_NAME>

• -it will run the container interactively
• --mount type=bind,src="<SCENARIO_FOLDER_FULL_PATH_ON_COMPUTER>",dst=/scenarioFolder will bind make the folder containing LANDIS-II scenario files on your computer available inside the container, at the path /scenarioFolder. Simply replace <SCENARIO_FOLDER_FULL_PATH_ON_COMPUTER> with the full path to the folder on your compute (for example, C:\Users\JohnDoe\LANDIS-II_Simulation).
• limit system resources available to the container by passing e.g., --memory=64g and --cpus=8;
• <MY_LANDIS_CONTAINER_NAME> is simply a name to give the container (useful to distinguish among several containers initialized from the same image);
• <LANDIS_DOCKER_IMAGE_NAME> is simply the name of the Docker image we have built earlier (for example, landis_ii).

To run a non-interactive Docker container with a bind mount, use:

docker run \
  --cpus=4 \
  --memory=64g \
  --mount type=bind,src="<SCENARIO_FOLDER_FULL_PATH_ON_COMPUTER>",dst=/scenarioFolder \
  --name <MY_LANDIS_CONTAINER_NAME> \
  <LANDIS_DOCKER_IMAGE_NAME> /bin/sh -c "<COMMAND1> && <COMMAND2>"

• Here, /bin/sh -c "<COMMAND1> && <COMMAND2> allow use to define the commands we want to run once the container is running. You can add more commands with the && symbol.

These containers are intended for interactive workflows, via Rstudio.

When launching an instance of the container:

• specify the local port to use to connect to the container by passing -p with appropriate arguments (e.g., -p 127.0.0.1:8080:8787 allows connections on local port 8080; 8787 is the port used by Rstudio on the container);
• a custom PASSWORD can be specified (if not specified, a random one will be used and displayed once at container launch);
• local directories can be mounted as above;
• USERID and GROUPID specify the user and group ids, respectively, and can be specified to ensure user file permissions of the container match those of the mounted volume (defaults: 1000) (see https://rocker-project.org/images/versioned/rstudio.html#userid-and-groupid);
• limit system resources available to the container by passing e.g., --memory=64g and --cpus=8;

## example
docker run -d -it \
  -e USERID=$(id -u) \
  -e GROUPID=$(id -g) \
  -e PASSWORD='<MySecretPassword>' \
  --cpus=4 \
  --memory=64g \
  -p 127.0.0.1:8080:8787 \
  --mount type=bind,source=/home/$(id -un)/projects/LANDIS-II,target=/home/rstudio/LANDIS-II \
  --name landis01 \
  landis-ii-rstudio:release

To access the running container's Rstudio instance:

Open your web browser and connect to localhost:8080. Log in using username rstudio and the password set above.

See also: https://rocker-project.org/images/versioned/rstudio.html#how-to-use

The Docker containers created with the Dockerfiles present in this repository will be running in an Ubuntu (Linux) environment. As such, the command to launch LANDIS-II in the container will be a bit different. To launch a LANDIS-II simulation from inside the container, you will need to change the working directory to the folder containing your scenario files, and then run :

cd path/to/scenarioFolder/
dotnet $LANDIS_CONSOLE scenario.txt

• dotnet is the Linux program that allows us to run LANDIS-II on Linux, since it's coded in C# (a programming language made by Microsoft);
• $LANDIS_CONSOLE is an environment variable that contains the location of the LANDIS-II program in the container (in /bin/LANDIS_Linux/build/Release/Landis.Console.dll);
• scenario.txt is the name of your scenario file;

As such, if you want to run LANDIS-II through an interactive container :

• Run the following command:

  docker run -it \
    --cpus=4 \
    --memory=64g \
    --mount type=bind,src="<SCENARIO_FOLDER_FULL_PATH_ON_COMPUTER>",dst=/scenarioFolder \
    --name <MY_LANDIS_CONTAINER_NAME> \
    <LANDIS_DOCKER_IMAGE_NAME>

• In the interactive mode, use cd to change your working directory to go into /scenarioFolder (or where you can access your scenario files through the bind)

• Once you are in the right folder, run dotnet $LANDIS_CONSOLE scenario.txt, and the scenario should run.

If you want to run the LANDIS-II scenario in an non-interactive container (useful to automatize your simulations), here is the full command :

docker run \
--cpus=4 \
  --memory=64g \
  --mount type=bind,src="<SCENARIO_FOLDER_FULL_PATH_ON_COMPUTER>",dst=/scenarioFolder \
  --name <MY_LANDIS_CONTAINER_NAME> \
  <LANDIS_DOCKER_IMAGE_NAME> /bin/sh -c "cd /scenarioFolder && dotnet $LANDIS_CONSOLE scenario.txt"

Simply make sure that the command cd /scenarioFolder goes where your scenario.txt file is located. If it's in a subfolder, change it to cd /scenarioFolder/subFolder.

On HPC clusters, Docker is usually forbidden and you use Apptainer (formerly Singularity) instead. Apptainer runs a single .sif file, which you can either download pre-built or build yourself from any of our Docker images.

Pre-built .sif files for the simulation images are attached to our Releases. Download the one you need — e.g. directly on the cluster with wget/curl — and follow the run instructions below. No build step required.

These .sif files are built automatically from the published Docker images, so they stay in sync with each release.

Because the Docker images are published to the GitHub Container Registry, Apptainer can build a .sif directly from the registry — there is no need to docker save to a .tar first:

## replace <imagename> with one from the tables above (e.g. landis-ii-v8-release)
apptainer build <imagename>.sif docker://ghcr.io/landis-ii-foundation/<imagename>:ubuntu-latest

Apptainer only runs on Linux, so:

• On Linux — including the WSL Ubuntu that ships with Docker Desktop (run wsl -d Ubuntu in a PowerShell terminal) — install Apptainer and run the command above.

• On Windows without WSL — run the build inside a container that already includes Apptainer, so you don't have to install anything extra. In PowerShell, from the folder where you want the .sif saved (the --mount line makes that folder /work inside the container):

  docker run --rm --privileged `
    --mount type=bind,src="${PWD}",dst=/work `
    kaczmarj/apptainer:latest `
    build /work/<imagename>.sif docker://ghcr.io/landis-ii-foundation/<imagename>:ubuntu-latest

💡 The slim v8 images build into small .sif files (a few hundred MB) on a normal laptop. If a build runs out of RAM — or you simply want to avoid building — use the pre-built .sif from the Releases (Option 1).

To use the Apptainer on a HPC environment :

• Upload your LANDIS-II scenario files and your .sif Apptainer file on your HPC environment.

• In the terminal you use to interact with your HPC environment, load the package apptainer (which should be available).

• Go to where your .sif files are located, and use the following command:

  apptainer exec -C -B <FULL_PATH_TO_FOLDER_WITH_SCENARIO_FILE> <NAME OF YOUR APPTAINER FILE>.sif /bin/sh -c "cd <FULL_PATH_TO_FOLDER_WITH_SCENARIO_FILE> && dotnet \$LANDIS_CONSOLE scenario.txt"

As you can see, the command is very similar to the one used with Docker:

• apptainer calls the apptainer package, which knows how to use your .sif file;
• exec tells the apptainer package that we are going to run commands inside the Apptainer;
• -C tells apptainer remove all of the folder binding that gets done automatically by Apptainer. It will only bind the folders to the Apptainer that we tell him to. The folder binding is essential: it's the process through which your Apptainer will become able to access files from outside the Apptainer file.
• -B <FULL_PATH_TO_FOLDER_WITH_SCENARIO_FILE> binds the folder containing your scenario files. Replace <FULL_PATH_TO_FOLDER_WITH_SCENARIO_FILE> with the full, absolute path to your scenario folder on your HPC environment (e.g. /home/Klemet/LANDIS-II_Simulations/Simulation1). These files will become accessible inside the Apptainer at the same path.
• <NAME OF YOUR APPTAINER FILE>.sif is simply the name of the Apptainer file.
• /bin/sh -c "... && ..." is used to give several commands at once to do inside the Apptainer. These two commands (cd and donet) are described just below.
• cd <FULL_PATH_TO_FOLDER_WITH_SCENARIO_FILE> is a the first command we launch while inside the Apptainer: we simply use it to go inside the folder containing your LANDIS-II scenario files, which are accessible inside the Apptainer thanks to -B <FULL_PATH_TO_FOLDER_WITH_SCENARIO_FILE> that we used before, which "binded" them inside it.
• dotnet \$LANDIS_CONSOLE scenario.txt is the final command we launch to launch the simulation. ⚠ Important : You have to escape the $LANDIS_CONSOLE variable with a \ character before it; this is because the variable is inside the apptainer. But if you don't escape it, the shell will try to take it from outside the apptainer (from the Linux installation from which you're launching the command), which will not work.

• I'm encountering an error when compiling the Docker image where it says that it fails to download from GitHub (something like error unexpected disconnect while reading sideband packet). What should I do ?

You're most likely using Windows; this error seems to be due to an outdated SSH library that deal with the encryption of connections. See here for more information. It seems like it can be solved by downloading the latest beta version of the SSH library of Microsoft, by using the following command in a Powershell prompt :

 winget install Microsoft.OpenSSH.Beta

• I'm encountering an error when compiling the Docker image at the beginning of the process, where commands like apt update and apt upgrade are used. What should I do ?

Most likely, this error is due the fact that the command returned an interactive prompt (e.g., Do you want to continue? [Y/n]Abort). Because Docker cannot answer this prompt, the command is aborted and returns an error. Simply change the command to something like apt-get update -y in your Dockerfile; the -y flag will confirm the prompt automatically for you.

• I've got another error that is not indicated here ?

Please head to the LANDIS-II users group if you have questions or issues !