Unprivileged on shared HPC

nwp-compose is designed so a user with no elevated privileges on a shared HPC node can do everything on the user path. The only root operation in the whole project is the production hosted-GUI installer (deploy/install.sh), which is an operator tool, not a user tool.

One command checks all of this

nwp-compose doctor probes every item below — versions, paths, quota, ports, prerequisites — and prints the exact override to set when something is red. Run it first on any new node.

State paths are redirectable

$HOME on a login node is often small or on slow NFS. Every state path honors an override so it can live on scratch:

Override	Redirects	Default
NWPC_VENV_DIR	the virtual environment	<repo>/.venv
XDG_CACHE_HOME	the gist/HTTP cache	~/.cache/nwp-compose
XDG_DATA_HOME	the plugin component dir	~/.local/share/nwp-compose
CYLC_RUN_DIR	Cylc run directories	~/cylc-run

export NWPC_VENV_DIR=/scratch/$USER/nwpc/venv
export XDG_CACHE_HOME=/scratch/$USER/.cache
export CYLC_RUN_DIR=/scratch/$USER/cylc-run

A read-only or full filesystem degrades gracefully — a cache that cannot be written is a skipped optimization, not a crash.

The local GUI is loopback-only

nwp-compose gui serves a read-only view of your ~/cylc-run/ on 127.0.0.1 only, with five GET-only endpoints and path-traversal protection. On a shared node where the default port is taken, it retries on an ephemeral port and announces the chosen one. Reach it from your laptop with an SSH tunnel — no inbound ports, no service.

Containers: rootless only

The CLI and local GUI need no container at all — that is the simplest path and the one to prefer. Where containers are needed (the CI harness, or a future containerized runtime):

• Apptainer / Singularity is the NCAR HPC standard and runs rootless by default. It is the documented alternative to the Docker Compose harness — no daemon, no root, runs on Derecho.
• Rootless Podman is a near-term drop-in where user namespaces are enabled (/proc/sys/user/max_user_namespaces > 0).

No Docker daemon on the user path

Nothing a user runs assumes a docker daemon. The Compose harness that does is a maintainer CI tool; the rootless recipes above are the unprivileged equivalents.

Scheduling is user-space

• Cylc’s own scheduler is user-space. Once cylc play is running, the cycling workflow is the recurrence engine — this is the primary answer.
• To wrap or kick automation, use a user crontab (crontab -e), never a system unit. No systemd --user is assumed (it is unavailable on nodes without XDG_RUNTIME_DIR/lingering).

Next

• Installation — the overrides in context.
• The last mile: run & doctor — the preflight that checks all of this.
• Modernization roadmap — the rootless-container and lockfile work.