getwilds/umitools repository overview

⁠umitools

This directory contains Docker images for UMI-tools, a collection of tools for handling Unique Molecular Identifiers (UMIs) in high-throughput sequencing data.

⁠Available Versions

• latest ( Dockerfile⁠ | Vulnerability Report⁠ )
• 1.1.6 ( Dockerfile⁠ | Vulnerability Report⁠ )

⁠Image Details

These Docker images are built from Python 3.11-bookworm and include:

• UMI-tools v1.1.6: Tools for dealing with Unique Molecular Identifiers in NGS data
• Samtools v1.20: Utilities for manipulating SAM/BAM/CRAM alignment files, commonly used alongside UMI-tools for sorting, indexing, and inspecting BAMs before deduplication

The images are designed to be minimal and focused on a specific version of UMI-tools with its dependencies, optimized for handling UMIs in next-generation sequencing data analysis pipelines.

⁠Usage

⁠Docker

docker pull getwilds/umitools:latest
# or
docker pull getwilds/umitools:1.1.6

# Alternatively, pull from GitHub Container Registry
docker pull ghcr.io/getwilds/umitools:latest

⁠Singularity/Apptainer

apptainer pull docker://getwilds/umitools:latest
# or
apptainer pull docker://getwilds/umitools:1.1.6

# Alternatively, pull from GitHub Container Registry
apptainer pull docker://ghcr.io/getwilds/umitools:latest

⁠Example Commands

# Extract UMIs from FASTQ files
docker run --rm -v /path/to/data:/data getwilds/umitools:latest umi_tools extract \
  --bc-pattern=NNNNNN \
  --stdin=/data/reads.fastq.gz \
  --stdout=/data/reads.extracted.fastq.gz

# Sort and index a BAM file with samtools before deduplication
docker run --rm -v /path/to/data:/data getwilds/umitools:latest \
  bash -c "samtools sort -o /data/mapped.sorted.bam /data/mapped.bam && samtools index /data/mapped.sorted.bam"

# Deduplicate BAM files based on UMIs
docker run --rm -v /path/to/data:/data getwilds/umitools:latest umi_tools dedup \
  --stdin=/data/mapped.sorted.bam \
  --stdout=/data/deduplicated.bam

# Group reads by UMI
docker run --rm -v /path/to/data:/data getwilds/umitools:latest umi_tools group \
  --stdin=/data/mapped.sorted.bam \
  --stdout=/data/grouped.tsv \
  --output-bam \
  --paired

# Alternatively using Apptainer
apptainer run --bind /path/to/data:/data docker://getwilds/umitools:latest umi_tools extract \
  --bc-pattern=NNNNNN \
  --stdin=/data/reads.fastq.gz \
  --stdout=/data/reads.extracted.fastq.gz

# ... or a local SIF file via Apptainer
apptainer run --bind /path/to/data:/data umitools_latest.sif umi_tools dedup \
  --stdin=/data/mapped.bam \
  --stdout=/data/deduplicated.bam

⁠Security Features

The UMI-tools Docker images include:

• Multi-stage build that keeps compilers and dev headers out of the final image
• Python 3.11 slim from Debian Bookworm for a minimal base
• Installation via pip with no-cache-dir to minimize image size
• Pinned versions for reproducibility

⁠Security Scanning and CVEs

These images are regularly scanned for vulnerabilities using Docker Scout. However, due to the nature of bioinformatics software and their dependencies, some Docker images may contain components with known vulnerabilities (CVEs).

Use at your own risk: While we strive to minimize security issues, these images are primarily designed for research and analytical workflows in controlled environments.

For the latest security information about this image, please check the CVEs_*.md files in this directory, which are automatically updated through our GitHub Actions workflow. If a particular vulnerability is of concern, please file an issue⁠ in the GitHub repo citing which CVE you would like to be addressed.

⁠Dockerfile Structure

The Dockerfile uses a multi-stage build to keep the final image minimal:

1. Build stage: Uses Python 3.11-bookworm with build tools and dev headers to compile Samtools v1.20 from source and install UMI-tools with a specific version via pip
2. Final stage: Uses a fresh Python 3.11-slim-bookworm base with only the runtime libraries needed by Samtools
3. Adds metadata labels for documentation and attribution
4. Dynamically determines and pins the latest security-patched versions of dependencies in both stages
5. Copies the compiled Samtools binary and the installed UMI-tools packages from the build stage
6. Runs a smoke test verifying both umi_tools and samtools are functional

This approach keeps compilers and development headers out of the final image, reducing its size and attack surface.

⁠Source Repository

These Dockerfiles are maintained in the WILDS Docker Library⁠ repository.