Apptainer (formerly Singularity) is a production-grade container runtime specifically engineered for high-performance computing (HPC) environments. Unlike general-purpose container platforms, Apptainer prioritizes security, performance, and integration with HPC infrastructure. It allows users to build, run, and manage containers without root privileges, leveraging a unique setuid starter binary for safe privilege escalation. The system supports multiple image formats, with a primary focus on its own SIF (Singularity Image Format) for integrity and cryptographic verification, alongside full OCI/Docker compatibility. The architecture is a hybrid monolith with a plugin system. The core is written in Go, with a critical C component for privileged operations. It features a custom CLI framework, multiple runtime engines (native, OCI, fakeroot), and extensive client libraries for pulling images from various sources (Docker Hub, ORAS, Library, SHUB, IPFS). Key differentiators include deep GPU support (NVIDIA, AMD ROCM, Intel HPU), cgroups integration for resource management, filesystem overlays/underlays for unprivileged mounts, and a comprehensive security model involving PGP/DSSE signatures, execution control lists (ECL), and seccomp profiles. The codebase demonstrates high craftsmanship in its utility packages (cgroups manager, mount point management, keyring handling, CLI flag framework) and its testing infrastructure. However, it carries significant technical debt from its Singularity origins, including deprecated flags, a custom build system (makeit), and a large surface area of vendored dependencies. It is actively maintained by a dedicated community and the Linux Foundation, making it a reliable choice for HPC containerization.