Wave containers

Wave is Seqera's container provisioning service that enables on-demand container image management for Nextflow pipelines. Wave can provision containers dynamically during pipeline execution, removing the need to manually build and upload images to a container registry.

Deployment options

Wave can be integrated with Seqera Platform in two ways:

• Seqera Wave service: Use the hosted Wave service at https://wave.seqera.io (default for Seqera Cloud)
• Self-hosted Wave: Deploy Wave in your own infrastructure for full control over container builds and caching

Requirements

Network connectivity

Source	Destination	Purpose
Seqera Platform	Wave server	API communication
Wave server	Container registry	Container image reads and writes
Compute environments	Wave server	Container image access during pipeline execution

If you use the Seqera-hosted Wave service and your firewall rules are IP-based, see firewall configuration for the addresses to allow in each direction. Wave reaching your registry uses the egress addresses. Your installation reaching Wave uses the ingress addresses.

Container registry credentials

Container registry credentials must be configured in the Seqera UI to authenticate with your private or public registries. See container registry credentials for provider-specific instructions.

Configuration

Connect to Wave service

Configure Seqera Platform to use the Seqera-hosted Wave service or your self-hosted Wave deployment:

Variable	Description
TOWER_ENABLE_WAVE	Set to true to enable Wave integration
WAVE_SERVER_URL	Wave server endpoint (default: https://wave.seqera.io)

Verify connectivity

Test connectivity to your Wave server:

curl https://wave.seqera.io/service-info

Replace wave.seqera.io with your self-hosted Wave endpoint if applicable.

Features enabled by Wave

After Wave is enabled, the following features become available:

• Private container registries: Access containers from private repositories using credentials stored in Seqera
• Fusion file system: High-performance cloud-native file system for pipeline execution
• Container augmentation: Dynamically extend existing containers with additional layers
• Conda-based containers: Provision containers from Conda or Bioconda packages on demand
• Singularity support: Build and provision Singularity/Apptainer format containers
• Security scanning: Automatic vulnerability scanning of built container images

Wave features are available on the compute environment creation page after integration is configured.

Registries behind a private endpoint

Wave is a registry proxy. It reads and writes your container images from Seqera's network, not from yours. The Seqera-hosted Wave service cannot reach a registry that is exposed only through a private endpoint inside your own network, such as an Azure Container Registry (ACR) with public network access disabled. The connection fails at name resolution, before Wave evaluates your registry credentials, and valid credentials do not change the outcome. This applies to every Wave mode, including mirror and freeze, which write to your registry. On Azure, the Allow trusted Microsoft services setting does not grant Wave access.

You have three options:

• Allow Wave's addresses on the registry firewall. If your security policy allows opening a hole in the firewall, keep the registry's public endpoint enabled and restrict it to the egress addresses published at meta.seqera.io: see firewall configuration. On Azure, registry network rules require the Premium ACR service tier.
• Self-host Wave inside your own network. The registry stays fully private. See Self-hosted Wave deployment. Wave Lite runs on any conformant Kubernetes distribution, so on Azure it is the only available option: it provides container augmentation, inspection, and private registry authentication. Wave Lite does not provide on-demand builds, freeze, mirroring, or security scanning: those features require the full Wave configuration, which runs on Amazon EKS only.
• Keep the registry fully private and do not use the hosted Wave service.

If Wave hangs without an error when it reaches your registry, see Wave cannot reach your container registry.

Limitations

• The Seqera-hosted Wave service at https://wave.seqera.io cannot pull from container repositories secured by a private Certificate Authority (CA), because you cannot modify its trust store. A self-hosted Wave deployment can pull from these repositories after you add your CA certificate to the trust store in the Wave container. See Configure Seqera to trust your private certificate.
• The Seqera-hosted Wave service cannot reach a container registry that is exposed only through a private endpoint inside your network. See Registries behind a private endpoint.

Self-hosted Wave deployment

For enterprises requiring full control over container builds, caching, and security scanning, Wave can be deployed in your own infrastructure.

Self-hosted Wave supports:

• Wave Lite: Container augmentation, inspection, and private registry authentication. Wave Lite has no AWS dependency and runs on any conformant Kubernetes distribution, or on a single Docker host with Docker Compose.
• Full Wave: Everything in Wave Lite, plus on-demand container builds, freeze, mirroring, and security scanning. Requires an Amazon EKS installation using EFS for the shared build workspace.

See the Wave documentation for installation and configuration guidance.

Additional resources

• Wave documentation
• Nextflow Wave integration
• Seqera Containers - Free community container registry