Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Container Machines

github.com

Post reply on HN
Print view View original

351–360 of 457 posts

Re: macOS Container Machines

#351

Post by kdrag0n »

rahen wrote: post #290
kdrag0n wrote: post #26

Earlier quoted context omitted.

(OrbStack dev here.) Instead of Virtualization.framework, we have a custom Rust virtualization stack with custom devices and protocols for things like filesystem sharing. It's a highly optimized vertically integrated stack specifically for running our Linux machines and containers. Our biggest perf/resource gain is dynamic memory, which reduces memory usage a lot by releasing unused memory back to macOS. Nothing else…

What kind of virtualization do you use internally? I assume some kind of LXD fork? OrbStack really feels like a single-node Incus host.

The Linux VM host and guest components are all custom, as well as the daemon that manages machines. It currently uses LXC as the runtime but that's being replaced as well. For containers we run a standard Docker engine inside a special machine.

Re: macOS Container Machines

#352

Post by qalmakka »

larodi wrote: post #303
qalmakka wrote: post #245

Earlier quoted context omitted.

macOS sandboxing is deliberately limited just enough to prevent anyone from truly implement Darwin-on-Darwin containers. People have been discussing about this for a while, see https://github.com/apple/container/discussions/611 In general I understand the rationale behind Apple's decision. They sell hardware, and there's real demand for macOS on servers to run build jobs and other Mac-only tools. Giving you the abili…

and how is this, having containers run hardware one owns, a bad or even shameful idea, given people do it and want to do it with their hardware all the time?

> aving containers run hardware one owns, a bad or even shameful idea

what? it isn't, it's absolutely a right you surely have. The problem is that

a. Apple forces people to buy Macs to build, notarise and deploy iOS and macOS apps b. Apple refuses to implement jails which is something that every OS, including Windows, has nowadays c. Apple only allows you to have 2 VMs - full, fat, with GUI - on each Mac computer, running at once c. Jails/Containers would allow you to easily deploy multiple jobs, which would allow you to have N jobs in parallel, which would mean you'd need way less Mac Studios/Mini in your local CI

Re: macOS Container Machines

#353

Post by lxgr »

jdub wrote: post #307
lxgr wrote: post #275

Earlier quoted context omitted.

This applies to both containers and container machines though, right?

Containers (those popularised on Linux by Docker) are built on Linux primitives like cgroups and namespaces, so they're running directly on the same kernel, same VFS, often the same FS, etc. Their isolation properties rely on (a) all those Linux features working as expected, and (b) the container runtime setting them up properly. Depending on your threat model, that's fine, but a lot of people (including me) will say…

The surface of an OS is definitely larger than that of many hypervisors, which is e.g. why browsers often provide their own much narrower sandbox.

On the other hand, in other scenarios, people trust the security boundaries of their working as expected all the time, no? This is the basis of e.g. Android app isolation (every app runs under its own Linux UID/GID), and true multi-user Unix systems trusting the OS's security boundaries to hold have decades of history.

Re: macOS Container Machines

#354

Post by cromka »

regexorcist wrote: post #341
QuiEgo wrote: post #337

Earlier quoted context omitted.

The issue with Linux isn’t the software, it’s the hardware. Apple Silicon Macs are still the nicest laptop hardware by a huge margin. All the Linux-native options are, at best, “okay”.

Agreed, the Linux laptop story is pretty dire compared to Apple hardware. My travel laptop is an M1 with Asahi.

Same here but after 4 months with Asahi on M1 I wouldn't trust it fully. Had 3 freezes/reboots so far and WiFi often hangs on resume to the point I need to rmmod/modprobe.

Re: macOS Container Machines

#355

Post by cromka »

neop1x wrote: post #296
cromka wrote: post #181

So essentially both macOS and Windows now heavily support developing using Linux on them. They can't more openly admit that they are no match for Linux in that area. There's some clever advertising in it for Linux, if Linux was advertising.

A lot of devs needs to use linux but they still use it just as a VM (Mac) or in some kind emulation (WSL). How pathetic.

If they need to, it's because it's their work computers. Otherwise it's a choice.

Re: macOS Container Machines

#356

Post by gempir »

kdrag0n wrote: post #347
gempir wrote: post #217

Earlier quoted context omitted.

I just wish bind mounts would be more performant/native. I get that this is probably impossible, and probably also sucks on Linux, haven't tried. But like having containers that need file watchers like vite dev server, or frankenphp in watch mode will overload OrbStack real quick since It seems to fallback to polling instead of listening to fs events. So I'm stuck running vite dev servers and the like on the host.

Can you share more details? OrbStack has always supported inotify/fanotify (Linux fs watching APIs) on bind mounts and most people use watchers with no issues. Happy to look into whatever you're running into: danny@orbstack.dev

I'll remember it and email you when I try it again.

Last time I tried all of orbstack froze and I had to restart my whole mac to fix it. But you also did some recent releases that fix issues related to freezing up, so maybe it was unrelated.

Thanks for the great software! Happy enterprise customer

Re: macOS Container Machines

#357

Post by cromka »

krzyk wrote: post #313
artistonn wrote: post #299

Earlier quoted context omitted.

Linux also can't openly admit that it's no match for macOS/Windows on the desktop, which is why we have this hybrid situation - macOS/Windows desktops running Linux VMs

Unfortunately there are more and more users on Linux and as a result windowsization/macosization of Linux is in progress (systemd, wayland, some scary stuff Poettering is doing with boot, snap/flatpack).

How is that a problem? Both systemd and Wayland helped tremendously in unifying Linux for desktop use, which together with Flatpak enable more 3rd party software to get official support. Yes it adds complexity but it's all still developed in an open fashion and you get very good insight into how things work. With Windows and macOS you have no clue what's happening in the background, or very little.

Re: macOS Container Machines

#358

Post by kdrag0n »

rubnogueira wrote: post #274
kdrag0n wrote: post #26

Earlier quoted context omitted.

(OrbStack dev here.) Instead of Virtualization.framework, we have a custom Rust virtualization stack with custom devices and protocols for things like filesystem sharing. It's a highly optimized vertically integrated stack specifically for running our Linux machines and containers. Our biggest perf/resource gain is dynamic memory, which reduces memory usage a lot by releasing unused memory back to macOS. Nothing else…

Just to give a thumbs up to you and OrbStack. I've been using it every day since the first releases, and it is one of the most stable and performant drop-in replacements that I've seen.

love to hear it!

Re: macOS Container Machines

#359

Post by krzyk »

cromka wrote: post #357
krzyk wrote: post #313

Earlier quoted context omitted.

Unfortunately there are more and more users on Linux and as a result windowsization/macosization of Linux is in progress (systemd, wayland, some scary stuff Poettering is doing with boot, snap/flatpack).

How is that a problem? Both systemd and Wayland helped tremendously in unifying Linux for desktop use, which together with Flatpak enable more 3rd party software to get official support. Yes it adds complexity but it's all still developed in an open fashion and you get very good insight into how things work. With Windows and macOS you have no clue what's happening in the background, or very little.

It is done in the open, but it adds complexity and it removes that made Unix/Linux great - composability, variety and replaces it with corporate introduced "stuff". And any distro is forced to support those additions because corps owning Fedora, Redhat, Ubuntu just rule the Linux world, and event Debian gives up.

As long as there are just few "normies" using Linux, it is safe from corporations adding their "security", "safety" etc.

Re: macOS Container Machines

#360

Post by TimTheTinker »

CarlitosHighway wrote: post #287
TimTheTinker wrote: post #51

Earlier quoted context omitted.

OrbStack is great also

until they remove the free tier and raise prices, once their user base is sufficiently reliant on it.

I had no idea they have a free tier. I've been paying for a couple of years and it's been so worth it.
Post reply on HN