Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Containers v0.0.1

macoscontainers.org

Post reply on HN
Print view View original

11–20 of 374 posts

Re: macOS Containers v0.0.1

#11

Post by plextoria »

AceJohnny2 wrote: post #6

How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…

> Does XNU have such namespacing functionality across all its interfaces?

I don't think so, but some Docker features could be implemented using XNU sandboxing AFAIK

> Furthermore, the existing container ecosystem assumes a Linux syscall interface. [1]. Does macOS provide that? I expect not.

This project is about running macOS containers on macOS. It's not about running Linux containers.

Re: macOS Containers v0.0.1

#15

Post by perryizgr8 »

highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

> "Disable System Identity Protection."

This is the first thing I do on any Mac OS system before I start using it.

Re: macOS Containers v0.0.1

#16

Post by highwaylights »

AceJohnny2 wrote: post #6

How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…

This introduces a long-standing problem that is really the main issue I have with Docker/Podman/containers on anything other than Linux - you have a dedicated VM that needs memory to be set aside for it exclusively.

This is fine if you have a 32/64GB machine, but less so on an 8GB non-upgradeable laptop.

I get it - memory is relatively cheap these days - and manufacturers that are building memory-limited devices are really only doing it to fleece you on obscene upgrade fees at the time of purchase - but it would be nice if there was a more elegant solution to this on Windows and macOS.

WSL 1 had a solution to this that clearly took a lot of work to put together, wherein they'd have a Linux kernel running side-by-side as a Windows sub-process so that the memory pool was shared. Unfortunately it might have been too much work as they scrapped it entirely for WSL 2 and just used essentially the same VM route.

If anyone knows of any projects trying to work around that problem I'd love to hear about it. If Apple really wanted to bring the development community back on board, focusing on these kind of use cases would be great, sadly it seems someone over there has taken the view that scrapping butterfly keys and the touchbar is "enough".

Say what you will about Microsoft, but they've focused really hard on developer use cases for decades, and it shows.

Re: macOS Containers v0.0.1

#17

Post by dwattttt »

AceJohnny2 wrote: post #6

How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…

> Furthermore, the existing container ecosystem assumes a Linux syscall interface. [1]. Does macOS provide that? I expect not.

There is more to the container ecosystem than Linux containers; Windows native containers function much the same way (well, in two ways, with VM-backing or the traditional kernel syscall interface, but with Windows syscalls).

Re: macOS Containers v0.0.1

#18

Post by przems »

perryizgr8 wrote: post #15
highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

Could you elaborate why? I’m new to macOS, I’d love to learn more about it.

Re: macOS Containers v0.0.1

#19

Post by highwaylights »

dddnzzz334 wrote: post #12
highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

[flagged]

I opt-in to a prison with trade-offs I deem reasonable for what I get out of it. I have a couple of Linux devices too.

Being interested in this project and simultaneously disappointed it requires SIP to be disabled are not conflicting views, even if a little unfortunate for me personally.

Re: macOS Containers v0.0.1

#20

Post by cassianoleal »

dddnzzz334 wrote: post #12
highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

[flagged]

You're free to disable SIP, so your post makes no sense.

It's more akin to locking your front door. Keep it locked if you want the extra protection but feel free to crank the door open if you want the breeze to come in, but knowing that more than the breeze might do so.

Post reply on HN