Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Containers v0.0.1

macoscontainers.org

Post reply on HN
Print view View original

101–110 of 374 posts

Re: macOS Containers v0.0.1

#101

Post by slonopotamus »

znpy wrote: post #43
robertlagrant wrote: post #9

Earlier quoted context omitted.

The transitively linked docs have some answers: rund is an experimental containerd shim for running macOS containers on macOS. rund doesn’t offer the usual level of container isolation that is achievable on other OSes due to limited macOS kernel API. What rund provides: - Filesystem isolation via chroot(2) - Cleanup of container processes using process group - OCI Runtime Specification compatibility (to the extent it…

So essentially a chroot with a bit of make-up and a lot of marketing? Except for bind mounts (not even overlayfs...) there isn't much interesting. > - Host-network mode only Yeah expect a lot of things to break in subtle ways... most containers are developed kinda expecting you have your own network namespace (and that no one else is using ports)

Original author here.

> So essentially a chroot with a bit of make-up

Well.

1. It is not trivial to properly set up a chroot on macOS. If you try to find a working guide/tool that works with modern macOS, I doubt you'll find anything (at least, I failed, even though tried very hard) 2. I believe that ability to package stuff into a Docker image distributable via already existing infrastructure and compatible with already existing tools maybe "a bit of make-up", but it is an important makeup. 3. Kubernetes recently got HostProcesses for Windows: https://kubernetes.io/blog/2022/12/13/windows-host-process-c.... They are even less isolated from host than chroot and still, people find them useful for certain scenarios.

> and a lot of marketing?

Thanks for "a lot of marketing", that made me chuckle. My own submission got buried yesterday with humble 8 points: https://news.ycombinator.com/item?id=37640688

Re: macOS Containers v0.0.1

#102

Post by lloeki »

hhh wrote: post #96
slonopotamus wrote: post #81

Earlier quoted context omitted.

Original author here. Thanks for spotting the typo, fixed. WRT security implications of disabling SIP - I don't think OS becomes any less vulnerable than usual Linux/Windows installation.

Docker Desktop doesn’t require me to disable SIP. Why would I use this if it requires that?

To containerize darwin binaries?

This is not an alternative to remotely connecting to a VM to control Linux containers (which DfM is)

Re: macOS Containers v0.0.1

#103

Post by prmoustache »

Klonoar wrote: post #42
perryizgr8 wrote: post #15

Earlier quoted context omitted.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

So I take it you don't use Apple Pay or anything...? Edit: to be clear for the people who may not know, Apple Pay does not work with SIP disabled. ;P

Is Apple Pay that popular?

Re: macOS Containers v0.0.1

#104

Post by blablabla123 »

prmoustache wrote: post #76

caveat: this is based on rund. Extract from the readme: rund is an experimental containerd shim for running macOS containers on macOS. rund doesn’t offer the usual level of container isolation that is achievable on other OSes due to limited macOS kernel API. What rund provides: Filesystem isolation via chroot(2) Cleanup of container processes using process group OCI Runtime Specification compatibility (to the extent…

I wonder if something comparable can be achieved with ptrace. I've tried to experiment with that but the API seems a bit unclear to say the least

Re: macOS Containers v0.0.1

#105

Post by lloeki »

sacnoradhq wrote: post #48
highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

> Disable System Identity [sic] Protection. Aaand, it's stillborn. Not happening.

Hopefully if Darwin containers take off and produce an ecosystem of containers this could pressure Apple to implement process namespacing in Darwin in a SIP compatible way.

Re: macOS Containers v0.0.1

#106

Post by sofixa »

anonymoushn wrote: post #79
hamandcheese wrote: post #68

Earlier quoted context omitted.

I wonder what people mean when they say "Homebrew is pretty great", I do not wonder what they mean when they say "Homebrew".

For example people do not use homebrew to install python3 on a fresh install of mac os and get a python that spews a bunch of messages to stderr about the version of libc6.so and cannot speak TLS.

It only upgrades PostgreSQL 3 major versions up alongside without asking.

Re: macOS Containers v0.0.1

#107

Post by slonopotamus »

ayewo wrote: post #99
slonopotamus wrote: post #81

Earlier quoted context omitted.

Original author here. Thanks for spotting the typo, fixed. WRT security implications of disabling SIP - I don't think OS becomes any less vulnerable than usual Linux/Windows installation.

If you really want good adoption, you’ll have to figure out a way for devs to try it out without first having to disable SIP. Is this related to the code you tried to have merged here: https://github.com/containerd/containerd/pull/8789 ?

Nope, that PR was an attempt to upstream my changes: https://github.com/macOScontainers/containerd/commits/macos

Vanilla containerd cannot mount anything on macos.

> If you really want good adoption, you’ll have to figure out a way for devs to try it out without first having to disable SIP.

I can't stress enough how I also would like it to work with SIP enabled!

Re: macOS Containers v0.0.1

#108

Post by figmert »

It's sad to see so many negative comments for this. I get it's not an ideal place to start for macOS containers, but it's a start. Apple isn't doing it, so the community has to. Once you have a start, you can iterate on it. It might not be great now, but hopefully this makes it possible in a year or so. Who knows, maybe this is the kick Apple needs, and maybe they'll hire the devs of this project to fully work on this.

Re: macOS Containers v0.0.1

#109

Post by prmoustache »

lopkeny12ko wrote: post #36
cassianoleal wrote: post #20

Earlier quoted context omitted.

You're free to disable SIP, so your post makes no sense. It's more akin to locking your front door. Keep it locked if you want the extra protection but feel free to crank the door open if you want the breeze to come in, but knowing that more than the breeze might do so.

Have you ever tried modifying the filesystem a couple levels under /? Last I used a Mac I remember trying to create a new directory in / and writing to /bin (or something like that). I was appalled that Mac doesn't let you do anything other than read-only operations for select paths a few levels under root, and as I remember, there way no way to disable this asinine behavior.

OTOH it is the same for an "immutable" linux distro.

Re: macOS Containers v0.0.1

#110

Post by jppittma »

highwaylights wrote: post #21
perryizgr8 wrote: post #15

Earlier quoted context omitted.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

This kind of makes me wonder why you'd have a Mac at all (I'm sure there are use cases). Wouldn't a Linux device, or Linux running on a Mac suit you better? For me, the security picture is one of the main features of the eco-system even if it's very restrictive - disabling SIP undermines it more or less completely.

SIP on consumer laptops/desktops is security theater. It only really makes sense on web-servers. For people for whom this is a deal breaker, can you describe a concrete scenario where SIP would actually protect you?
Post reply on HN