[dead]
OrbStack: The fast, light, and easy way to run Docker containers and Linux
151–160 of 161 posts
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#152Earlier quoted context omitted.
One reason I'm still using docker desktop in my (small) company is that our production systems are using docker compose and the networking with domains does not translate 1:1 between orbstack locally and docker compose + nginx in production. Is there an easy way to solve this?
OrbStack domains can be nice but you don't have to use them. It's fully compatible with Compose, so you can just run the same commands with no changes to your setup. Did that not work for you?
I don't fully remember the issues, but I think it was somehow necessary to run all apps on port 80 inside of the containers in order to make the OrbStack domains work properly.
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#153Earlier quoted context omitted.
It advertises as an alternative to Docker Desktop which is for Windows and Linux as well.
The thing Docker Desktop (and analogues like Podman Desktop, Rancher Desktop, etc.) is useful for (a) is setting up a Linux guest VM so that you can run Linux containers and (b) doing some socket forwarding magic so that when you run the `docker` CLI on the host operating system, it acts as a remote client for dockerd running on the guest. There's little point in running Docker Desktop on Linux because you don't need…
[deleted]
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#154I don't generally prefer to work on macOS, but if I wind up using macOS to do work, I often find myself working a lot on things in virtual machines and containers. Using Docker Desktop to compile Envoy using the standard Docker build process took somewhere in the ball park of 3 to 4 hours depending on my luck. OrbStack, on the other hand, brought it down to a bit under an hour, much closer to inline with a fresh comp…
Funny how WSL2 makes Windows much more usable than macOS for development. None of the free options (colima, multipass, etc) I've tried on macOS are as smooth, though OrbStack might be it. I have also moved towards using devcontainers for my projects whenever I can, so that I can spin up my environment on whatever machine I have, or connect to a remote one if the machine doesn't allow it.
The difference between darwin and macos environments really stands out with postgres stuff. Try installing WAL2json on macos postgres and you will feel my pain.
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#155Earlier quoted context omitted.
Can you make containers in Darwin?
https://darwin-containers.github.io/
Seems like it's not quite what would qualify as a container for many, but a nice effort.
> rund doesn’t offer the usual level of container isolation that is achievable on other OSes due to limited Darwin kernel API.
https://github.com/darwin-containers/rund?tab=readme-ov-file...
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#156Earlier quoted context omitted.
Can you make containers in Darwin?
Yes, the macOS way, with Virtualization Framework.
The virtualization layer breaks many "container" expectations, I wouldn't call this containers without big caveats. Same as firecracker VMs may give some of the ergonomics of containers but come with a lot of limitations.
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#157Earlier quoted context omitted.
Only because it is a Linux VM, and people insist on using Linux specific stuff instead of UNIX, to the point younger generations have no clue about the difference. Even the BSDs and Solaris/Illumos have add to add Linux translation layers. Sad state where POSIX hardly matters for portable UNIX code.
> Sad state where POSIX hardly matters for portable UNIX code. Given the current state of POSIX applications, I would actually argue that the BSD/Linux hegemony we enjoy is the best possible outcome. The only people that are mad are the people paying for UNIX and expecting to get something better for it. Those people should have learned their lesson in the 90s, I have no empathy for POSIX apologists in 2024. The only…
In what concerns headless software probably, as they hardly managed anywhere else.
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#158Earlier quoted context omitted.
What’s the security model for OrbStack and its containers? Is OrbStack rootless? Where is the security boundary for the containers? (Are they sandboxed completely from the host?) How does the virtualisation work? (I’d assume Virtualization.framework, so I can run it without Rosetta if all containers will share host architecture?) Does it support Docker-in-Docker and Docker-out-of-Docker? (M1 and M2 Mac’s don’t have h…
It's a shared VM and kernel, so the security boundary between containers is only as strong as typical Linux containers, and we don't really use the VM as a strong security boundary right now. The security model is similar to running Docker containers on a native Linux machine for development. Admin privileges aren't required on the macOS side. You can optionally allow a privileged helper for some small niceties, but…
I'm not completely sure about the use case of Docker-out-of-docker (maybe CI probably) but i guess a sibling container (a CI agent maybe) have access to docker.sock, and control other sibling containers, which i guess ( haven't tried yet) is possible with current implementation of orbstack.
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#159Nice to see this here :) I work on OrbStack. Happy to answer questions!
What’s the security model for OrbStack and its containers? Is OrbStack rootless? Where is the security boundary for the containers? (Are they sandboxed completely from the host?) How does the virtualisation work? (I’d assume Virtualization.framework, so I can run it without Rosetta if all containers will share host architecture?) Does it support Docker-in-Docker and Docker-out-of-Docker? (M1 and M2 Mac’s don’t have h…
currently using orbstack with a devcontainer project, and in that devcontainer i'm bringing up some other nested containers via `testcontainers` via golang, so it's completely possible and is running sweetly
Re: OrbStack: The fast, light, and easy way to run Docker containers and Linux
#160Earlier quoted context omitted.
What’s the security model for OrbStack and its containers? Is OrbStack rootless? Where is the security boundary for the containers? (Are they sandboxed completely from the host?) How does the virtualisation work? (I’d assume Virtualization.framework, so I can run it without Rosetta if all containers will share host architecture?) Does it support Docker-in-Docker and Docker-out-of-Docker? (M1 and M2 Mac’s don’t have h…
It's a shared VM and kernel, so the security boundary between containers is only as strong as typical Linux containers, and we don't really use the VM as a strong security boundary right now. The security model is similar to running Docker containers on a native Linux machine for development. Admin privileges aren't required on the macOS side. You can optionally allow a privileged helper for some small niceties, but…
Is there an example somewhere of how to do Docker-in-Docker with Orbstack? I have given this a try but there does not seem to be a docker.sock (or equivalent) to mount so no way to spawn containers at the “host level” from inside a container. Maybe my mental model of Orbstack is wrong here and there is no need for a mounted socket at all?