Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Containers v0.0.1

macoscontainers.org

Post reply on HN
Print view View original

181–190 of 374 posts

Re: macOS Containers v0.0.1

#181

Post by slonopotamus »

lloeki wrote: post #124
plextoria wrote: post #11

Earlier quoted context omitted.

> Does XNU have such namespacing functionality across all its interfaces? I don't think so, but some Docker features could be implemented using XNU sandboxing AFAIK > Furthermore, the existing container ecosystem assumes a Linux syscall interface. [1]. Does macOS provide that? I expect not. This project is about running macOS containers on macOS. It's not about running Linux containers.

> > Does XNU have such namespacing functionality across all its interfaces? > I don't think so, but some Docker features could be implemented using XNU sandboxing AFAIK Theoretically, probably, for coarse-grained yes/no things? I don't think it's able to go much further than "you can use the local network and/or internet" and "you can read/write to the filesystem location corresponding to you bundle identifier `com.f…

> Also not sure if it can be dynamically set by a parent process for a child?

Yes, it can. See sandbox-exec tool. And I actually plan to use it: https://github.com/macOScontainers/rund/issues/15

Re: macOS Containers v0.0.1

#182

Post by fodkodrasz »

lloeki wrote: post #102
hhh wrote: post #96

Earlier quoted context omitted.

Docker Desktop doesn’t require me to disable SIP. Why would I use this if it requires that?

To containerize darwin binaries? This is not an alternative to remotely connecting to a VM to control Linux containers (which DfM is)

And what is the benefit of that? Who would use that and for what? Containers solved deployment, and software distribution problems related to diversity of runtime environments on linux. It also has some security benefits, but their adoption was successful because it solved real world everyday problems. It eventually allowed better utilization of servers.

They did not have such success on windows, despite Windows also having a container subsystem, as windows servers already did this with IIS web app containerization.

On MacOS desktop software distribution is largely a solved problem since ages. On MacOS/Darwin servers... are there such in industrial use apart from some research installations?

Re: macOS Containers v0.0.1

#184

Post by deskamess »

highwaylights wrote: post #16
AceJohnny2 wrote: post #6

How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…

This introduces a long-standing problem that is really the main issue I have with Docker/Podman/containers on anything other than Linux - you have a dedicated VM that needs memory to be set aside for it exclusively. This is fine if you have a 32/64GB machine, but less so on an 8GB non-upgradeable laptop. I get it - memory is relatively cheap these days - and manufacturers that are building memory-limited devices are…

One of my issues too. The tools/ecosystem are Linux driven and doing anything on Windows requires a Linux 'stub' of some sort (VM, WSL, etc). I am comfortable with both OS's but all of my coworkers are Microsoft OS tied. 0% Linux experience. Cannot really introduce a managed kub/docker/containers into the picture without ending up being 'support' - not happening! The cloud is an option but that still leaves the developer experience (local laptop) short changed.

Edit: It has been a while since I last looked at this. Looks like containerd is, perhaps, a native option

Re: macOS Containers v0.0.1

#185

Post by shortrounddev2 »

madeofpalk wrote: post #98
highwaylights wrote: post #16

Earlier quoted context omitted.

This introduces a long-standing problem that is really the main issue I have with Docker/Podman/containers on anything other than Linux - you have a dedicated VM that needs memory to be set aside for it exclusively. This is fine if you have a 32/64GB machine, but less so on an 8GB non-upgradeable laptop. I get it - memory is relatively cheap these days - and manufacturers that are building memory-limited devices are…

WSL 2 now allows for memory reclaim from the VM, essentially fixing this autoMemoryReclaim – Makes the WSL VM shrink in memory as you use it by reclaiming cached memory https://devblogs.microsoft.com/commandline/windows-subsystem...

I think someone told me that the relies on a feature of the CPU itself and MS is the only OS vendor to actually implement it

Re: macOS Containers v0.0.1

#186

Post by thathndude »

rafaelmn wrote: post #30
highwaylights wrote: post #21

Earlier quoted context omitted.

This kind of makes me wonder why you'd have a Mac at all (I'm sure there are use cases). Wouldn't a Linux device, or Linux running on a Mac suit you better? For me, the security picture is one of the main features of the eco-system even if it's very restrictive - disabling SIP undermines it more or less completely.

>Wouldn't a Linux device, or Linux running on a Mac suit you better? Maybe they want a unixy desktop with working sound ? Half joking, but that's my use case - homebrew is pretty great, most developers use a Mac in my domains of interest so it's always supported. Linux is just too much work (and I'm using Fedora on my desktop). SIP is just false positives and annoyance. I'm on the fence about M/ARM switch since I sti…

This is a fair point. For folks who want a “just works” Unix system, disabling SIP probably makes sense. But most it’s still very niche.

Is there a way to make a separate partition of MacOS and have one copy with SIP and one without?

Re: macOS Containers v0.0.1

#188

Post by nightfader »

rafaelmn wrote: post #131
hamandcheese wrote: post #47

Earlier quoted context omitted.

> homebrew is pretty great I hear this said a lot in passing, and I'm really curious what people mean when they say this.

I can use it to get stuff I need to do work and I don't remember the last time I couldn't. Upgrades sometimes leave me broken but it's usually ironed out fast because everyone is using it. If my dependencies are that locked down I'm using docker and special environments anyway. Linux can get tedious with upgrades breaking or dependency mismatches. Homebrew is probably the largest homogenous community - if you're doin…

Homebrew is available for Linux as well since approx 3yrs now. I've been using it without issues https://docs.brew.sh/Homebrew-on-Linux

Re: macOS Containers v0.0.1

#189

Post by worthless-trash »

rebolek wrote: post #90
devsda wrote: post #45

Earlier quoted context omitted.

> Maybe they want a unixy desktop with working sound ? In my experience, this has not been an issue for the past 10-15 years atleast. Before that there were some problems with few (external) soundcards or random cpu spikes with the mixers. However, the UX can still improve. Switching audio outputs with multiple outputs like external displays etc is not very smooth or intuitive. Some bluetooth headsets have issues but…

I'm running Linux everyday and I really wouldn't recommend it for any serious audio stuff. There is great audio software coming to Linux (Bitwig, Reaper, etc) which is great but the underlying infrastructure is a mess. There are like 3-4 audio subsystems running, I never know which one is it, setting latency is wizardry and sometimes it doesn't run at all. It's usually fine when I run stuff like Spotify, VLC, or Yout…

It sounds like your specifically fighting your distros problem, or something that its not your understanding.

I would not consider Linux sound Terrible, but to be fair, I only use it every day for regular development tasks for the last 10 years. Maybe I've become accustomed to whatever problem you see that I don't.

Re: macOS Containers v0.0.1

#190

Post by licebmi__at__ »

hamandcheese wrote: post #47
rafaelmn wrote: post #30

Earlier quoted context omitted.

>Wouldn't a Linux device, or Linux running on a Mac suit you better? Maybe they want a unixy desktop with working sound ? Half joking, but that's my use case - homebrew is pretty great, most developers use a Mac in my domains of interest so it's always supported. Linux is just too much work (and I'm using Fedora on my desktop). SIP is just false positives and annoyance. I'm on the fence about M/ARM switch since I sti…

> homebrew is pretty great I hear this said a lot in passing, and I'm really curious what people mean when they say this.

The experience is really seamless, mostly it just works… which IMO is nothing special as they mostly support installing the latest and maybe a couple of other versions, and software that requires weird stuff will likely be packaged in a self contained way.
Post reply on HN