Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Containers v0.0.1

macoscontainers.org

Post reply on HN
Print view View original

191–200 of 374 posts

Re: macOS Containers v0.0.1

#191

Post by digitalsushi »

diogenes4 wrote: post #180
cj wrote: post #173

Earlier quoted context omitted.

Help doc: https://support.apple.com/en-us/102149#:~:text=System%20Inte... . TLDR: it restricts even the root user from modifying system files. Like the ones that would otherwise be the target of malware.

I understand that of course, I'm much more curious why you think this is a concern for people, and/or why you consider this an effective protection against said unknown actors.

I want that feature on cause I dont want stuff I dont know about looking and changing stuff I dont know about, whether it's running with escalated privileges or not

Re: macOS Containers v0.0.1

#192

Post by [deleted] »

pasc1878 wrote: post #150
doctor_eval wrote: post #44

Earlier quoted context omitted.

I say this as someone who has used Unix, MacOS and Linux for most of his long life: not being able to write to /bin and other system directories is a feature and I really don’t understand how anybody in 2023 could see it otherwise. Freedom does not just imply the ability to do the things you want, but also the ability to avoid the things you don’t.

Why 2023 writing to /bin was always a bad idea in 1994 when I first used Unix and would have been so even earlier.

[deleted]

Re: macOS Containers v0.0.1

#193

Post by nicexe »

da39a3ee wrote: post #95

I use MacOS and am very positive about it. I have lots of reasons to run Linux containers. What are some reasons I might want to run a MacOS container?

I would imagine it would enable you to run MacOS specific pipelines like building a project and have it work semi-portably across different machines/users.

Re: macOS Containers v0.0.1

#194

Post by slonopotamus »

fodkodrasz wrote: post #182
lloeki wrote: post #102

Earlier quoted context omitted.

To containerize darwin binaries? This is not an alternative to remotely connecting to a VM to control Linux containers (which DfM is)

And what is the benefit of that? Who would use that and for what? Containers solved deployment, and software distribution problems related to diversity of runtime environments on linux. It also has some security benefits, but their adoption was successful because it solved real world everyday problems. It eventually allowed better utilization of servers. They did not have such success on windows, despite Windows also…

> Who would use that and for what?

I believe this project can be useful for CI and testing scenarios.

> On MacOS desktop software distribution is largely a solved problem since ages

Are you talking about App Store? Or Homebrew? Or MacPorts? Or... Wait, isn't this too many tools for a problem that was solved?

Re: macOS Containers v0.0.1

#196

Post by slonopotamus »

thathndude wrote: post #186
rafaelmn wrote: post #30

Earlier quoted context omitted.

>Wouldn't a Linux device, or Linux running on a Mac suit you better? Maybe they want a unixy desktop with working sound ? Half joking, but that's my use case - homebrew is pretty great, most developers use a Mac in my domains of interest so it's always supported. Linux is just too much work (and I'm using Fedora on my desktop). SIP is just false positives and annoyance. I'm on the fence about M/ARM switch since I sti…

This is a fair point. For folks who want a “just works” Unix system, disabling SIP probably makes sense. But most it’s still very niche. Is there a way to make a separate partition of MacOS and have one copy with SIP and one without?

> But most it’s still very niche.

I'd say that the whole containerization topic is niche

> Is there a way to make a separate partition of MacOS and have one copy with SIP and one without?

I think you can install macOS VM on your macOS host and disable SIP _inside VM_.

Re: macOS Containers v0.0.1

#197

Post by smcleod »

diogenes4 wrote: post #166
smcleod wrote: post #97

Earlier quoted context omitted.

Oh wow… please do not do that folks!

Sincerely, why is this your recommendation? What does this protect against and why do you consider it a concern?

https://eclecticlight.co/2019/06/19/what-is-sip-and-when-is-...

It’s a core part of how macOS is prevents unauthorised modifications to the operating system and file system by malicious software.

Re: macOS Containers v0.0.1

#198

Post by Wowfunhappy »

hhh wrote: post #96
slonopotamus wrote: post #81

Earlier quoted context omitted.

Original author here. Thanks for spotting the typo, fixed. WRT security implications of disabling SIP - I don't think OS becomes any less vulnerable than usual Linux/Windows installation.

Docker Desktop doesn’t require me to disable SIP. Why would I use this if it requires that?

Docker Desktop runs an entire second kernel in a VM.

Re: macOS Containers v0.0.1

#199

Post by ptspts »

huijzer wrote: post #83
zuppy wrote: post #63

Earlier quoted context omitted.

depending of what you mean by friction with containers, there may be different solutins. for example, as a temporary solution on Docker when you don't want/have time to support both arm and x86, you can do something like this: FROM --platform=linux/x86_64 ubuntu:23.04 i haven't found any issues with it that i could not get over in the past 2+ years of m1. most of the containers are available on both architectures any…

> i haven't found any issues with it that i could not get over in the past 2+ years of m1. I'm currently running a Journal of Open Source Software x86 container on aarch64 and it's terribly slow. Takes 12GB of RAM and 3 minutes to build a LaTeX document, see https://github.com/openjournals/inara/issues/30 . Any tips?

Building a single-page LaTeX document as a PDF can be done in less than 0.3s when the environment is set up correctly. I don't know anything about this particular container.

Re: macOS Containers v0.0.1

#200

Post by rafaelmn »

nightfader wrote: post #188
rafaelmn wrote: post #131

Earlier quoted context omitted.

I can use it to get stuff I need to do work and I don't remember the last time I couldn't. Upgrades sometimes leave me broken but it's usually ironed out fast because everyone is using it. If my dependencies are that locked down I'm using docker and special environments anyway. Linux can get tedious with upgrades breaking or dependency mismatches. Homebrew is probably the largest homogenous community - if you're doin…

Homebrew is available for Linux as well since approx 3yrs now. I've been using it without issues https://docs.brew.sh/Homebrew-on-Linux

OK but what I like about homebrew on mac is that when I'm having an issue with "popular stack X broke after updating" it's probably me and >10k other people out there, so by the time I hit the problem it's already under investigation on GH. I'm not sure the same would apply to homebrew on Linux - even if you ignore the differences between distros - how popular is homebrew on linux and linux desktop in comparison ?
Post reply on HN