Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Containers v0.0.1

macoscontainers.org

Post reply on HN
Print view View original

21–30 of 374 posts

Re: macOS Containers v0.0.1

#21

Post by highwaylights »

perryizgr8 wrote: post #15
highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

This kind of makes me wonder why you'd have a Mac at all (I'm sure there are use cases).

Wouldn't a Linux device, or Linux running on a Mac suit you better?

For me, the security picture is one of the main features of the eco-system even if it's very restrictive - disabling SIP undermines it more or less completely.

Re: macOS Containers v0.0.1

#22

Post by jraph »

highwaylights wrote: post #21
perryizgr8 wrote: post #15

Earlier quoted context omitted.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

This kind of makes me wonder why you'd have a Mac at all (I'm sure there are use cases). Wouldn't a Linux device, or Linux running on a Mac suit you better? For me, the security picture is one of the main features of the eco-system even if it's very restrictive - disabling SIP undermines it more or less completely.

I would think most people choose macOS over Linux for the familiarity with the UI/UX and software availability (Adobe and MS stuff).

I would expect a very small number people making this choice over security concerns.

Re: macOS Containers v0.0.1

#23

Post by highwaylights »

Hnrobert42 wrote: post #14
xcdzvyn wrote: post #2

TIL SIP blocks chroot. I wonder why?

I imagine because if an adversary can a chroot environment, then they can trick anything using that chroot to use different binaries.

I have these thoughts about Homebrew also.

macOS apps have to be signed and notarised to run without a warning, which is a pretty big part of the defence picture for this software - the certificates can be revoked at any time to block the software if malicious behaviour is identified.

However, if I install Homebrew, then install python, then install a pip package, there's really no kind of scanning/notarization/checking happening at all. I wonder if this is something Apple has ever looked into - it seems like the exact scenario where you'd want to sandbox it away from the rest of the system.

Re: macOS Containers v0.0.1

#24

Post by irjustin »

dddnzzz334 wrote: post #12
highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

[flagged]

FWIW, i like the security without thinking. Yes, I give up freedoms but I gain a lot in lack of cognitive load.

Re: macOS Containers v0.0.1

#25

Post by themoonisachees »

highwaylights wrote: post #16
AceJohnny2 wrote: post #6

How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…

This introduces a long-standing problem that is really the main issue I have with Docker/Podman/containers on anything other than Linux - you have a dedicated VM that needs memory to be set aside for it exclusively. This is fine if you have a 32/64GB machine, but less so on an 8GB non-upgradeable laptop. I get it - memory is relatively cheap these days - and manufacturers that are building memory-limited devices are…

VM dynamic allocation of ram has been a standard feature of KVM, hyper-v and VMware for the better part of 10 years now.

Re: macOS Containers v0.0.1

#27

Post by walthamstow »

highwaylights wrote: post #21
perryizgr8 wrote: post #15

Earlier quoted context omitted.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

This kind of makes me wonder why you'd have a Mac at all (I'm sure there are use cases). Wouldn't a Linux device, or Linux running on a Mac suit you better? For me, the security picture is one of the main features of the eco-system even if it's very restrictive - disabling SIP undermines it more or less completely.

I'm not your parent post but surely the easy answer to why use a mac at all is simply how great the hardware is. The 2020 M1 Air is nearly 3 years old and still a brilliant machine.

Re: macOS Containers v0.0.1

#29

Post by _joel »

perryizgr8 wrote: post #15
highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

Bizarre

Re: macOS Containers v0.0.1

#30

Post by rafaelmn »

highwaylights wrote: post #21
perryizgr8 wrote: post #15

Earlier quoted context omitted.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

This kind of makes me wonder why you'd have a Mac at all (I'm sure there are use cases). Wouldn't a Linux device, or Linux running on a Mac suit you better? For me, the security picture is one of the main features of the eco-system even if it's very restrictive - disabling SIP undermines it more or less completely.

>Wouldn't a Linux device, or Linux running on a Mac suit you better?

Maybe they want a unixy desktop with working sound ?

Half joking, but that's my use case - homebrew is pretty great, most developers use a Mac in my domains of interest so it's always supported.

Linux is just too much work (and I'm using Fedora on my desktop). SIP is just false positives and annoyance.

I'm on the fence about M/ARM switch since I still see a lot of friction with containers so I might be looking at framework for my next device. Or just go all in on client/server development model.

Post reply on HN