Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Containers v0.0.1

macoscontainers.org

Post reply on HN
Print view View original

311–320 of 374 posts

Re: macOS Containers v0.0.1

#311

Post by anthk »

rebolek wrote: post #90
devsda wrote: post #45

Earlier quoted context omitted.

> Maybe they want a unixy desktop with working sound ? In my experience, this has not been an issue for the past 10-15 years atleast. Before that there were some problems with few (external) soundcards or random cpu spikes with the mixers. However, the UX can still improve. Switching audio outputs with multiple outputs like external displays etc is not very smooth or intuitive. Some bluetooth headsets have issues but…

I'm running Linux everyday and I really wouldn't recommend it for any serious audio stuff. There is great audio software coming to Linux (Bitwig, Reaper, etc) which is great but the underlying infrastructure is a mess. There are like 3-4 audio subsystems running, I never know which one is it, setting latency is wizardry and sometimes it doesn't run at all. It's usually fine when I run stuff like Spotify, VLC, or Yout…

Fedora Silverblue with Pipewire will just use a single subsystem and that's it. Inmutable OS and the rest of software it's Flatpak. The issues are gone. Oh, you need a proper devel environment with dnf/rpm? Just use "toolbox enter" and install all the complex envs under that container.

Re: macOS Containers v0.0.1

#312

Post by xenadu02 »

znpy wrote: post #43
robertlagrant wrote: post #9

Earlier quoted context omitted.

The transitively linked docs have some answers: rund is an experimental containerd shim for running macOS containers on macOS. rund doesn’t offer the usual level of container isolation that is achievable on other OSes due to limited macOS kernel API. What rund provides: - Filesystem isolation via chroot(2) - Cleanup of container processes using process group - OCI Runtime Specification compatibility (to the extent it…

So essentially a chroot with a bit of make-up and a lot of marketing? Except for bind mounts (not even overlayfs...) there isn't much interesting. > - Host-network mode only Yeah expect a lot of things to break in subtle ways... most containers are developed kinda expecting you have your own network namespace (and that no one else is using ports)

If the parent process of the container here changes its bootstrap port to itself or disinherits it then it could also create an isolated mach namespace, restricting access to mach/XPC services.

Re: macOS Containers v0.0.1

#313

Post by saagarjha »

abujazar wrote: post #154
highwaylights wrote: post #31

Earlier quoted context omitted.

SIP is secure boot for macOS. It's intended to prevent malware from changing system files due to rogue permissions or escalation. With SIP enabled, even the root/sudo user doesn't have rights to change these files. It also refuses to boot a system with drivers that are not signed by Apple, so as to deter malware from using drivers as an attack vector. https://en.wikipedia.org/wiki/System_Integrity_Protection

> SIP is secure boot for macOS. Not really. «Secure Boot» is intended to secure the boot process through signature verification. However the security model is completely broken, https://arstechnica.com/information-technology/2023/03/unkil... SIP is a protection layer which protects system files from modification also after the system is booted.

Apple ships a non-broken secure boot, unlike almost everyone else.

Re: macOS Containers v0.0.1

#314

Post by nraf »

sofixa wrote: post #106
anonymoushn wrote: post #79

Earlier quoted context omitted.

For example people do not use homebrew to install python3 on a fresh install of mac os and get a python that spews a bunch of messages to stderr about the version of libc6.so and cannot speak TLS.

It only upgrades PostgreSQL 3 major versions up alongside without asking.

[dead]

Re: macOS Containers v0.0.1

#315

Post by fredoliveira »

prmoustache wrote: post #103
Klonoar wrote: post #42

Earlier quoted context omitted.

So I take it you don't use Apple Pay or anything...? Edit: to be clear for the people who may not know, Apple Pay does not work with SIP disabled. ;P

Is Apple Pay that popular?

I don't know whether it is popular everywhere, but it is certainly popular everywhere I go (anywhere in the US, and western Europe). I absolutely love it.

Re: macOS Containers v0.0.1

#316

Post by slonopotamus »

dkonofalski wrote: post #299
conradev wrote: post #234

Earlier quoted context omitted.

OrbStack doesn’t require breaking security: https://orbstack.dev/

Does OrbStack allow you to create MacOS Containers? It doesn't seem like it from their website. It seems like it just runs on MacOS to let you create Linux containers.

OrbStack is about Linux containers. What we're talking about in this topic is the only software in the world for macOS containers.

Re: macOS Containers v0.0.1

#317

Post by fredoliveira »

dkonofalski wrote: post #304
avidphantasm wrote: post #223

Earlier quoted context omitted.

Civilized people don’t install things in “/“.

I'm not sure if you were arguing against the parent comment or supporting it but did you actually mean "/" and not "~/"?

Reads like support, and I'm 99% sure they mean "/"

Re: macOS Containers v0.0.1

#318

Post by rakoo »

dkonofalski wrote: post #300
rakoo wrote: post #294

Earlier quoted context omitted.

Why would it be running with escalated privileges if you don't know what it is ?

I feel like you're assuming that applications have to be honest about what they are when they request a user-prompted permission. SIP makes that irrelevant.

No, I'm assuming that you know what you install and that apps run with the same rights your user has. Your user can't touch /System, so shouldn't the app

Re: macOS Containers v0.0.1

#319

Post by daft_pink »

I feel cheated by Apple a little bit.

I bought an Apple Silicon machine after their presentation claiming that they would have first class docker support, but the reality has been that while the first docker worked well as it was translated, now it wants to default to arm containers and it has become very difficult to use because it doesn't want to use Rosetta 2 containers.

The whole point of using docker is to use the same containers in production as you use in development, so having docker default to these random arm containers means that my containers aren't exactly production, because they are arm based and the servers are not.

I understand that docker is the developer of docker software, but I really wish I could just click a button and force intel based containers in docker as the default and have to opt-in to arm.

If anyone has an easy solution to this let me know. I don't want to spend hours and hours figuring out docker on my mac.

Re: macOS Containers v0.0.1

#320

Post by [deleted] »

perryizgr8 wrote: post #305
Klonoar wrote: post #42

Earlier quoted context omitted.

So I take it you don't use Apple Pay or anything...? Edit: to be clear for the people who may not know, Apple Pay does not work with SIP disabled. ;P

No, I don't use apple pay. I don't have any apple device for personal use at all, and I wouldn't use my work MacBook for personal payments.

[deleted]
Post reply on HN