Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Containers v0.0.1

macoscontainers.org

Post reply on HN
Print view View original

331–340 of 374 posts

Re: macOS Containers v0.0.1

#331

Post by Wowfunhappy »

sacnoradhq wrote: post #61
przems wrote: post #18

Earlier quoted context omitted.

Could you elaborate why? I’m new to macOS, I’d love to learn more about it.

Don't disable security features because of random comments from randos. Also, don't install shit anywhere but your home directory as you unless you want to break your system in an irreparably, unmaintainable, or unsupported manner. If you're using sudo, you're already doing it wrong. https://support.apple.com/en-us/102149

> Also, don't install shit anywhere but your home directory as you unless you want to break your system in an irreparably, unmaintainable, or unsupported manner.

I guess you don't use Homebrew or MacPorts?

Re: macOS Containers v0.0.1

#332

Post by Klonoar »

slonopotamus wrote: post #175
highwaylights wrote: post #147

Earlier quoted context omitted.

This is not necessarily the case. On Linux, more or less the entire permissions system makes no assumption about SIP existing (as it doesn't there), so other protections are relied upon to secure the system (such as SELinux, granular directory permissions, etc.). On both Linux and Windows, TPM and secure boot provide similar protections to SIP on macOS, but are optional (it's encouraged more forcefully on Windows 11)…

What exactly attack vectors you think are possible against macOS without SIP but not possible against Linux?

With SIP enabled it’s not possible to load arbitrary kernel extensions, for one - they must be signed.

Re: macOS Containers v0.0.1

#333

Post by entrepy123 »

stonewhite wrote: post #88
urxvtcd wrote: post #71

Earlier quoted context omitted.

Anecdotal evidence, but here it goes. I moved from Linux to M1 MacBook recently. I know my greps and vims, but I was tired of audio glitches during high CPU usage, system not waking up from sleep, total OS freezes, super loud fans, and so on. Now I get none of that. I don't think I've ever heard the fans. Audio just works, everything is super snappy. It always wakes up. I'm no longer afraid of bluetooth. And on top o…

Exactly my experience. After 15 years, I became an apple fanboy in 15 days. I still do hate losing my muscle memory on some bash shortcuts, but I'd say it was very much worth it.

Homebrew has GNU utils to smooth over the differences in package options.

  [0] https://formulae.brew.sh/formula/coreutils
  [1] https://apple.stackexchange.com/questions/69223/how-to-replace-mac-os-x-utilities-with-gnu-core-utilities

Re: macOS Containers v0.0.1

#334

Post by dmeijboom »

daft_pink wrote: post #319

I feel cheated by Apple a little bit. I bought an Apple Silicon machine after their presentation claiming that they would have first class docker support, but the reality has been that while the first docker worked well as it was translated, now it wants to default to arm containers and it has become very difficult to use because it doesn't want to use Rosetta 2 containers. The whole point of using docker is to use t…

Try OrbStack ;) It’s the only docker daemon alternative for Mac that makes working with docker acceptable.

Re: macOS Containers v0.0.1

#335

Post by garblegarble »

solatic wrote: post #34
highwaylights wrote: post #7

https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interesting. "Disable System Identity Protection." Eesh.

I'm more interested in this as part of a CI/CD process for releasing macOS software. For an isolated build worker - yeah, sure, I'll go ahead and disable SIP. Not every workload is running on an endpoint connected to a human via keyboard and screen.

>For an isolated build worker - yeah, sure, I'll go ahead and disable SIP.

Isn't this especially dangerous on a build worker? All your source code goes in and you (presumably) use the binaries that come out across the rest of your infrastructure. Compromising a build worker in a persistent fashion due to lack of SIP seems like it could do some serious[1] harm...

1: https://wiki.c2.com/?TheKenThompsonHack

Re: macOS Containers v0.0.1

#336

Post by satvikpendem »

zshrc wrote: post #321
satvikpendem wrote: post #290

Earlier quoted context omitted.

I always disable SIP on every Mac I own. It's not very useful and I can run whatever I want on my hardware.

I hope that's sarcasm. https://support.apple.com/en-us/102149 https://support.apple.com/guide/security/system-integrity-pr...

Why would it be sarcasm? If I am root and want to write to /bin or /System, I should be able to, even if it might be dangerous. I get why Apple does it for normal consumers but for people who know what they're doing, it should be available, which it is by disabling it.

Re: macOS Containers v0.0.1

#337

Post by ravenstine »

This is a cool idea and an impressive project.

At the same time, I don't truly understand why anyone would need to use it. If your preference is to totally work with macOS, then I'm sure this would be perfect for that. Otherwise, what's the advantage?

VMs have really come a long way. Every major OS today has a virtualization framework that makes running another OS extremely performant. Docker on macOS uses a virtual machine, but so what? Performance of individual containers, in my experience, isn't really a problem unless you're doing something with the GPU, and even then there are ways to deal with that. Even a fully-emulated VM using QEMU (without hypervisor or KVM) won't have any noticeable performance penalties in many cases.

IMO, there's a much greater advantage to sticking with Linux. Even if the host isn't Linux, developing and deploying with Linux guests provides a tremendous level of consistency and portability.

But maybe I'll be proven wrong by this project someday soon!

Re: macOS Containers v0.0.1

#338

Post by jmbwell »

diogenes4 wrote: post #287
jmbwell wrote: post #230

Earlier quoted context omitted.

SIP means not messing with the system files, enumerated thusly: /System. Enumerating what I do want an app to access is handled by Gatekeeper.

> SIP means not messing with the system files, enumerated thusly: /System. ...and all its children, which is effectively the entire operating system > Enumerating what I do want an app to access is handled by Gatekeeper. Gatekeeper is not capable of this.

It's among the things Gatekeeper does, isn't it? As configured with PPPC?

Re: macOS Containers v0.0.1

#339

Post by saagarjha »

Wowfunhappy wrote: post #330
saagarjha wrote: post #280

Earlier quoted context omitted.

No, that's not true. Turning off SIP is usually about equivalent to allowing instant escalation to root privileges; sometimes even worse.

Can you please expand on this? It wasn't my understanding at all. A decade ago SIP didn't exist at all. I thought disabling SIP just put us back to how things were in Yosemite. What changed?

Apple relied on it being turned on and started introducing permission checks where you'd have things like "do thing as root" and check for some flag being set that is protected by SIP. If you have it turned on, there are no issues, because the check blocks both root and non-root users! But if you turn it off, now the "do thing as root" is available to any account because the flag is editable.

Re: macOS Containers v0.0.1

#340

Post by daft_pink »

dmeijboom wrote: post #334
daft_pink wrote: post #319

I feel cheated by Apple a little bit. I bought an Apple Silicon machine after their presentation claiming that they would have first class docker support, but the reality has been that while the first docker worked well as it was translated, now it wants to default to arm containers and it has become very difficult to use because it doesn't want to use Rosetta 2 containers. The whole point of using docker is to use t…

Try OrbStack ;) It’s the only docker daemon alternative for Mac that makes working with docker acceptable.

Thanks! I'll check it out.
Post reply on HN