Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS Containers v0.0.1

macoscontainers.org

Post reply on HN
Print view View original

91–100 of 374 posts

Re: macOS Containers v0.0.1

#91

Post by mbreese »

slonopotamus wrote: post #81
maggit wrote: post #33

Earlier quoted context omitted.

"System Integrity Protection (SIP)" seems to be the correct name here, for anyone as confused as me :) (More details here: https://support.apple.com/en-us/102149 )

Original author here. Thanks for spotting the typo, fixed. WRT security implications of disabling SIP - I don't think OS becomes any less vulnerable than usual Linux/Windows installation.

And that’s a good thing? I’m not sure the benefits of containers would be worth disabling SIP.

Maybe for an automated test CI/CD running system (which is probably the main use-case), but not on anything that users would interact with.

Re: macOS Containers v0.0.1

#93

Post by da39a3ee »

highwaylights wrote: post #21
perryizgr8 wrote: post #15

Earlier quoted context omitted.

> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.

This kind of makes me wonder why you'd have a Mac at all (I'm sure there are use cases). Wouldn't a Linux device, or Linux running on a Mac suit you better? For me, the security picture is one of the main features of the eco-system even if it's very restrictive - disabling SIP undermines it more or less completely.

No, the hardware drivers are very polished and never give any problems. And the hardware itself is beautiful but I suspect wouldn't integrate as well with the OS if it were running Linux.

Re: macOS Containers v0.0.1

#96

Post by hhh »

slonopotamus wrote: post #81
maggit wrote: post #33

Earlier quoted context omitted.

"System Integrity Protection (SIP)" seems to be the correct name here, for anyone as confused as me :) (More details here: https://support.apple.com/en-us/102149 )

Original author here. Thanks for spotting the typo, fixed. WRT security implications of disabling SIP - I don't think OS becomes any less vulnerable than usual Linux/Windows installation.

Docker Desktop doesn’t require me to disable SIP. Why would I use this if it requires that?

Re: macOS Containers v0.0.1

#98

Post by madeofpalk »

highwaylights wrote: post #16
AceJohnny2 wrote: post #6

How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…

This introduces a long-standing problem that is really the main issue I have with Docker/Podman/containers on anything other than Linux - you have a dedicated VM that needs memory to be set aside for it exclusively. This is fine if you have a 32/64GB machine, but less so on an 8GB non-upgradeable laptop. I get it - memory is relatively cheap these days - and manufacturers that are building memory-limited devices are…

WSL 2 now allows for memory reclaim from the VM, essentially fixing this

    autoMemoryReclaim – Makes the WSL VM shrink in memory
    as you use it by reclaiming cached memory
https://devblogs.microsoft.com/commandline/windows-subsystem...

Re: macOS Containers v0.0.1

#99

Post by ayewo »

slonopotamus wrote: post #81
maggit wrote: post #33

Earlier quoted context omitted.

"System Integrity Protection (SIP)" seems to be the correct name here, for anyone as confused as me :) (More details here: https://support.apple.com/en-us/102149 )

Original author here. Thanks for spotting the typo, fixed. WRT security implications of disabling SIP - I don't think OS becomes any less vulnerable than usual Linux/Windows installation.

If you really want good adoption, you’ll have to figure out a way for devs to try it out without first having to disable SIP.

Is this related to the code you tried to have merged here: https://github.com/containerd/containerd/pull/8789 ?

Re: macOS Containers v0.0.1

#100

Post by vetinari »

slonopotamus wrote: post #87
vetinari wrote: post #57

Earlier quoted context omitted.

> However, if I install Homebrew, then install python, then install a pip package, there's really no kind of scanning/notarization/checking happening at all. There is: you are running that pip package in a chain of processes: Terminal (or iTerm, or whatever) - your shell - python - pip package. In this chain, Terminal has "Developer Tools" privilege, which allows you to run software, that does not meet the system's s…

Yeah, but we need to analyze picture as a whole. And by default, chroot is banned while running as root arbitrary stuff downloaded from the internets is not.

Only in terminal and only if you have developer tools installed. Otherwise, it is not.
Post reply on HN