macOS Containers v0.0.1
macoscontainers.org
macOS Containers v0.0.1
1–10 of 374 posts
Re: macOS Containers v0.0.1
#2TIL SIP blocks chroot. I wonder why?
Re: macOS Containers v0.0.1
#3System Integrity Protection sounds really important. What does it do normally, and why does this tool require it to be disabled?
Re: macOS Containers v0.0.1
#4Why should anyone trust this website and download the software? There's no indication who made it. Could be malware for all I know.
Re: macOS Containers v0.0.1
#5Why should anyone trust this website and download the software? There's no indication who made it. Could be malware for all I know.
Looks like it's open source https://github.com/macOScontainers
Re: macOS Containers v0.0.1
#6How does this work?
Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel.
Does XNU have such namespacing functionality across all its interfaces?
Furthermore, the existing container ecosystem assumes a Linux syscall interface. [1]. Does macOS provide that? I expect not.
The way Docker Desktop (and podman.io) implement "containers on macOS" is a bit of a cop-out: they actually run a Linux virtual machine (using Hypervisor.framework/hvf), and have that just provide the container environment.
Is that what this project is doing? But then, how could it run a macOS container?
[1] based on the foundation that Linux, unlike BSDs, has a stable syscall interface!
Re: macOS Containers v0.0.1
#7https://github.com/macOScontainers/homebrew-formula
"macOS native containers"
Cool, this sounds interesting.
"Disable System Identity Protection."
Eesh.
Re: macOS Containers v0.0.1
#8How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…
[deleted]
Re: macOS Containers v0.0.1
#9How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…
The transitively linked docs have some answers:
rund is an experimental containerd shim for running macOS containers on macOS.
rund doesn’t offer the usual level of container isolation that is achievable on other OSes due to limited macOS kernel API.
What rund provides:
- Filesystem isolation via chroot(2)
- Cleanup of container processes using process group
- OCI Runtime Specification compatibility (to the extent it is possible on macOS)
- Host-network mode only
- bind mountsRe: macOS Containers v0.0.1
#10How does this work? Fundamentally, containers are about namespace/isolation of a bunch of OS interfaces, so file system functions, network functions, memory management, process functions, etc, can all pretend like they're the only game in town, but crucially without having to virtualize out the kernel. Does XNU have such namespacing functionality across all its interfaces? Furthermore, the existing container ecosyste…