3 ms·

While neat and useful - is it fair to call this a container ? It seems to only partition/isolate the filesystem(perhaps network interface too) - while (arguably

While neat and useful - is it fair to call this a container ? It seems to only partition/isolate the filesystem(perhaps network interface too) - while (arguably) the benefit of containers is being able to also partition and isolate CPU, memory, network, routing, etc.

geggam 11y ago
The cpu / memory / network "isolation" is done with cgroups and can be done without containers
- vidarh 11y ago
  cgroups are Linux-specific - they're not relevant for a OS X/NetBSD tool.
  - geggam 11y ago
    no kidding ? sarcasm They also don't isolate anything. especially when the container system is running as root. Neither does chroot.
jacques_chester 11y ago
Smarter people than me say that "true" containerizing on OS X is not really a thing[1]. [1] https://github.com/vito/houdini https://github.com/vito/houdini
- geofft 11y ago
  OS X doesn't provide kernel features directly equivalent to Linux's CLONE_* and cgroups. But it does provide Seatbelt, a sandboxing policy layer, which you could use with effort to implement something similar in end result. This is what both iOS apps and desktop App Store apps use for security isolation. Alternatively, you could ship a kernel module that added these features (although that might be ridiculously complicated).
  - jacques_chester 11y ago
    Alex (aka vito) likes implementing things from scratch on weekends. So if you surprised him with a github issue he might just take you up on that challenge.