6 ms·

Does OSX offer reasonable container technology? chroot?

wedn3sday 7y ago
Singularity recently released a (non-fully featured, but still useful) mac version.
pram 7y ago
macOS has a native hypervisor framework, Docker and xhyve uses it. https://developer.apple.com/documentation/hypervisor https://developer.apple.com/documentation/hypervisor https://github.com/moby/hyperkit https://github.com/moby/hyperkit
- AceJohnny2 7y ago
  In other words, nothing serious. Does anyone actually use Docker on Mac? Xhyve is more of a proof-of-concept than a production-ready tool.
  - abhorrence 7y ago
    I use Docker on Mac, and know many others who do as well.
  - RussianCow 7y ago
    > Does anyone actually use Docker on Mac? What? We use it at work every day for local development, and my previous employer did as well. It has issues, definitely, but they have more to do with Docker than with xhyve.
    - enneff 7y ago
      But doesn’t Docker on Mac run a Linux VM? I don’t think it uses any of MacOS’s isolation features.
      - frizkie 7y ago
        It uses Hyperkit: https://github.com/moby/hyperkit https://github.com/moby/hyperkit
  - dwaite 7y ago
    > Does anyone actually use Docker on Mac? I use it extensively. It is a desktop product however; it you aren't expected to put a swarm of MacBook pros into production.
    - brianwawok 7y ago
      Unless you want to run CD to the App Store? So fun....
    - jackfraser 7y ago
      Ah, but if the XServe had not died and datacenters had racks of these things, there'd no doubt be a production quality implementation by now. Shame.
  - markn951 7y ago
    I personally know of at least 3 or 4 engineering teams of 30+ developers who use it daily.
  - jen20 7y ago
    Xhyve is but one of the options for fronting hypervisor.framework. Calling it “not serious” is quite wrong.
  - konart 7y ago
    >Does anyone actually use Docker on Mac? Sure, for development tasks.
- bpye 7y ago
  Qemu has a backend too if I'm not mistaken?
- new_realist 7y ago
  A hypervisor is not exactly a container. Definitely not in the Linux sense. It may be more secure, but it is also slower. Further, there's no decent solution for shipping a macOS container image to run in a VM. Linux, yes, Mac, no. Finally, good luck getting your virtualized macOS app to interact reasonably with your main OS (no drag and drop, no OpenGL, etc.). I would rather chroot.
  - markstos 7y ago
    How much slower?
    - TehCorwiz 7y ago
      Measurably slower than a LXC container, but still much faster than a full VM.
    - jackfraser 7y ago
      Not much slower than, say, Hyper-V or Virtualbox or other hypervisors that live alongside a general purpose desktop OS. Remember, they're using the same Intel chips and VT-d and such as anything else; as long as you have enough CPU power it's going to run fine. IIRC the Docker implementation for OS X runs a tiny, carefully-configured Linux VM transparently in the background. This isn't that dissimilar from the Windows Subsystem for Linux from a user standpoint. I've done plenty of Docker work on OS X; the only real weirdness is that you're running Linux in the containers and OS X outside. Eventually, though, before switching completely to a native Linux desktop, I moved deeper into the containers and would barely ever see the OS X command prompt any more.
    - wyufro 7y ago
      Primarily disk access is a lot slower, even with Hyper-V. Eg. Compilation suffers from this. But tasks that don't use the disk too much shouldn't be that bad.
    - tele_ski 7y ago
      Our build time on Linux container is 8 minutes, but it's a few hours on macOS using docker containers. I haven't dug into it but the hypervisor seems to be single threading the normally multicore compile.
m463 7y ago
I think apple fundamentally does not understand containers. All the interesting container stuff is on other platforms. It might be out of fear, maybe because apple doesn't want macos to be virtualized. It would be really nice to have say the current xcode in one container and a dev xcode in another. It would be nice to farm work out to a lot of machines. or a dockerfile like: FROM macos:10.14 RUN installer xcode... RUN xcode-build myproject
- eropple 7y ago
  > I think apple fundamentally does not understand containers. Given that Apple is (or at least was) one of the biggest users of Mesos in the world and have invited me to interview specifically on the back of the operationalization of containers, I'm guessing that the staggeringly bright programmers they've got probably understand containers. Just a little hunch, you know?
  - m463 7y ago
    The devops guys need to spread the love to the OS group and ship it with the OS. Maybe it's another "you're not the target market" kind of thing. The point I'm getting at is that folks on other platforms have lots and lots of options and apple doesn't provide any.
- saagarjha 7y ago
  > apple doesn't want macos to be virtualized. The macOS EULA explicitly allows macOS to be virtualized if you do it on a Mac running macOS. > It would be really nice to have say the current xcode in one container and a dev xcode in another. This is the entire point behind xcode-select. I currently have Xcode-beta and Xcode on side-by-side on my machine, and they pretty much coexist.
  - m463 7y ago
    - "allows" not the same as supports. - I think xcode-select just modifies a .plist.
Gaelan 7y ago
I imagine you could get pretty far with sandboxing+chroot, but it wouldn’t be docker. You’d definitely be able to prevent stuff in the container from getting out, but I’m not so sure you could reproduce docker’s “VM-like” (I.e. the inside of the container is ~identical to a normal Linux machine, with no need to make stuff compatible) quality.

Singularity recently released a (non-fully featured, but still useful) mac version.

pram 7y ago

macOS has a native hypervisor framework, Docker and xhyve uses it. https://developer.apple.com/documentation/hypervisor https://developer.apple.com/documentation/hypervisor https://github.com/moby/hyperkit https://github.com/moby/hyperkit

AceJohnny2 7y ago
In other words, nothing serious. Does anyone actually use Docker on Mac? Xhyve is more of a proof-of-concept than a production-ready tool.
- abhorrence 7y ago
  I use Docker on Mac, and know many others who do as well.
- RussianCow 7y ago
  > Does anyone actually use Docker on Mac? What? We use it at work every day for local development, and my previous employer did as well. It has issues, definitely, but they have more to do with Docker than with xhyve.
  - enneff 7y ago
    But doesn’t Docker on Mac run a Linux VM? I don’t think it uses any of MacOS’s isolation features.
    - frizkie 7y ago
      It uses Hyperkit: https://github.com/moby/hyperkit https://github.com/moby/hyperkit
- dwaite 7y ago
  > Does anyone actually use Docker on Mac? I use it extensively. It is a desktop product however; it you aren't expected to put a swarm of MacBook pros into production.
  - brianwawok 7y ago
    Unless you want to run CD to the App Store? So fun....
  - jackfraser 7y ago
    Ah, but if the XServe had not died and datacenters had racks of these things, there'd no doubt be a production quality implementation by now. Shame.
- markn951 7y ago
  I personally know of at least 3 or 4 engineering teams of 30+ developers who use it daily.
- jen20 7y ago
  Xhyve is but one of the options for fronting hypervisor.framework. Calling it “not serious” is quite wrong.
- konart 7y ago
  >Does anyone actually use Docker on Mac? Sure, for development tasks.
bpye 7y ago
Qemu has a backend too if I'm not mistaken?
new_realist 7y ago
A hypervisor is not exactly a container. Definitely not in the Linux sense. It may be more secure, but it is also slower. Further, there's no decent solution for shipping a macOS container image to run in a VM. Linux, yes, Mac, no. Finally, good luck getting your virtualized macOS app to interact reasonably with your main OS (no drag and drop, no OpenGL, etc.). I would rather chroot.
- markstos 7y ago
  How much slower?
  - TehCorwiz 7y ago
    Measurably slower than a LXC container, but still much faster than a full VM.
  - jackfraser 7y ago
    Not much slower than, say, Hyper-V or Virtualbox or other hypervisors that live alongside a general purpose desktop OS. Remember, they're using the same Intel chips and VT-d and such as anything else; as long as you have enough CPU power it's going to run fine. IIRC the Docker implementation for OS X runs a tiny, carefully-configured Linux VM transparently in the background. This isn't that dissimilar from the Windows Subsystem for Linux from a user standpoint. I've done plenty of Docker work on OS X; the only real weirdness is that you're running Linux in the containers and OS X outside. Eventually, though, before switching completely to a native Linux desktop, I moved deeper into the containers and would barely ever see the OS X command prompt any more.
  - wyufro 7y ago
    Primarily disk access is a lot slower, even with Hyper-V. Eg. Compilation suffers from this. But tasks that don't use the disk too much shouldn't be that bad.
  - tele_ski 7y ago
    Our build time on Linux container is 8 minutes, but it's a few hours on macOS using docker containers. I haven't dug into it but the hypervisor seems to be single threading the normally multicore compile.

m463 7y ago

I think apple fundamentally does not understand containers. All the interesting container stuff is on other platforms. It might be out of fear, maybe because apple doesn't want macos to be virtualized. It would be really nice to have say the current xcode in one container and a dev xcode in another. It would be nice to farm work out to a lot of machines. or a dockerfile like: FROM macos:10.14 RUN installer xcode... RUN xcode-build myproject

eropple 7y ago
> I think apple fundamentally does not understand containers. Given that Apple is (or at least was) one of the biggest users of Mesos in the world and have invited me to interview specifically on the back of the operationalization of containers, I'm guessing that the staggeringly bright programmers they've got probably understand containers. Just a little hunch, you know?
- m463 7y ago
  The devops guys need to spread the love to the OS group and ship it with the OS. Maybe it's another "you're not the target market" kind of thing. The point I'm getting at is that folks on other platforms have lots and lots of options and apple doesn't provide any.
saagarjha 7y ago
> apple doesn't want macos to be virtualized. The macOS EULA explicitly allows macOS to be virtualized if you do it on a Mac running macOS. > It would be really nice to have say the current xcode in one container and a dev xcode in another. This is the entire point behind xcode-select. I currently have Xcode-beta and Xcode on side-by-side on my machine, and they pretty much coexist.
- m463 7y ago
  - "allows" not the same as supports. - I think xcode-select just modifies a .plist.

Gaelan 7y ago

I imagine you could get pretty far with sandboxing+chroot, but it wouldn’t be docker. You’d definitely be able to prevent stuff in the container from getting out, but I’m not so sure you could reproduce docker’s “VM-like” (I.e. the inside of the container is ~identical to a normal Linux machine, with no need to make stuff compatible) quality.