11 ms·

ISH: An Alpine Linux Shell on iOS

193 points by qubex 7y ago

supdatecron 7y ago
Wow. This gave me a flashback to the early days of iOS jailbreaking, back in late 2000's. Wasn't "alpine" the password for the original jailbreak (that you downloaded over a safari/web PDF link if I recall). I never did learn exactly why "alpine" was the password...
- saagarjha 7y ago
  The first iOS release was codenamed Alpine, which started a long line of ski-resort related names. (It's a coincidence in this case.)
  - numpad0 7y ago
    I remember the initial iPhone Simulator release was called "Aspen Simulator" and another codename for the iPhone hardware was "Purple" appearing somewhere as "Purple is the new Orange" or something... Is there a list of those?
    - saagarjha 7y ago
      Wikipedia has a fairly detailed (and as far as I can tell, accurate) page, though it’s not complete by any means: https://en.wikipedia.org/wiki/List_of_Apple_codenames https://en.wikipedia.org/wiki/List_of_Apple_codenames
- Flockster 7y ago
  And it still is the root password of the iPhone/iPad etc. So when you install an ssh server on your jailbroken iDevice, you should change this password. ;)
  - saagarjha 7y ago
    It’s also the mobile user’s password.
- seltzered_ 7y ago
  Yes, alpine was the password. I'm hoping ipadOS (not iOS) will eventually get some ability to compute/develop/run software without the hacks, just because the current state is absurd. I've made a collage to illustrate this: https://imgur.com/a/CQwApt8 https://imgur.com/a/CQwApt8 Text summary: iSH - enable location services to run things in the background. A couple youtube videos talking about having yet another device to do things like terminal access (via having a raspi over usb-c) or UTM (virtual machine host) - which from my understanding requires a paid 99/yr developer profile to run.
  - Cu3PO42 7y ago
    I really like the iPad form factor and carry one around with me for almost all work and study because I really like the digital writing experience on that. Much more than on a Surface, for example. So I wanted to make this work, I really wanted to be able to use it for light development so I could leave my notebook at home some/most days (depending on what I'm currently working on). But it doesn't stop with all the things in your collage. i(Pad)OS doesn't natively support my keyboard layout, so I was looking at getting a QMK-compatible keyboard so I could do all the remapping before the signal ever reaches the iPad. Only after sinking a non-trivial amount of time into researching that I realized how absurd this was. A device so powerful and yet so limited by its software. I have since made my peace with the fact that my iPad is a glorified notepad and PDF viewer, but I wish it didn't have to be.
    - epicide 7y ago
      Depending on exactly what you want to work on, also look into using something like Blink[0]. I have several servers set up that I can now easily access from my iPad (or anything with an internet connection and an SSH client). I have one "bastion" server that basically acts as a headless dev box with mosh and tmux set up. As long as I have internet, I can quickly access machines that are far more capable than any laptop I've owned. Even when I inevitably do need my laptop for something, having this setup is great for continuity [1]. Of course, this is not a drop-in replacement for a proper desktop OS, especially if you aren't a heavy CLI user [2]. However, in a similar vein to "Linux is NOT Windows" [3], you can't expect a mobile experience to be significantly better without being significantly different. Over the past couple years where I've been dabbling with it, I have made a couple of mentality shifts about how I want to use computers going forward. Even if I don't every use an iPad as my main/only physical device, I now happily carry around one of the 12" Macbooks since I don't need all the computing power on my person. None of these ideas are particularly new, but I haven't seen many other people really taking it past "SSH into server, run command(s), exit". [0]: A very well-made SSH client for iOS that supports mosh): https://blink.sh/ https://blink.sh/ [1]: I can shut my laptop even if a large/long job is running since the job is running on a server. [2]: For some things, I've used VNC or other remote desktop type tools, but this experience also comes with heavy tradeoffs. YMMV. [3]: http://linux.oneandoneis2.org/LNW.htm http://linux.oneandoneis2.org/LNW.htm
chadlavi 7y ago
I joined the testflight beta for this a while ago, then got a "the developer removed you" message and could never get back in. But it was convenient to have on hand.
- saagarjha 7y ago
  Send him an email, he'll add you back. The beta can only fit 10,000 people and it gets cleaned regularly in an attempt to stay below this limit.
  - q3k 7y ago
    At this point, why does Apple even still bother preventing people from sideloading apps?
    - saagarjha 7y ago
      Because Apple is extremely inconsistent at enforcing their rules.
    - 2fast4you 7y ago
      This isn’t side loading. The app is in TestFlight because it’s still in beta
  - chadlavi 7y ago
    Ahhh I see I see. I should probably just let it be, so other people can experience it too.
fbn79 7y ago
I'm quite sure this kind of application is against Apple store rules and would be banned if published: 2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps. Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. Such apps must make the source code provided by the Application completely viewable and editable by the user.
- qubex 7y ago
  That’s why it’s released through TestFlight.
- saagarjha 7y ago
  It's up in the air, since Apple's guidelines are not consistently interpreted or enforced. It has, however, been approved to be on TestFlight thus far. (Which has little bearing on whether it will continue to be available, or if it will ever pass App Store review.)
- Wingy 7y ago
  It stays within the container. It just emulates alpine linux. It's a VM. If that weren't allowed, how is Pythonista on the app store?
  - saagarjha 7y ago
    Pythonista readily lets you inspect the code you’re running, since it’s just a Python script.
classified 7y ago
Yummy. Does it have a C compiler?
- saagarjha 7y ago
  If you install one: app add gcc
chc4 7y ago
I recommend people check the GitHub readme for a good laugh too :)
monkin 7y ago
Is there an option to switch ESC with Tab?
- saagarjha 7y ago
  With tab? No. But on iOS 13.4 you can remap caps lock.
cosmiccatnap 7y ago
Now if only you could just install Linux directly to your laptop you wouldn't need a Mac at all
madushan1000 7y ago
It looks interesting, great work! I'm curious why you chose x86 emulation instead of arm emulation though, provided that this is running on an arm processor?
- qubex 7y ago
  I’m not the author.
- saagarjha 7y ago
  Not the author, but I did write the FAQ entry for this: https://github.com/tbodt/ish/wiki/FAQ#q-why-does-ish-not-emulate-arm-or-some-other-architecture https://github.com/tbodt/ish/wiki/FAQ#q-why-does-ish-not-emu...
  - fragmede 7y ago
    The FAQ answer only answers one very specific aspect of things. The broader question is that emulating a foreign chipset (especially one as complex as x86), in order to have a local terminal, is ridiculous. Why be so ridiculous? The answer is that it has to be that way, due to Apple's restrictions on what is allowed to run, so iSH is a very clever hack on top of those restrictions, in order to get a "blessed" local unix environment on an iOS device.
    - saagarjha 7y ago
      Fewer people asked that question, so it never got added. Feel free to add it yourself if you think you have a good answer.
- zozbot234 7y ago
  In practice, RISC-V emulation would likely show better performance than either x86 or ARM. Though Alpine support for that architecture is not there yet, so I can see why ISH isn't using it at this time.
KiDD 7y ago
I've loved watching this app grow from the beginning in TestFlight to what it has become now!
sigjuice 7y ago
Apple should officially expose the Unix underneath so ARM homebrew can be a possibility.
- todd3834 7y ago
  If they did this I could do my job from an iPad Pro
- techntoke 7y ago
  It's called Android
  - skavi 7y ago
    Android’s tablet ecosystem is dead.
- headmelted 7y ago
  This isn’t needed though. Chrome OS handles this quite gracefully by having container support baked in. You can just install whatever distro you need in the container and get rolling with it. It would make iPad Pro my perfect device (I’d replace my MBP in a heartbeat).
  - josteink 7y ago
    ChromeOS can do that because it has already booted a Linux-kernel and the container is also a Linux-distro, so it’s essentially just a chroot. I.e. computationally really cheap. An iPad boots a (modified?) XNU kernel and can’t just “chroot” into a Linux-distro because the right kernel won’t be there to support the Linux userspace.
    - Hackbraten 7y ago
      > (modified?) By now, iPhones, iPads and Apple Watches boot XNU proper (meaning their kernel is no longer compiled from a fork but from the proper XNU code base). It’s still a modified kernel in a broader sense: platform-and architecture-dependent modules, ifdefs, a different set of kernel modules, exclusive/missing system calls and other extraneous/missing features (e. g. no kext loading infrastructure).
deeblering4 7y ago
There are a couple interesting choices that I'd like to understand the reasoning for: * The shell runs as root as soon as you open it, why not a use less privileged user and sudo? * There are getty processes running on tty[1-6] what is the purpose of this?
- tbodt 7y ago
  iSH author here. Answer to both: because that's how the Alpine Linux minirootfs image is set up.
headmelted 7y ago
ISH makes me happy and frustrates me in equal measure. On one hand, it’s exactly what I want on iOS in terms of a shell and Posix sandbox. On the other, it forces x86 emulation on me that I don’t want. If ISH could just give me an aarch64 environment without QEMU at all I’d be in love.
- nneonneo 7y ago
  The biggest problem is that iOS completely bans executing native code that isn’t code signed, with the sole exception of the Safari JIT (and possibly Swift Playgrounds - not sure how that works). There’s weird hacks to get around this, e.g. a JIT compiler that compiles native code into ROP chains that jump around gadgets precompiled into your native binary, but otherwise there’s really no way to run arbitrary CPU-native code. Hence, the emulator. And if you have to emulate the CPU, you might as well emulate the most popular CPU for compatibility.
  - saagarjha 7y ago
    Swift Playgrounds has the com.apple.private.amfi.can-execute-cdhash entitlement, which allows it to dynamically load unsigned code.
- hsitz 7y ago
  In other words, at least as I would say it: iSH is slow.
dang 7y ago
Related from 2018: https://news.ycombinator.com/item?id=18421016 https://news.ycombinator.com/item?id=18421016
- saagarjha 7y ago
  Also a previous submission of the website, a day later: https://news.ycombinator.com/item?id=18430031 https://news.ycombinator.com/item?id=18430031
ezequiel-garzon 7y ago
I love this, got removed due to inactivity and am lazy enough to not bug anybody with an email. Does anybody know why they don’t offer this as an app? I’m sure people would be willing to pay quite a bit for it.
- evanextreme 7y ago
  As far as I'm aware, they're still working on bugs and it's not ready for release
  - ezequiel-garzon 7y ago
    Thanks, such a shame... It feels way less buggy than plenty of paid apps.
rcarmo 7y ago
iSH is pretty great. I've been using it for a while, and (even with all its shortcomings) it really drives home the point that the iPad (even the Mini 5) is a beast of a machine.
nneonneo 7y ago
Apple is in a bit of an odd place right now with respect to development and end-user programming. Ever since they released Swift Playgrounds they’ve seemingly decided to be much nicer to programming apps. Pythonista is probably the most prominent such app, with deep integration with iOS features and full access to every API (thanks to ctypes you can even dlopen private APIs and use them...shhh). But there are some new ones too, like Play.js (full node.js environment), Scriptable, and probably dozens of others that I haven’t tried. It’s a bit of an interesting time. The real question will be whether Apple continues the slow path towards openness or whether they choose to go back to locking things down. I suspect their push to make the iPad more “pro” will inevitably force them towards the former.
- mark_l_watson 7y ago
  Pythonista is really very good, and it is easy to pip install pure Python libraries. Too bad Python is not one of my favorite languages. The Raskell app used to provide a decent Haskell environment in iOS, but, file access stopped working. Really too bad since it was fun to hack Haskell on airplanes, etc. Swift Playgrounds on iOS are very interesting and makes me wonder if XCode might someday live in iOS, with appropriate code sandboxing. Apple has made iOS and macOS app development much simpler with SwiftUI, simple enough that I enjoy using it. I think Apple will jump through hoops in the coming years to make app development easier.
miguelmota 7y ago
I just noticed that there's a word counter badge on the ISH github README that counts how many times the word fuck shows up in the codebase https://github.com/tbodt/ish https://github.com/tbodt/ish
miguelmota 7y ago
I get 'The beta is full' when clicking on the TestFlight link.
- mmcwilliams 7y ago
  If you have an Apple developer account the app is relatively simple to build and install with your own profile.

193 points by qubex 7y ago

Wow. This gave me a flashback to the early days of iOS jailbreaking, back in late 2000's. Wasn't "alpine" the password for the original jailbreak (that you downloaded over a safari/web PDF link if I recall). I never did learn exactly why "alpine" was the password...

saagarjha 7y ago
The first iOS release was codenamed Alpine, which started a long line of ski-resort related names. (It's a coincidence in this case.)
- numpad0 7y ago
  I remember the initial iPhone Simulator release was called "Aspen Simulator" and another codename for the iPhone hardware was "Purple" appearing somewhere as "Purple is the new Orange" or something... Is there a list of those?
  - saagarjha 7y ago
    Wikipedia has a fairly detailed (and as far as I can tell, accurate) page, though it’s not complete by any means: https://en.wikipedia.org/wiki/List_of_Apple_codenames https://en.wikipedia.org/wiki/List_of_Apple_codenames
Flockster 7y ago
And it still is the root password of the iPhone/iPad etc. So when you install an ssh server on your jailbroken iDevice, you should change this password. ;)
- saagarjha 7y ago
  It’s also the mobile user’s password.
seltzered_ 7y ago
Yes, alpine was the password. I'm hoping ipadOS (not iOS) will eventually get some ability to compute/develop/run software without the hacks, just because the current state is absurd. I've made a collage to illustrate this: https://imgur.com/a/CQwApt8 https://imgur.com/a/CQwApt8 Text summary: iSH - enable location services to run things in the background. A couple youtube videos talking about having yet another device to do things like terminal access (via having a raspi over usb-c) or UTM (virtual machine host) - which from my understanding requires a paid 99/yr developer profile to run.
- Cu3PO42 7y ago
  I really like the iPad form factor and carry one around with me for almost all work and study because I really like the digital writing experience on that. Much more than on a Surface, for example. So I wanted to make this work, I really wanted to be able to use it for light development so I could leave my notebook at home some/most days (depending on what I'm currently working on). But it doesn't stop with all the things in your collage. i(Pad)OS doesn't natively support my keyboard layout, so I was looking at getting a QMK-compatible keyboard so I could do all the remapping before the signal ever reaches the iPad. Only after sinking a non-trivial amount of time into researching that I realized how absurd this was. A device so powerful and yet so limited by its software. I have since made my peace with the fact that my iPad is a glorified notepad and PDF viewer, but I wish it didn't have to be.
  - epicide 7y ago
    Depending on exactly what you want to work on, also look into using something like Blink[0]. I have several servers set up that I can now easily access from my iPad (or anything with an internet connection and an SSH client). I have one "bastion" server that basically acts as a headless dev box with mosh and tmux set up. As long as I have internet, I can quickly access machines that are far more capable than any laptop I've owned. Even when I inevitably do need my laptop for something, having this setup is great for continuity [1]. Of course, this is not a drop-in replacement for a proper desktop OS, especially if you aren't a heavy CLI user [2]. However, in a similar vein to "Linux is NOT Windows" [3], you can't expect a mobile experience to be significantly better without being significantly different. Over the past couple years where I've been dabbling with it, I have made a couple of mentality shifts about how I want to use computers going forward. Even if I don't every use an iPad as my main/only physical device, I now happily carry around one of the 12" Macbooks since I don't need all the computing power on my person. None of these ideas are particularly new, but I haven't seen many other people really taking it past "SSH into server, run command(s), exit". [0]: A very well-made SSH client for iOS that supports mosh): https://blink.sh/ https://blink.sh/ [1]: I can shut my laptop even if a large/long job is running since the job is running on a server. [2]: For some things, I've used VNC or other remote desktop type tools, but this experience also comes with heavy tradeoffs. YMMV. [3]: http://linux.oneandoneis2.org/LNW.htm http://linux.oneandoneis2.org/LNW.htm

chadlavi 7y ago

I joined the testflight beta for this a while ago, then got a "the developer removed you" message and could never get back in. But it was convenient to have on hand.

saagarjha 7y ago
Send him an email, he'll add you back. The beta can only fit 10,000 people and it gets cleaned regularly in an attempt to stay below this limit.
- q3k 7y ago
  At this point, why does Apple even still bother preventing people from sideloading apps?
  - saagarjha 7y ago
    Because Apple is extremely inconsistent at enforcing their rules.
  - 2fast4you 7y ago
    This isn’t side loading. The app is in TestFlight because it’s still in beta
- chadlavi 7y ago
  Ahhh I see I see. I should probably just let it be, so other people can experience it too.

fbn79 7y ago

I'm quite sure this kind of application is against Apple store rules and would be banned if published: 2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps. Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. Such apps must make the source code provided by the Application completely viewable and editable by the user.

qubex 7y ago
That’s why it’s released through TestFlight.
saagarjha 7y ago
It's up in the air, since Apple's guidelines are not consistently interpreted or enforced. It has, however, been approved to be on TestFlight thus far. (Which has little bearing on whether it will continue to be available, or if it will ever pass App Store review.)
Wingy 7y ago
It stays within the container. It just emulates alpine linux. It's a VM. If that weren't allowed, how is Pythonista on the app store?
- saagarjha 7y ago
  Pythonista readily lets you inspect the code you’re running, since it’s just a Python script.

classified 7y ago

Yummy. Does it have a C compiler?

saagarjha 7y ago
If you install one: app add gcc

chc4 7y ago

I recommend people check the GitHub readme for a good laugh too :)

monkin 7y ago

Is there an option to switch ESC with Tab?

saagarjha 7y ago
With tab? No. But on iOS 13.4 you can remap caps lock.

cosmiccatnap 7y ago

Now if only you could just install Linux directly to your laptop you wouldn't need a Mac at all

madushan1000 7y ago

It looks interesting, great work! I'm curious why you chose x86 emulation instead of arm emulation though, provided that this is running on an arm processor?

qubex 7y ago
I’m not the author.
saagarjha 7y ago
Not the author, but I did write the FAQ entry for this: https://github.com/tbodt/ish/wiki/FAQ#q-why-does-ish-not-emulate-arm-or-some-other-architecture https://github.com/tbodt/ish/wiki/FAQ#q-why-does-ish-not-emu...
- fragmede 7y ago
  The FAQ answer only answers one very specific aspect of things. The broader question is that emulating a foreign chipset (especially one as complex as x86), in order to have a local terminal, is ridiculous. Why be so ridiculous? The answer is that it has to be that way, due to Apple's restrictions on what is allowed to run, so iSH is a very clever hack on top of those restrictions, in order to get a "blessed" local unix environment on an iOS device.
  - saagarjha 7y ago
    Fewer people asked that question, so it never got added. Feel free to add it yourself if you think you have a good answer.
zozbot234 7y ago
In practice, RISC-V emulation would likely show better performance than either x86 or ARM. Though Alpine support for that architecture is not there yet, so I can see why ISH isn't using it at this time.

KiDD 7y ago

I've loved watching this app grow from the beginning in TestFlight to what it has become now!

sigjuice 7y ago

Apple should officially expose the Unix underneath so ARM homebrew can be a possibility.

todd3834 7y ago
If they did this I could do my job from an iPad Pro
techntoke 7y ago
It's called Android
- skavi 7y ago
  Android’s tablet ecosystem is dead.
headmelted 7y ago
This isn’t needed though. Chrome OS handles this quite gracefully by having container support baked in. You can just install whatever distro you need in the container and get rolling with it. It would make iPad Pro my perfect device (I’d replace my MBP in a heartbeat).
- josteink 7y ago
  ChromeOS can do that because it has already booted a Linux-kernel and the container is also a Linux-distro, so it’s essentially just a chroot. I.e. computationally really cheap. An iPad boots a (modified?) XNU kernel and can’t just “chroot” into a Linux-distro because the right kernel won’t be there to support the Linux userspace.
  - Hackbraten 7y ago
    > (modified?) By now, iPhones, iPads and Apple Watches boot XNU proper (meaning their kernel is no longer compiled from a fork but from the proper XNU code base). It’s still a modified kernel in a broader sense: platform-and architecture-dependent modules, ifdefs, a different set of kernel modules, exclusive/missing system calls and other extraneous/missing features (e. g. no kext loading infrastructure).

deeblering4 7y ago

There are a couple interesting choices that I'd like to understand the reasoning for: * The shell runs as root as soon as you open it, why not a use less privileged user and sudo? * There are getty processes running on tty[1-6] what is the purpose of this?

tbodt 7y ago
iSH author here. Answer to both: because that's how the Alpine Linux minirootfs image is set up.

headmelted 7y ago

ISH makes me happy and frustrates me in equal measure. On one hand, it’s exactly what I want on iOS in terms of a shell and Posix sandbox. On the other, it forces x86 emulation on me that I don’t want. If ISH could just give me an aarch64 environment without QEMU at all I’d be in love.

nneonneo 7y ago
The biggest problem is that iOS completely bans executing native code that isn’t code signed, with the sole exception of the Safari JIT (and possibly Swift Playgrounds - not sure how that works). There’s weird hacks to get around this, e.g. a JIT compiler that compiles native code into ROP chains that jump around gadgets precompiled into your native binary, but otherwise there’s really no way to run arbitrary CPU-native code. Hence, the emulator. And if you have to emulate the CPU, you might as well emulate the most popular CPU for compatibility.
- saagarjha 7y ago
  Swift Playgrounds has the com.apple.private.amfi.can-execute-cdhash entitlement, which allows it to dynamically load unsigned code.
hsitz 7y ago
In other words, at least as I would say it: iSH is slow.

dang 7y ago

Related from 2018: https://news.ycombinator.com/item?id=18421016 https://news.ycombinator.com/item?id=18421016

saagarjha 7y ago
Also a previous submission of the website, a day later: https://news.ycombinator.com/item?id=18430031 https://news.ycombinator.com/item?id=18430031

ezequiel-garzon 7y ago

I love this, got removed due to inactivity and am lazy enough to not bug anybody with an email. Does anybody know why they don’t offer this as an app? I’m sure people would be willing to pay quite a bit for it.

evanextreme 7y ago
As far as I'm aware, they're still working on bugs and it's not ready for release
- ezequiel-garzon 7y ago
  Thanks, such a shame... It feels way less buggy than plenty of paid apps.

rcarmo 7y ago

iSH is pretty great. I've been using it for a while, and (even with all its shortcomings) it really drives home the point that the iPad (even the Mini 5) is a beast of a machine.

nneonneo 7y ago

Apple is in a bit of an odd place right now with respect to development and end-user programming. Ever since they released Swift Playgrounds they’ve seemingly decided to be much nicer to programming apps. Pythonista is probably the most prominent such app, with deep integration with iOS features and full access to every API (thanks to ctypes you can even dlopen private APIs and use them...shhh). But there are some new ones too, like Play.js (full node.js environment), Scriptable, and probably dozens of others that I haven’t tried. It’s a bit of an interesting time. The real question will be whether Apple continues the slow path towards openness or whether they choose to go back to locking things down. I suspect their push to make the iPad more “pro” will inevitably force them towards the former.

mark_l_watson 7y ago
Pythonista is really very good, and it is easy to pip install pure Python libraries. Too bad Python is not one of my favorite languages. The Raskell app used to provide a decent Haskell environment in iOS, but, file access stopped working. Really too bad since it was fun to hack Haskell on airplanes, etc. Swift Playgrounds on iOS are very interesting and makes me wonder if XCode might someday live in iOS, with appropriate code sandboxing. Apple has made iOS and macOS app development much simpler with SwiftUI, simple enough that I enjoy using it. I think Apple will jump through hoops in the coming years to make app development easier.

miguelmota 7y ago

I just noticed that there's a word counter badge on the ISH github README that counts how many times the word fuck shows up in the codebase https://github.com/tbodt/ish https://github.com/tbodt/ish

miguelmota 7y ago

I get 'The beta is full' when clicking on the TestFlight link.

mmcwilliams 7y ago
If you have an Apple developer account the app is relatively simple to build and install with your own profile.