16 ms·
macOS in QEMU in Docker
- maliker 6y agoNow if we could just get a windows docker container running on unix hosts I could debug my cross-platform support.
- yjftsjthsd-h 6y agoI mean, this is just a VM in a container, so you could totally make an equivalent running NT rather than Darwin in the VM.
- joshlk 6y agoDoes this break the user agreement for macOS?
- jdboyd 6y agoOnly if you do it on a non-Apple comoputer. If you install linux on your mac, then follow the guide I believe it should be fine.
- lostlogin 6y agoThe agreement is pretty vague on the subject but it seems that you can get permission to virtualise on non-Apple hardware. How one does this and if anyone ever has is another matter entirely.
- jedieaston 6y agoApple does it internally, since they can turn off the mechanisms that stop macOS from booting on non-Apple hardware (last I heard on HN, they ran it on HP workstations?). I'd imagine that if you got JAMF, Adobe, and Microsoft in a room one of them has the magic incantation as well, considering the amount of Mac code they put out.
- ac29 6y agoNot a lawyer, etc, but I read this as requiring the VM to be run on macOS host: allowed "to install, use and run up to two (2) additional copies or instances of the Apple Software within virtual operating system environments on each Mac Computer you own or control that is already running the Apple Software" https://www.apple.com/legal/sla/docs/macOSCatalina.pdf https://www.apple.com/legal/sla/docs/macOSCatalina.pdf
- mindfulhack 6y agoIANAL either, and also I only read that PDF for a minute, but: maybe the Apple firmware running on the motherboard, a T2 chip etc, can satisfy the requirement that it is a computer "already running the Apple Software", even with Linux as the host OS. I think "the Apple Software" carries broad meaning in that agreement (and not very exclusive in its definition), e.g. clause 1: "The Apple software (including Boot ROM code)"... ?
- hunter2_ 6y agoThe definition is broad (and self-referential, oddly): The "Apple software" is defined as "The Apple software (including Boot ROM code), any third party software, documentation, interfaces, content, fonts and any data accompanying this License" If a subset such as "Boot ROM code" on the VM host was sufficient to allow for using "Apple software" beyond said subset in VM guests, then any other subset (such as "fonts") would also have to be sufficient, and no reasonable person would agree with such a thing. Therefore, it follows that the _entirety_ of "Apple software" must be "already running" on that "Mac Computer" before booting any VM guests that use "Apple software." This interpretation is supported by the use of the word "and."
- mindfulhack 6y agoUpon second look, it would seem that the spirit of what they mean by "the Apple Software" is 'the whole set of standard Apple software (that comes pre-installed on the Apple machine'. But actually, even more strongly in favour of interpreting that they don't specifically license macOS for use on a Linux host via their agreement, is the syntax of 2.B.iii itself (italicisation for emphasis): > [you are granted a license] to install, use and run up to two (2) additional copies or instances of the Apple Software within virtual operating system environments on each Mac Computer you own or control that is already running the Apple Software" Their clear syntax of repeating "the Apple Software" in the context of both guest and host environment indicates that what is used virtually must also be used on the host. Additionally, you probably couldn't get out of it by dual booting with Linux and saying that 'aha, see, I have mac running on the host machine I'm fine', the grammar of the words "that is already running" indicates that macOS must be running while using macOS as a guest, under their license. I can't imagine any serious legal implications that really matter apart from to major corporation making major money off virtualising macOS somehow. To anyone else or any other angle relating to it, I don't think there's any worry whatsoever. It appears the Hackintosh community hasn't been sued into oblivion...
- sjburt 6y agoIt's hard to see what Docker is adding here since qemu is being run inside Docker. You could get almost identical functionality out of a bare VM image and not deal with the hassles of docker.
- qayxc 6y agoIt's a hammer problem. Docker is the new hammer and now everything starts to look like nails.
- lostlogin 6y agoLuckily, a lot of the things are nails. The number of applications you can keep neat and tidy with a fleet of containers is so great. Even a relative novice can get some great things working by poking about a few guides. And when it all breaks you can start again without too much collateral damage.
- qayxc 6y agoI'd argue that I was able to do the exact same thing 20 years ago using VMWare Workstation - download a VHD image with OS and app(s) pre-installed and configured, optionally map to a drive on the host OS and get started instantly... Maybe I'm too old to get the appeal of "a fleet of containers" in place of a single (and potentially throw-away) VM image along with maybe even a vagrant-script to make it easily reproducible... ¯\_(ツ)_/¯
- lostlogin 6y agoI’m going to look at this, thank you.
- hamandcheese 6y agoThe difference is tooling, particularly "just works out of the box" tooling.
- 6y ago
- sequoiar6868 6y agoamazing project
- miles 6y agoMore info on the project in this reddit thread from a few hours back: https://www.reddit.com/r/jailbreak/comments/gwg3e4/free_release_dockerosx_run_xcode_on_linux_sign/ https://www.reddit.com/r/jailbreak/comments/gwg3e4/free_rele... The developer mentions[0] that, like macOS-Simple-KVM[1], this leverages kholia's OSX-KVM[2]. [0] https://www.reddit.com/r/jailbreak/comments/gwg3e4/free_release_dockerosx_run_xcode_on_linux_sign/fsuz29i/ https://www.reddit.com/r/jailbreak/comments/gwg3e4/free_rele... [1] https://github.com/foxlet/macOS-Simple-KVM https://github.com/foxlet/macOS-Simple-KVM [2] https://github.com/kholia/OSX-KVM https://github.com/kholia/OSX-KVM
- flexvision 6y agoEdit: Okay, I understand my assumption was wrong. Thanks Doesn't docker run a container in a single thread? So this would be running the entire MacOS in a single thread? Is there a way to tell Docker to execute this in multiple threads?
- skrebbel 6y ago> doesn't docker run a container in a single thread? No, it doesn't.
- 0xcoffee 6y agoNobody would be using docker is that was the case. Spawn as many processes and threads as you want.
- parhamn 6y agoA wild WASM appears. I joke but you get it.
- ecnahc515 6y agoNo, that isn't how containers work. Containers run processes, as many as you want, each which can use as many threads as they (up to ulimits). Most hypervisors will allocate 1 thread per virtual CPU core by default, and since this is using qemu with KVM then that's likely the case. Looking at the Dockerfile in the OP, you can see it's using https://github.com/kholia/OSX-KVM/blob/master/OpenCore-Boot.sh https://github.com/kholia/OSX-KVM/blob/master/OpenCore-Boot.... as the script to start the VM, and you can see the -smp 4,cores=2 in the qemu arguments which configures how many threads/cores/sockets to assign to the guest. Though I'm not entirely familiar with the syntax so I'm not sure what the "4" is for, but I'd guess threads.
- orionblastar 6y agoYou can read the main Github page here: https://github.com/kholia/OSX-KVM https://github.com/kholia/OSX-KVM It only works on Macs, it needs the toolchain and ROM I guess? Docker is just one step closer to porting it on the Windows and Linux platforms. Personally, if I wanted to run MacOSX that badly, I'd buy a Mac Mini or the lowest-priced Mac they have. Much easier and worth it for the AppleCare and Warranty. Edit: grammar and spelling.
- MuffinFlavored 6y agoDoes it have to be a Linux host? Can it be a Mac OS X host?
- amaccuish 6y agoI'm pretty sure since Docker uses bhyve on mac, so that would be a nested VM...
- lostlogin 6y agoI misunderstood the angle this thread was taking - I thought the OP was going to ask if the Dockered MacOS could run Docker. I was just reading up on Rancher OS, but that’s a containerisation too far at this time in the AM.
- sigjuice 6y agoDocker has their own xhyve derivative called hyperkit. Nested VMs are not supported https://github.com/moby/hyperkit/issues/127 https://github.com/moby/hyperkit/issues/127
- chrisgacsal 6y agoIf I am not mistaken then xhyve and hyperkit are separate projects utilizing the same Hypervisor Framework from Apple under the hood.
- lloeki 6y agohyperkit is a fork of xhyve, plus stuff like bridges between inotify and kqueue/fsevents, or transparent tcp port forwarding. Hypervisor.framework is an API to execute hypervised code, to build virtualisation engines that can run unprivileged; you still have to write an actual virtual machine.
- lloeki 6y agoYou can use Docker Machine and whatever backend you want, including xhyve, VirtualBox, and VMware Fusion, and enable nested virtualisation in the created machine.
- etaioinshrdlu 6y agoSo this is pretty misleading. It's really a full system emulator (qemu) running inside Docker, using root privileges on the container that make the isolation very weak (--privileged). It also uses hardware assisted virtualization (KVM) which is not going to be available most of the time Docker is. You can think of the Docker platform itself as subset of the Linux platform. With many common features removed by default... SYS_PTRACE, cgroups come to mind as not allowed within the container. (This "Docker as a subset of Linux" is also what you end up getting from most "Docker as a service" platforms offered by clouds, including kubernetes. I'm referring to AWS Fargate, Google Cloud Run, GKE, AKS, here.) So don't think of this as macOS in docker wherever docker runs. What would be a lot more analogous to macOS in docker would be running Darling in docker: https://www.darlinghq.org/ https://www.darlinghq.org/ ... if that could be made to work for the entire system (highly unlikely) Darling is more like Wine in that it runs native executables for one platform as native processes on another platform using a compatibility layer. Wine, by the way, definitely works quite well inside Docker. Also, one final thought. I wonder if you could get macOS to boot in QEMU without hardware assisted virtualization. Then you could probably run this in a fully isolated container again. The performance would likely be abysmal though!
- tutfbhuf 6y agoWell the title: "A full system emulator (qemu) running inside Docker, using root privileges on the container that make the isolation very weak" would be a bit to long for HN, what do you think?
- etaioinshrdlu 6y agoWe are a bunch of pedantic nerds here though. How about "macOS in QEMU in Docker"?
- AshamedCaptain 6y agoThat would not be as clickbaity! Why would you do that?
- joshgel 6y agoDoes it run iMessage on Windows?
- cercatrova 6y agoI just want a good CI/CD system for macOS to build iOS apps without needing to buy a farm of Mac Minis, or even buy a Mac, is that too much to ask?
- kccqzy 6y agoYou can rent Mac servers instead of buying them.
- nine_k 6y agoThe typical answer is paying to those who do that for you, like Travis. And yes, too much to ask. Apple's principal revenue source is selling hardware. They don't care if developing for their platform is not cheap; they explicitly target the premium segment, and are never uncomfortable with their well-known large margins.
- deathanatos 6y agoApple doesn't care if developing for their platform is a PITA. The existence of companies like MacStadium filling rooms with Macs just to bend over backwards for inane license terms proves the paid demand is there. Apple could offer to license their OS for use not on Apple hardware — for a fee. They don't. The objection isn't to the price; the objection is that needing to manage physical hardware (as opposed to spinning up VMs like in the article) is a PITA to manage, comparatively. Companies would — and do — pay to not need to deal with that pain, but it would be a lot less painful to not need to get a third party involved / to be able to make use of the infra I have without having to stuff some Macs into a closet and wonder how I'm going to make that redundant.
- GordonS 6y agoAzure DevOps has hosted MacOS build agents, which you can use on the (generous) free tier.
- benbristow 6y agoAlthough it's slowly being migrated to GitHub (though they won't officially admit it), DevOps is a great service with a lovely UI. The pipeline docs are somewhat lacking though IMHO but once you get them working, they work great.
- tarkin2 6y agoOT: Has anyone Found virtualization really resource in the latest OS X? It was eating up 25 percent of my RAM doing nothing. Both Docker and Vagrant were so resource hungry that I ended up ditching them.
- JaggedNZ 6y agoThe last version of Docker for Mac had some big resource issues, current latest version seems to be better, but still makes my 2017 MBP into a grill when running multiple containers.
- benologist 6y agoCan macOS virtual machines ever be performant enough to use as a workstation? So far I have only tried setting it up in VMWare and VirtualBox, the performance wasn't there but I haven't dedicated a GPU or drive to it yet. It would be so convenient to decouple macOS from Mac hardware.
- mjayhn 6y agoThe problem is cocoa performs terribly without gpu acceleration and nobody has figured out how to get around that, there are some tweaks to get OSX running in vmware and wherever else but you never wind up with working GPU acceleration so not only can you not change the resolution once you turn it on (iirc, may be wrong here), it's refresh rate is horrendous. If you ever used Windows before it installs the gpu drivers where the window manager is all weird and unoptimized and glitchy, it's that but worse. It's been a long time since I played with macos vfio passthru stuff but maybe that's a way around it nowadays. There's a little /r/vfio community that tries to tackle it pretty frequently. Hopefully someone else has more recent details than me, I'm back to using osx hardware now that the 16" mbp lets me have 32gb.
- schlopper 6y agoQEMU/KVM/VFIO has come a long way. If you have a MacOS-supported GPU and working IOMMU (AMD) or VT-d (Intel), then you can achieve near-native MacOS performance for your CPU/GPU combo.
- PaulDavisThe1st 6y agoI run macOS (currently Mojave) on a 8 core, 16GB KVM on top of Debian on a 16 core 64GB Ryzen. It's faster than the (older) Mac Mini I used to use for everything I've tried on it. I don't know how it compares to current apple hardware, but for my purposes (doing the bits of macOS-specific code development in a large native cross-platform application), it's about as perfect as it gets.
- thepiwo 6y agomy container got the name "silly_torvalds" do you want to tell me something Linux Kernel?
- mister_hn 6y agoOh yes, finally. With this, you can do pretty everything
- self_awareness 6y agoThey should put it on zombo.com
- ianmobbs 6y agoCould this be used to run an iMessage proxy on a server?
- hosh 6y agoDoes this mean I can run Xcode to do iOS and Unity builds on a Linux host?
- read_if_gay_ 6y agoYes. But for testing on actual devices I am pretty sure you need a spare USB controller to pass through. When I tried a few months ago, there was no other way to connect USB devices.
- williesleg 6y agoWhat a waste.
- miguelmota 6y agoHas anyone had success running the docker image on Arch? I ran into some issues but wondering if it's me or the instructions
- miguelmota 6y agoIssue resolved https://github.com/sickcodes/Docker-OSX/issues/7 https://github.com/sickcodes/Docker-OSX/issues/7
- ChrisRR 6y agoHow well does this run? OSX runs like molasses in Virtualbox under Windows/Linux
- paulcarroty 6y agoWorks much faster with qemu-kvm.
- Dilu8 6y agoLrnix os is best on macOS
- 867-5309 6y agoon the model of "Hackintosh", I am inclined to propose "Dockintosh"
- acd 6y agoGreat work! I would add a disclaimer that you should only run this on Mac hardware. Ie you can run Arch on mac hardware. Get an old mac and point to it if someone asks.
- wdb 6y agoI have always wondering how Azure, BrowserStack and such support Safari or macOS. Do they have custom licensing with Apple to allow to run it virtualised or are they actually running it on Macs? If I remember correctly you can only run macOS on their hardware.
- fellovv 6y agoThis was done by SpaceInvader for the UnRAID docker community months ago. As stated, it is just streamlining a process that has been available with KVM-OSX with various bash scripts for months or years before that.