7 ms·
So this is pretty misleading. It's really a full system emulator (qemu) running inside Docker, using root privileges on the container that make the isolation ve
by etaioinshrdlu 6y ago
So this is pretty misleading. It's really a full system emulator (qemu) running inside Docker, using root privileges on the container that make the isolation very weak (--privileged).
It also uses hardware assisted virtualization (KVM) which is not going to be available most of the time Docker is.
You can think of the Docker platform itself as subset of the Linux platform. With many common features removed by default... SYS_PTRACE, cgroups come to mind as not allowed within the container. (This "Docker as a subset of Linux" is also what you end up getting from most "Docker as a service" platforms offered by clouds, including kubernetes. I'm referring to AWS Fargate, Google Cloud Run, GKE, AKS, here.)
So don't think of this as macOS in docker wherever docker runs.
What would be a lot more analogous to macOS in docker would be running Darling in docker: https://www.darlinghq.org/ https://www.darlinghq.org/ ... if that could be made to work for the entire system (highly unlikely)
Darling is more like Wine in that it runs native executables for one platform as native processes on another platform using a compatibility layer. Wine, by the way, definitely works quite well inside Docker.
Also, one final thought. I wonder if you could get macOS to boot in QEMU without hardware assisted virtualization. Then you could probably run this in a fully isolated container again. The performance would likely be abysmal though!
- tutfbhuf 6y agoWell the title: "A full system emulator (qemu) running inside Docker, using root privileges on the container that make the isolation very weak" would be a bit to long for HN, what do you think?
- etaioinshrdlu 6y agoWe are a bunch of pedantic nerds here though. How about "macOS in QEMU in Docker"?
- AshamedCaptain 6y agoThat would not be as clickbaity! Why would you do that?
- tomrod 6y agoHonesty > Clickbait <3
- dang 6y agoDone! Changed from "macOS in a Docker Container".
- compsciphd 6y agoits using docker as an artifact delivery mechanism, not as an isolationism mechanism.
- ronsor 6y agoHonestly that's kind of yikes. That probably just adds extra complexity, and there are better ways to deliver VMs.
- MiroF 6y ago> there are better ways to deliver VMs For the curious - what are they?
- flatiron 6y agoNot op but they probably mean vagrant?
- brutal_boi 6y ago0PeNStaCk
- paulfurtado 6y agoIf you have container orchestration in place, being able to use it to run VMs via qemu is actually incredibly useful and isn't really much of a yikes. Sure, you're losing the container's isolation features, but you have a VM there, which is even stronger isolation. We do CI for our VM images in our kubernetes clusters. The build system already was in kubernetes, so putting the OS image testing in there was a big win. The benefit of doing this is also that on a personal machine you can start playing with an OSX vm with a single docker run command with no other dependencies and many people already have docker setup, whereas standardized qemu/virtualization tooling is now much less common on developer machines
- slimsag 6y agoI work at Sourcegraph and have been considering something like this for a while for running long-running jobs, things like CI pipelines and GitHub actions for example. How would you feel about an app like GitLab, for example, shipping a docker container that required privileges for this, I wonder?
- m463 6y agoI think "docker" is an ambiguous term nowadays. Depending on your point of view, it could denote a container, or source control, or a sort of makefile. To me it is a reproducible recipe in 43 lines of Dockerfile text.
- AshamedCaptain 6y agoThis thing is basically a bash script that runs the package manager of a distro pointing to the latest package feed; not even a specific stable version or anything like that. It also depends on host kernel features such as KVM settings and hardware such as CPU (good luck on AMD) much more than whatever is packaged on the container. This is about as "reproducible" as replaying my .bash_history on a different machine. I would bet that before the end of this year this script no longer works.
- yjftsjthsd-h 6y agoOkay, I know how docker can mean containers, and I agree that Dockerfiles are quite similar to makefiles, but how does docker relate to source control?
- m463 6y agoDocker keeps a history of changes to the container with layers, and you might arguably treat it like version control. maybe "docker history" ~ "git log"?? tags=branches? Docker isn't one thing, so it's ALL grey. It's not really make. It's not really a vm. It's not really even reproducible. One thing is for certain - it's hard to describe docker to new folks so they get it. "it's sort of like netflix, for cows, but in space..."
- Denvercoder9 6y agoThat's the most insane use of Docker I've ever heard of.
- m463 6y agoI'm not saying people use it for vc, it's how docker works. It optimizes your containers using layers and if you do "FROM ubuntu:18.04" in 3 dockerfiles, you only have one copy of the ubuntu stuff.
- userbinator 6y agoI have run MacOS in QEMU in emulation mode, that was around the time of the first Hackintoshes. You're right, it was very slow (on the hardware of the time.)
- hinkley 6y agoI don't care though. What I care about is that it's a pain in the butt to do CI/CD pipelines for an application with iOS/OSX support. So if someone has a headless OS X contraption on offer, I want to hear some more about it. The last time I set this up, a manager decided he wanted a laptop like the rest of us instead of the iMac he got. He asked semi-jokingly if someone wanted the machine for anything and I said "Yes, I do" before he even got the sentence out. There was just enough memory on the machine for me to set up a few Jenkins agents on it, one for Safari, the rest using the Selenium-maintained docker images.
- dahfizz 6y ago> So if someone has a headless OS X contraption on offer, I want to hear some more about it. This project relies on OSX-KVM, which is a thing that already exists. The dockerization of that project (what this post is about) is a gimmick as described by GP.
- kogepathic 6y agoI was so excited when I read: > This Dockerfile automates the installation of OSX-KVM inside a docker container. Except it automates the fetching of the macOS installation media and launching qemu, which is exactly what OSX-KVM already does. [1] This project does nothing additional to automate the actual installation of macOS inside the VM. I wish Apple supported installation automation like Microsoft does with sysprep (or Linux with kickstart/preseed). The best I've found is Arduino USB devices that pretend to be a keyboard and mouse to manually advance the installer, which is super lame "automation" [1] https://github.com/kholia/OSX-KVM/blob/master/OpenCore-Boot.sh https://github.com/kholia/OSX-KVM/blob/master/OpenCore-Boot....
- dahfizz 6y ago> The best I've found is Arduino USB devices that pretend to be a keyboard and mouse to manually advance the installer, which is super lame "automation". Definitely not great as an actual process, but this sounds like a super cool project!
- 6y ago
- nunez 6y agoIt's also been done before: https://github.com/kholia/OSX-KVM https://github.com/kholia/OSX-KVM
- m463 6y ago(that's referenced right there in the readme)
- saurik 6y ago(Darling requires a kernel module, which also isn't a thing you are able to do in the context of Docker as you are often just working with the host kernel.)
- etaioinshrdlu 6y agoWow! This is highly surprising and is totally unusual! They're embedding parts of the XNU kernel in Linux. I can imagine this was done as a last resort as there is pretty much no chance this will ever get upstreamed, not just because of licensing, but also simply just strangeness.
- fulafel 6y agoKVM will be available if you run Docker natively on your laptop, or if your docker-on-VM setup supports nested virtualization - I think these are pretty common setups?