11 ms·

Vftool runs Linux virtual machines in macOS Big Sur

195 points by syrusakbary 6y ago

ultrarunner 6y ago
> The bridging requires the binary to have the com.apple.vm.networking entitlement, and Apple docs helpfully give this note: >> Note This entitlement is restricted to developers of virtualization software. To request this entitlement, contact your Apple representative. I have not done development in Xcode for some time, but the first thing I wanted to do for an internal project was hamstrung by restricted entitlements. Luckily, it was just an experiment, but it makes it feel like this is coming up a lot. Is there still a way around this (i.e. to run your own code on macOS) ? This isn’t the first time I’ve seen a project based around Virtualization.framework; that’s both exciting and disconcerting. Issues like entitlement deals (that I will never be able to obtain) make the wide open path forward look a lot like a narrow track, the direction of which only Apple controls.
- djxfade 6y ago
  I feel like unless you are one of the bigger players, you never get a reply. I work for a company that develop apps, and we got into a situation where we had a need to be able to disable NFC temporarily, because Apple Pay was triggering when it shouldn't (on a ticket scanning gate). Hidden deep in an obscure doc, I found a notice about a special entitlement you could request by emailing the Apple Pay support team. Emailed them two times over the last two years, never even got a reply
  - afandian 6y ago
    Apple customers surrender their phones, and experiences, to Apple's custody. That walled garden is discussed every day here. But I wonder how much 'normal' Apple consumers realize how shoddy some of that custody really is. I bet your customers blamed you for that bug, not Apple?
    - pyr0hu 6y ago
      Of course they gonna blame the creator of the app, not Apple. The customer has no idea about the development and what entitlements are available or not. Why should they blame Apple, I don't understand your point. As the creator, notify your users about it and there you can blame Apple as long as you want. But if the users are not notified, they don't really know that the creators are waiting for Apple.
  - alfanick 6y ago
    As an user I literally run into this usecase: Germany, local bus company, I've run out of cash, so I just bought online ticket via Deutsche Bahn app (it's a QR code). When you enter the bus, you need to scan this QR code, but for some stupid/smart reason Apple Pay triggers and hides this screen, and of course when you try to debug Apple Pay screen is gone, QR code is back. Trying to explain to the bus driver that this was some stupid Apple Pay interaction was quite an experience. Lesson learned: make sure to always have some spare coins with you.
    - tuxone 6y ago
      Maybe the QR code scanner and the NFC POS have been installed in a poor way that make the two options collide. Since QR code could be provided from general purpose apps (browser, photo gallery) there is no software solution to this.
    - aeontech 6y ago
      Hey, I may know some people who’d be very interested in these failure modes on the team. Which bus company? Any chance you know what terminal they use? Would you mind getting in touch off HN to discuss further?
      - lucasverra 6y ago
        Same problem in France, public train company SNCF. All year long I had to ask the (human) controllers to open the glass barrier supposed to be opened with a QR scanner in the gates. Same flawed workflow. Show QR to scanner => not work => check phone on apple pay mode with credit cards => repeat => ask the (human) controllers. You can ping me @ lucas@concpt.io
      - xmodem 6y ago
        I have encountered the same problem with the tunnelbana in Stockholm. Normally I use a card, but on a few occasions I have left it at home or forgotten to top it up, and bought a ticket with the app. When it wasn't scanning and I took my phone off the scanner, I briefly glimpsed the Apple Pay screen before it animated away, so I realised I was "holding it wrong", and was able to get it to scan by holding it at a different angle to keep the NFC sensor at the top of the phone away from reader, but I can imagine a less technically minded user than myself might have serious problems. I don't know anything about the scanner or NFC standards used by this system, sorry.
  - aeontech 6y ago
    @djxfade: I might know some people on the team who’d be very interested to hear about it. what’s the best way to get in touch?
    - saagarjha 6y ago
      Unrelated question as an outside observer: how is it possible to get interactions like these as opposed to "file a feedback"?
    - djxfade 6y ago
      Hi, you can contact me on thomas(at)apility(dot).no
  - tomduncalf 6y ago
    I recently learned about the "technical support incident" help you can get from Apple, you get two such incidents included with your annual developer program - maybe worth a go, I believe they respond to you quite quickly from what I've heard: https://developer.apple.com/support/technical/ https://developer.apple.com/support/technical/
- derefr 6y ago
  > Is there still a way around this (i.e. to run your own code on macOS) ? In Big Sur I’ve noticed there’s now a “Developer Tools” entitlement in Privacy. I’m not sure exactly what it allows executables to do, but as it starts off with Terminal.app as a suggested entry, I’d assume it at least allows the given app to spawn unsigned binaries.
  - saagarjha 6y ago
    I think this lets apps ignore things like quarantine and data vaults.
- eecc 6y ago
  Besides a cunning and evil plan to gradually restrict user freedom (/s) I can also imagine this is meant to control an OS feature that can be used to nestle some pretty audacious privacy-violating software, away from the rest of the OS restrictions. Perhaps Apple will figure out some software control to sidestep this administration overhead, or just make it an xtra license to milk more money. After all Microsoft has been doing this since the beginning...
  - api 6y ago
    Yes. Freedom in computing is a very sharp double-edged sword. On one hand, it gives you control of your device and your computing world and lets you create anything you want. On the other hand, it lets malware and spyware take total control of your machine and steal all your personal data or extort you with ransomware. Security is always somewhat like that. It really wouldn't be that hard for a determined burglar to break into my house. I could make it a lot harder, but doing so would come at the expense of a great deal of my own convenience and even freedom. I don't want bars on my windows and I don't want to have to authenticate against a panel or app/keyfob every single time I enter or leave my home. My neighborhood has police and I live in a very civilized place. The Internet is an open war zone overrun with criminals and malicious privacy-invading corporations (and governments, and not just your own government) bent on subjecting you to a total panopticon. Computers must be secure in a much more hostile environment than my house or my car. A computer today must be more like a hardened compound in a failed state than a house in a typical developed world city or suburb. I've been saying "the Internet is a failed state" for a while. Apple with its locked down walled garden is like one of those private mercenary security armies that provide security to the rich in failed states.
    - progman32 6y ago
      In this example, I see Apple as one of those armies that only allows you to take groceries from their blessed vendors into the walls (some rumor about razor blades in fruit from the other shops?). They charge those grocery shops for this privilege. I don't disagree with the comment's observations, though I don't see a path to get to a "friendly" internet without sacrificing other important freedoms.
- marmaduke 6y ago
  I understand the concern, but this seems to derail the whole discussion of this lightweight tool supporting virtualization on m1/Big Sur.
  - ultrarunner 6y ago
    That was not my intention, but I can see how that would be the case. As I have seen several mentions of wrappers for Virtualization.framework, the common thread that jumped out to me was the continued march toward dependence on Apple’s provisions. I do hope that the rest of the thread continues to tend toward the merits of this particular tool.
    - marmaduke 6y ago
      yeah, I can see the topic being worth a blog post and a dedicated HN discussion, since there are pros and cons of locking things up like this.
- my123 6y ago
  For that specific entitlement, it's overridden by vmnet.framework if you call it from root. However, Virtualization.framework runs out of process, and Apple forgot to check for root if the entitlement isn't present. That should get solved soon.
- walrus01 6y ago
  > >> Note This entitlement is restricted to developers of virtualization software. To request this entitlement, contact your Apple representative. I can understand the desire, for convenience's sake of testing stuff quickly, to directly virtualize a guest linux OS on a developer's workstation laptop or desktop running MacOS. But that's an absolute non-starter for me. Contact your sales representative for an entitlement? Forget that, I'll keep on using Linux kernel based virtualization with either xen or kvm, and the equivalent of xen domU PV or HVM on a normal x86-64 server platform, controlled remotely from my laptop, thanks. The whole language in that sounds like they hired some MBAs away from Oracle.
  - marcan_42 6y ago
    Or you could wait until I port Linux to these Macs and then use KVM on that :-) (shameless plug) Seriously though, the machines are open, you can disable all the security to various degrees. The entitlement stuff is for deploying to vanilla Macs with all the codesigning requirements enabled (e.g. via the App Store), for security. It doesn't stop you from bypassing it on your own machines.
    - Wowfunhappy 6y ago
      If you disable SIP, iOS apps stop working. https://forums.macrumors.com/threads/if-you-disable-sip-all-you-ios-apps-will-stop-working-on-your-m1.2269661/ https://forums.macrumors.com/threads/if-you-disable-sip-all-... Your line was my line for a long time. But I feel like this is a significant step. For the first time, by taking control of your own device you’re loosing functionality.
      - new_realist 6y ago
        That’s because iOS devices are locked down for security. iOS apps are given a promise of a trusted computing base which must be kept. Otherwise your company, government or criminal gives you a MacOS laptop with SIP disabled and can now trivially circumvent the privacy protections built into all iOS devices, including for data sync’d over the cloud with your other secure devices.
- solarexplorer 6y ago
  I think this entitlement controls only the ability if you are not running as root. That makes perfect sense, because you don't want random user processes to be able to sniff your network traffic... > A Boolean that indicates whether the app manages virtual network interfaces without escalating privileges to the root user. https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_vm_networking?language=objc https://developer.apple.com/documentation/bundleresources/en...
  - dingaling 6y ago
    > I think this entitlement controls only the ability if you are not running as root. Indeed, but why can't it be granted by root?
    - solarexplorer 6y ago
      Well, if you don't care about security, you can always put the setuid bit on the binary (I suppose that would work?). I agree that the situation is not ideal, but at least you can run it on your own computer if you actually want to... In the past there were some bad actors doing shady stuff on iOS with this type of entitlement. I wonder if that influenced this type of restriction: https://guce.techcrunch.com/copyConsent?sessionId=3_cc-session_0a3a7fb3-fd15-41aa-8dba-83a7383b2990&lang=es-ES https://guce.techcrunch.com/copyConsent?sessionId=3_cc-sessi...
- johncolanduoni 6y ago
  Is it restricted for developer ID/notarized software, or just the App Store? The latter doesn’t surprise (or bother) me particularly, but if it’s the former it would be pretty surprising and annoying. In the past I’ve even used weird internal entitlements like the custom lisp sandbox directives just fine with signed binaries, though I haven’t tried to notarize them.
- rubatuga 6y ago
  Imagine if you wanted to run a Linux program with KVM support, and you had to ask Linus to enable a flag on your Linus ID Account.
  - pjmlp 6y ago
    Eventually even Linux will diverge from its idealistic roots as our generation has left the world of living.
- jamesfmilne 6y ago
  You can self-sign binaries to run on your own machine with the entitlement. You only need the entitlement from Apple if you want to distribute applications with the entitlement to other people.
marmaduke 6y ago
It's worth jumping directly to some issue comments, https://github.com/evansm7/vftool/issues/2#issuecomment-735455161 https://github.com/evansm7/vftool/issues/2#issuecomment-7354... as this doesn't seem to work right away for popular options, e.g. I tried the Alpine aarch64 net boot and nothing happens.
- marmaduke 6y ago
  I was then able to get Docker working with the Ubuntu VM (on m1)
  - theodric 6y ago
    Gosh, I hope the SSH performance is not representative of what the final products from VMware and Parallels will be. I've got about 750msec lag per keypress-- it's rather painful!
    - marmaduke 6y ago
      That's odd, I just booted it back up to check and ssh'd in, and there's no noticeable lag.
  - SkyLinx 6y ago
    Hi! Has the VM with vftool been stable for you? I have tried it for Docker but either I got kernel panics in the VM or performance was poor with multiple virtual cores.
- marmaduke 6y ago
  and in terms of speed, measured with scimark4, the VM is between rosetta2 and native.
brodo 6y ago
It would be great if Apple would add support for running OCI containers. Then most people would not need VMs.
- dan1234 6y ago
  How could you do that without running a Linux kernel?
  - vbezhenar 6y ago
    Implement Linux syscalls like Windows did.
    - mook 6y ago
      But Windows already gave up on that (WSL2 is VM-based, with a Microsoft-built Linux kernel); why would Apple go down that road?
      - mschuster91 6y ago
        Microsoft gave up on the syscall-emulation approach mostly because of filesystem performance issues - WSL1 uses the host NTFS filesystem for everything whereas WSL2 uses a backing ext4 disk image, which means that as long as one stays in the "Linux world" the performance is way better.
    - Qerub 6y ago
      That strategy did not work out well for WSL, so in WSL2 they chose to virtualize Linux instead: https://docs.microsoft.com/en-us/windows/wsl/compare-versions https://docs.microsoft.com/en-us/windows/wsl/compare-version...
      - wtallis 6y ago
        It's not hard to imagine that Linux binary compatibility might work out much better on macOS than it did on Windows, due to macOS already being a Unix. FreeBSD has been doing it forever, though I'm not sure what the current state is with regards to performance and completeness.
boris 6y ago
Virtualization.framework appears to provide Virtio disk, network, etc. I wonder how Apple did it: I doubt they could copy GPL code from qemu. Maybe they copied something from one of the *BSD implementations? If they have implemented it from scratch, I wonder how buggy it is? Anyone has any information on this?
- bartvk 6y ago
  I think Virtualization.framework lays on top of Hypervisor.framework, which Apple has included since Yosemite (released in 2014). So while I can't refute your suspicions, they would have had the time to implement it from scratch.
  - john_alan 6y ago
    I’ve been trying to understand the difference. Even have an open unanswered question on stack overflow. What’s the diff between Hypervisor and virtualisation frameworks? Docs are ambiguous.
Triv888 6y ago
wow, I am surprised Apple allows this
- ratww 6y ago
  Allow what? This is a public API: https://developer.apple.com/documentation/virtualization?language=objc https://developer.apple.com/documentation/virtualization?lan...
- bartvk 6y ago
  You will then be pleasantly surprised that the underlying Hypervisor.framework is used by Veertu in their Anka product. You can download and use it for free to virtualize macOS: https://veertu.com/download-anka-develop/ https://veertu.com/download-anka-develop/
dmix 6y ago
Seems interesting but far too immature for me to go anywhere near.
deleted 6y ago
[deleted]
jacobvosmaer 6y ago
I wonder how this compares to xhyve, which I use on Intel Mac. It's nice to see something like it for ARM. It appears xhyve is built on Hypervisor.framework while vftool is built on Virtualization.framework. Is that the main difference? What does that mean?
- jacobvosmaer 6y ago
  https://developer.apple.com/documentation/virtualization?language=objc https://developer.apple.com/documentation/virtualization?lan... https://developer.apple.com/documentation/hypervisor?language=objc https://developer.apple.com/documentation/hypervisor?languag... Looks like Virtualization.framework is newer (Big Sur only) and uses Objective C classes rather than C functions. I know from the xhyve README that it contains code responsible for booting a Linux kernel, which suggests Hypervisor.framework does not take care of that for you. The Virtualization.framework API on the other hand takes a linux kernel + ramdisk as its inputs. So it sounds like the framework vftool is built on is more high-level than that of xhyve, and like vftool is Linux-only.
  - johncolanduoni 6y ago
    Yeah, Hypervisor.framework is an analogue of KVM (i.e. just manual VM contexts, the caller needs to handle exits to provide virtual hardware). Virtualization.framework is closer to something like QEMU in library form.
- wiredfool 6y ago
  I’m using xhyve as well, but I’m having trouble getting it to boot newer kernels. 4.4 era works, (16.04) but 18.04 and 20.04 have various failures. I note that docker is built on xhyve and doesn’t seem to have this issue. So it’s not fundamental, but the fix hasn’t made it back to thx mostly abandoned xhyve.
  - jacobvosmaer 6y ago
    Ubuntu 18.04 (Linux 4.15) in xhyve works fine for me. I tried to get 20.04 set up a while ago but I gave up because its installer kept flaking out on me, something about the disk if I remember correctly.
anentropic 6y ago
https://twitter.com/Docker/status/1337163987641802752 https://twitter.com/Docker/status/1337163987641802752 > Releasing this week: > - Docker Desktop 3.0 > - Docker M1 Mac Technical Preview ...anticipation builds...
jwlake 6y ago
Do any of these solutions work for a thin mac on mac virtualization? Ideally opensource and not veertu. :)

195 points by syrusakbary 6y ago

> The bridging requires the binary to have the com.apple.vm.networking entitlement, and Apple docs helpfully give this note: >> Note This entitlement is restricted to developers of virtualization software. To request this entitlement, contact your Apple representative. I have not done development in Xcode for some time, but the first thing I wanted to do for an internal project was hamstrung by restricted entitlements. Luckily, it was just an experiment, but it makes it feel like this is coming up a lot. Is there still a way around this (i.e. to run your own code on macOS) ? This isn’t the first time I’ve seen a project based around Virtualization.framework; that’s both exciting and disconcerting. Issues like entitlement deals (that I will never be able to obtain) make the wide open path forward look a lot like a narrow track, the direction of which only Apple controls.

djxfade 6y ago
I feel like unless you are one of the bigger players, you never get a reply. I work for a company that develop apps, and we got into a situation where we had a need to be able to disable NFC temporarily, because Apple Pay was triggering when it shouldn't (on a ticket scanning gate). Hidden deep in an obscure doc, I found a notice about a special entitlement you could request by emailing the Apple Pay support team. Emailed them two times over the last two years, never even got a reply
- afandian 6y ago
  Apple customers surrender their phones, and experiences, to Apple's custody. That walled garden is discussed every day here. But I wonder how much 'normal' Apple consumers realize how shoddy some of that custody really is. I bet your customers blamed you for that bug, not Apple?
  - pyr0hu 6y ago
    Of course they gonna blame the creator of the app, not Apple. The customer has no idea about the development and what entitlements are available or not. Why should they blame Apple, I don't understand your point. As the creator, notify your users about it and there you can blame Apple as long as you want. But if the users are not notified, they don't really know that the creators are waiting for Apple.
- alfanick 6y ago
  As an user I literally run into this usecase: Germany, local bus company, I've run out of cash, so I just bought online ticket via Deutsche Bahn app (it's a QR code). When you enter the bus, you need to scan this QR code, but for some stupid/smart reason Apple Pay triggers and hides this screen, and of course when you try to debug Apple Pay screen is gone, QR code is back. Trying to explain to the bus driver that this was some stupid Apple Pay interaction was quite an experience. Lesson learned: make sure to always have some spare coins with you.
  - tuxone 6y ago
    Maybe the QR code scanner and the NFC POS have been installed in a poor way that make the two options collide. Since QR code could be provided from general purpose apps (browser, photo gallery) there is no software solution to this.
  - aeontech 6y ago
    Hey, I may know some people who’d be very interested in these failure modes on the team. Which bus company? Any chance you know what terminal they use? Would you mind getting in touch off HN to discuss further?
    - lucasverra 6y ago
      Same problem in France, public train company SNCF. All year long I had to ask the (human) controllers to open the glass barrier supposed to be opened with a QR scanner in the gates. Same flawed workflow. Show QR to scanner => not work => check phone on apple pay mode with credit cards => repeat => ask the (human) controllers. You can ping me @ lucas@concpt.io
    - xmodem 6y ago
      I have encountered the same problem with the tunnelbana in Stockholm. Normally I use a card, but on a few occasions I have left it at home or forgotten to top it up, and bought a ticket with the app. When it wasn't scanning and I took my phone off the scanner, I briefly glimpsed the Apple Pay screen before it animated away, so I realised I was "holding it wrong", and was able to get it to scan by holding it at a different angle to keep the NFC sensor at the top of the phone away from reader, but I can imagine a less technically minded user than myself might have serious problems. I don't know anything about the scanner or NFC standards used by this system, sorry.
- aeontech 6y ago
  @djxfade: I might know some people on the team who’d be very interested to hear about it. what’s the best way to get in touch?
  - saagarjha 6y ago
    Unrelated question as an outside observer: how is it possible to get interactions like these as opposed to "file a feedback"?
  - djxfade 6y ago
    Hi, you can contact me on thomas(at)apility(dot).no
- tomduncalf 6y ago
  I recently learned about the "technical support incident" help you can get from Apple, you get two such incidents included with your annual developer program - maybe worth a go, I believe they respond to you quite quickly from what I've heard: https://developer.apple.com/support/technical/ https://developer.apple.com/support/technical/
derefr 6y ago
> Is there still a way around this (i.e. to run your own code on macOS) ? In Big Sur I’ve noticed there’s now a “Developer Tools” entitlement in Privacy. I’m not sure exactly what it allows executables to do, but as it starts off with Terminal.app as a suggested entry, I’d assume it at least allows the given app to spawn unsigned binaries.
- saagarjha 6y ago
  I think this lets apps ignore things like quarantine and data vaults.
eecc 6y ago
Besides a cunning and evil plan to gradually restrict user freedom (/s) I can also imagine this is meant to control an OS feature that can be used to nestle some pretty audacious privacy-violating software, away from the rest of the OS restrictions. Perhaps Apple will figure out some software control to sidestep this administration overhead, or just make it an xtra license to milk more money. After all Microsoft has been doing this since the beginning...
- api 6y ago
  Yes. Freedom in computing is a very sharp double-edged sword. On one hand, it gives you control of your device and your computing world and lets you create anything you want. On the other hand, it lets malware and spyware take total control of your machine and steal all your personal data or extort you with ransomware. Security is always somewhat like that. It really wouldn't be that hard for a determined burglar to break into my house. I could make it a lot harder, but doing so would come at the expense of a great deal of my own convenience and even freedom. I don't want bars on my windows and I don't want to have to authenticate against a panel or app/keyfob every single time I enter or leave my home. My neighborhood has police and I live in a very civilized place. The Internet is an open war zone overrun with criminals and malicious privacy-invading corporations (and governments, and not just your own government) bent on subjecting you to a total panopticon. Computers must be secure in a much more hostile environment than my house or my car. A computer today must be more like a hardened compound in a failed state than a house in a typical developed world city or suburb. I've been saying "the Internet is a failed state" for a while. Apple with its locked down walled garden is like one of those private mercenary security armies that provide security to the rich in failed states.
  - progman32 6y ago
    In this example, I see Apple as one of those armies that only allows you to take groceries from their blessed vendors into the walls (some rumor about razor blades in fruit from the other shops?). They charge those grocery shops for this privilege. I don't disagree with the comment's observations, though I don't see a path to get to a "friendly" internet without sacrificing other important freedoms.
marmaduke 6y ago
I understand the concern, but this seems to derail the whole discussion of this lightweight tool supporting virtualization on m1/Big Sur.
- ultrarunner 6y ago
  That was not my intention, but I can see how that would be the case. As I have seen several mentions of wrappers for Virtualization.framework, the common thread that jumped out to me was the continued march toward dependence on Apple’s provisions. I do hope that the rest of the thread continues to tend toward the merits of this particular tool.
  - marmaduke 6y ago
    yeah, I can see the topic being worth a blog post and a dedicated HN discussion, since there are pros and cons of locking things up like this.
my123 6y ago
For that specific entitlement, it's overridden by vmnet.framework if you call it from root. However, Virtualization.framework runs out of process, and Apple forgot to check for root if the entitlement isn't present. That should get solved soon.
walrus01 6y ago
> >> Note This entitlement is restricted to developers of virtualization software. To request this entitlement, contact your Apple representative. I can understand the desire, for convenience's sake of testing stuff quickly, to directly virtualize a guest linux OS on a developer's workstation laptop or desktop running MacOS. But that's an absolute non-starter for me. Contact your sales representative for an entitlement? Forget that, I'll keep on using Linux kernel based virtualization with either xen or kvm, and the equivalent of xen domU PV or HVM on a normal x86-64 server platform, controlled remotely from my laptop, thanks. The whole language in that sounds like they hired some MBAs away from Oracle.
- marcan_42 6y ago
  Or you could wait until I port Linux to these Macs and then use KVM on that :-) (shameless plug) Seriously though, the machines are open, you can disable all the security to various degrees. The entitlement stuff is for deploying to vanilla Macs with all the codesigning requirements enabled (e.g. via the App Store), for security. It doesn't stop you from bypassing it on your own machines.
  - Wowfunhappy 6y ago
    If you disable SIP, iOS apps stop working. https://forums.macrumors.com/threads/if-you-disable-sip-all-you-ios-apps-will-stop-working-on-your-m1.2269661/ https://forums.macrumors.com/threads/if-you-disable-sip-all-... Your line was my line for a long time. But I feel like this is a significant step. For the first time, by taking control of your own device you’re loosing functionality.
    - new_realist 6y ago
      That’s because iOS devices are locked down for security. iOS apps are given a promise of a trusted computing base which must be kept. Otherwise your company, government or criminal gives you a MacOS laptop with SIP disabled and can now trivially circumvent the privacy protections built into all iOS devices, including for data sync’d over the cloud with your other secure devices.
solarexplorer 6y ago
I think this entitlement controls only the ability if you are not running as root. That makes perfect sense, because you don't want random user processes to be able to sniff your network traffic... > A Boolean that indicates whether the app manages virtual network interfaces without escalating privileges to the root user. https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_vm_networking?language=objc https://developer.apple.com/documentation/bundleresources/en...
- dingaling 6y ago
  > I think this entitlement controls only the ability if you are not running as root. Indeed, but why can't it be granted by root?
  - solarexplorer 6y ago
    Well, if you don't care about security, you can always put the setuid bit on the binary (I suppose that would work?). I agree that the situation is not ideal, but at least you can run it on your own computer if you actually want to... In the past there were some bad actors doing shady stuff on iOS with this type of entitlement. I wonder if that influenced this type of restriction: https://guce.techcrunch.com/copyConsent?sessionId=3_cc-session_0a3a7fb3-fd15-41aa-8dba-83a7383b2990&lang=es-ES https://guce.techcrunch.com/copyConsent?sessionId=3_cc-sessi...
johncolanduoni 6y ago
Is it restricted for developer ID/notarized software, or just the App Store? The latter doesn’t surprise (or bother) me particularly, but if it’s the former it would be pretty surprising and annoying. In the past I’ve even used weird internal entitlements like the custom lisp sandbox directives just fine with signed binaries, though I haven’t tried to notarize them.
rubatuga 6y ago
Imagine if you wanted to run a Linux program with KVM support, and you had to ask Linus to enable a flag on your Linus ID Account.
- pjmlp 6y ago
  Eventually even Linux will diverge from its idealistic roots as our generation has left the world of living.
jamesfmilne 6y ago
You can self-sign binaries to run on your own machine with the entitlement. You only need the entitlement from Apple if you want to distribute applications with the entitlement to other people.

marmaduke 6y ago

It's worth jumping directly to some issue comments, https://github.com/evansm7/vftool/issues/2#issuecomment-735455161 https://github.com/evansm7/vftool/issues/2#issuecomment-7354... as this doesn't seem to work right away for popular options, e.g. I tried the Alpine aarch64 net boot and nothing happens.

marmaduke 6y ago
I was then able to get Docker working with the Ubuntu VM (on m1)
- theodric 6y ago
  Gosh, I hope the SSH performance is not representative of what the final products from VMware and Parallels will be. I've got about 750msec lag per keypress-- it's rather painful!
  - marmaduke 6y ago
    That's odd, I just booted it back up to check and ssh'd in, and there's no noticeable lag.
- SkyLinx 6y ago
  Hi! Has the VM with vftool been stable for you? I have tried it for Docker but either I got kernel panics in the VM or performance was poor with multiple virtual cores.
marmaduke 6y ago
and in terms of speed, measured with scimark4, the VM is between rosetta2 and native.

brodo 6y ago

It would be great if Apple would add support for running OCI containers. Then most people would not need VMs.

dan1234 6y ago
How could you do that without running a Linux kernel?
- vbezhenar 6y ago
  Implement Linux syscalls like Windows did.
  - mook 6y ago
    But Windows already gave up on that (WSL2 is VM-based, with a Microsoft-built Linux kernel); why would Apple go down that road?
    - mschuster91 6y ago
      Microsoft gave up on the syscall-emulation approach mostly because of filesystem performance issues - WSL1 uses the host NTFS filesystem for everything whereas WSL2 uses a backing ext4 disk image, which means that as long as one stays in the "Linux world" the performance is way better.
  - Qerub 6y ago
    That strategy did not work out well for WSL, so in WSL2 they chose to virtualize Linux instead: https://docs.microsoft.com/en-us/windows/wsl/compare-versions https://docs.microsoft.com/en-us/windows/wsl/compare-version...
    - wtallis 6y ago
      It's not hard to imagine that Linux binary compatibility might work out much better on macOS than it did on Windows, due to macOS already being a Unix. FreeBSD has been doing it forever, though I'm not sure what the current state is with regards to performance and completeness.

boris 6y ago

Virtualization.framework appears to provide Virtio disk, network, etc. I wonder how Apple did it: I doubt they could copy GPL code from qemu. Maybe they copied something from one of the *BSD implementations? If they have implemented it from scratch, I wonder how buggy it is? Anyone has any information on this?

bartvk 6y ago
I think Virtualization.framework lays on top of Hypervisor.framework, which Apple has included since Yosemite (released in 2014). So while I can't refute your suspicions, they would have had the time to implement it from scratch.
- john_alan 6y ago
  I’ve been trying to understand the difference. Even have an open unanswered question on stack overflow. What’s the diff between Hypervisor and virtualisation frameworks? Docs are ambiguous.

Triv888 6y ago

wow, I am surprised Apple allows this

ratww 6y ago
Allow what? This is a public API: https://developer.apple.com/documentation/virtualization?language=objc https://developer.apple.com/documentation/virtualization?lan...
bartvk 6y ago
You will then be pleasantly surprised that the underlying Hypervisor.framework is used by Veertu in their Anka product. You can download and use it for free to virtualize macOS: https://veertu.com/download-anka-develop/ https://veertu.com/download-anka-develop/

dmix 6y ago

Seems interesting but far too immature for me to go anywhere near.

deleted 6y ago

[deleted]

jacobvosmaer 6y ago

I wonder how this compares to xhyve, which I use on Intel Mac. It's nice to see something like it for ARM. It appears xhyve is built on Hypervisor.framework while vftool is built on Virtualization.framework. Is that the main difference? What does that mean?

jacobvosmaer 6y ago
https://developer.apple.com/documentation/virtualization?language=objc https://developer.apple.com/documentation/virtualization?lan... https://developer.apple.com/documentation/hypervisor?language=objc https://developer.apple.com/documentation/hypervisor?languag... Looks like Virtualization.framework is newer (Big Sur only) and uses Objective C classes rather than C functions. I know from the xhyve README that it contains code responsible for booting a Linux kernel, which suggests Hypervisor.framework does not take care of that for you. The Virtualization.framework API on the other hand takes a linux kernel + ramdisk as its inputs. So it sounds like the framework vftool is built on is more high-level than that of xhyve, and like vftool is Linux-only.
- johncolanduoni 6y ago
  Yeah, Hypervisor.framework is an analogue of KVM (i.e. just manual VM contexts, the caller needs to handle exits to provide virtual hardware). Virtualization.framework is closer to something like QEMU in library form.
wiredfool 6y ago
I’m using xhyve as well, but I’m having trouble getting it to boot newer kernels. 4.4 era works, (16.04) but 18.04 and 20.04 have various failures. I note that docker is built on xhyve and doesn’t seem to have this issue. So it’s not fundamental, but the fix hasn’t made it back to thx mostly abandoned xhyve.
- jacobvosmaer 6y ago
  Ubuntu 18.04 (Linux 4.15) in xhyve works fine for me. I tried to get 20.04 set up a while ago but I gave up because its installer kept flaking out on me, something about the disk if I remember correctly.

anentropic 6y ago

https://twitter.com/Docker/status/1337163987641802752 https://twitter.com/Docker/status/1337163987641802752 > Releasing this week: > - Docker Desktop 3.0 > - Docker M1 Mac Technical Preview ...anticipation builds...

jwlake 6y ago

Do any of these solutions work for a thin mac on mac virtualization? Ideally opensource and not veertu. :)