7 ms·

Is there anyway to make docker-style Darwin containers?

takeda 5y ago
I don't see reason why it wouldn't be possible. Windows did just that. Although at that point having x86_64-linux, x86_64-windows and armv8-darwin would further remove benefits of docker reducing it to a fancy tarball.
jamesfinlayson 5y ago
I don't think Mac/Darwin has cgroups but it's based on BSD to it might have jails?
- yjftsjthsd-h 5y ago
  So my somewhat shaky understanding is that Apple does have some form of jails in Darwin, because they use it on iOS (hence, "jailbreaking"), but for some reason doesn't ship it in desktop Darwin (aka macOS).
  - heavyset_go 5y ago
    As far as I'm aware, macOS' sandbox isn't like the kernel namespaces and cgroups available on Linux.
  - johncolanduoni 5y ago
    It exists on macOS but doesn’t support the mount namespacing you’d need to create something like a docker container on macOS.
  - lostlogin 5y ago
    > Apple does have some form of jails in Darwin Thinking about the names Apple might call this tech is amusing, with their use of ‘me’ ‘I’ ‘Apple’ etc. I assume ‘Jail’ wouldn’t be in the name.
    - dotancohen 5y ago
      iSolation
  - Hackbraten 5y ago
    Apple’s sandbox focuses on isolating the OS from non-platform binaries. It doesn’t have namespaces or cgroups. Jailbreaking on iOS is mostly about that sandbox. It doesn’t relate to BSD jails. On macOS, Apple made the sandbox more lenient and implemented it a bit differently than on iOS. But both have roughly the same goals. They’re also alike in that both use the same kernel-level framework (MACF) to do their job. But the MACF is completely off-limits to everyone outside Apple. Not even accredited kext developers can use it. So I think that no one except Apple could possibly add container-style isolation to macOS.
- takeda 5y ago
  A lot of people assume that, but it's only partially true. Darwin's userland is taken from FreeBSD, the kernel is from NeXTSTEP, although it also borrowed some things from FreeBSD, but I don't think they incorporated jails[1]. [1] https://github.com/apple/darwin-xnu/search?q=jail https://github.com/apple/darwin-xnu/search?q=jail
  - heavyset_go 5y ago
    XNU itself is Mach plus a BSD "personality" taken from FreeBSD[1]. [1] https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/KernelProgramming/Architecture/Architecture.html https://developer.apple.com/library/archive/documentation/Da...
    - takeda 5y ago
      You are right, although doesn't look like jails was included.
      - heavyset_go 5y ago
        Yeah, it feels like only the minimum needed for Unixy BSD support was adopted from FreeBSD and included in XNU and the userland.
        fiddlerwoaroof 5y ago
        The thing that’s a bit surprising to me is that this didn’t include FreeBSD’s Linux emulation
        takeda 5y ago
        I don't think it is, they started with NeXTSTEP as a base and just copied interesting bits from FreeBSD. If FreeBSD was the base then that would be surprising.
      - spijdar 5y ago
- shilch 5y ago
  MacOS doesn't have jails as FreeBSD does. But they are using some kind of isolation for Mac applications, so they can not see data of other applications.
kf6nux 5y ago
The closest you're probably going to get is sandbox-exec https://jmmv.dev/2019/11/macos-sandbox-exec.html https://jmmv.dev/2019/11/macos-sandbox-exec.html
theThreeTuples 5y ago
Probably should look at https://veertu.com/ https://veertu.com/
- Hackbraten 5y ago
  Are those containers or VMs?
  - pcr910303 5y ago
    They’re VMs. It’s based on the Hypervisor.framework, so it’s actually faster than I thought, but it’s VMs.
    - easton 5y ago
      Do you know if the VMs have accelerated graphics? The new version of Hypervisor.framework in 12.x supports accelerated macOS guests but I didn't know if they figured out a way to do it without Apple's tricks. (https://developer.apple.com/documentation/virtualization/vzmacosrestoreimage https://developer.apple.com/documentation/virtualization/vzm... is the best citation I have, unfortuately)

I don't see reason why it wouldn't be possible. Windows did just that. Although at that point having x86_64-linux, x86_64-windows and armv8-darwin would further remove benefits of docker reducing it to a fancy tarball.

jamesfinlayson 5y ago

I don't think Mac/Darwin has cgroups but it's based on BSD to it might have jails?

yjftsjthsd-h 5y ago
So my somewhat shaky understanding is that Apple does have some form of jails in Darwin, because they use it on iOS (hence, "jailbreaking"), but for some reason doesn't ship it in desktop Darwin (aka macOS).
- heavyset_go 5y ago
  As far as I'm aware, macOS' sandbox isn't like the kernel namespaces and cgroups available on Linux.
- johncolanduoni 5y ago
  It exists on macOS but doesn’t support the mount namespacing you’d need to create something like a docker container on macOS.
- lostlogin 5y ago
  > Apple does have some form of jails in Darwin Thinking about the names Apple might call this tech is amusing, with their use of ‘me’ ‘I’ ‘Apple’ etc. I assume ‘Jail’ wouldn’t be in the name.
  - dotancohen 5y ago
    iSolation
- Hackbraten 5y ago
  Apple’s sandbox focuses on isolating the OS from non-platform binaries. It doesn’t have namespaces or cgroups. Jailbreaking on iOS is mostly about that sandbox. It doesn’t relate to BSD jails. On macOS, Apple made the sandbox more lenient and implemented it a bit differently than on iOS. But both have roughly the same goals. They’re also alike in that both use the same kernel-level framework (MACF) to do their job. But the MACF is completely off-limits to everyone outside Apple. Not even accredited kext developers can use it. So I think that no one except Apple could possibly add container-style isolation to macOS.
takeda 5y ago
A lot of people assume that, but it's only partially true. Darwin's userland is taken from FreeBSD, the kernel is from NeXTSTEP, although it also borrowed some things from FreeBSD, but I don't think they incorporated jails[1]. [1] https://github.com/apple/darwin-xnu/search?q=jail https://github.com/apple/darwin-xnu/search?q=jail
- heavyset_go 5y ago
  XNU itself is Mach plus a BSD "personality" taken from FreeBSD[1]. [1] https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/KernelProgramming/Architecture/Architecture.html https://developer.apple.com/library/archive/documentation/Da...
  - takeda 5y ago
    You are right, although doesn't look like jails was included.
    - heavyset_go 5y ago
      Yeah, it feels like only the minimum needed for Unixy BSD support was adopted from FreeBSD and included in XNU and the userland.
      - fiddlerwoaroof 5y ago
        The thing that’s a bit surprising to me is that this didn’t include FreeBSD’s Linux emulation
        takeda 5y ago
        I don't think it is, they started with NeXTSTEP as a base and just copied interesting bits from FreeBSD. If FreeBSD was the base then that would be surprising.
    - spijdar 5y ago
shilch 5y ago
MacOS doesn't have jails as FreeBSD does. But they are using some kind of isolation for Mac applications, so they can not see data of other applications.

kf6nux 5y ago

The closest you're probably going to get is sandbox-exec https://jmmv.dev/2019/11/macos-sandbox-exec.html https://jmmv.dev/2019/11/macos-sandbox-exec.html

theThreeTuples 5y ago

Probably should look at https://veertu.com/ https://veertu.com/

Hackbraten 5y ago
Are those containers or VMs?
- pcr910303 5y ago
  They’re VMs. It’s based on the Hypervisor.framework, so it’s actually faster than I thought, but it’s VMs.
  - easton 5y ago
    Do you know if the VMs have accelerated graphics? The new version of Hypervisor.framework in 12.x supports accelerated macOS guests but I didn't know if they figured out a way to do it without Apple's tricks. (https://developer.apple.com/documentation/virtualization/vzmacosrestoreimage https://developer.apple.com/documentation/virtualization/vzm... is the best citation I have, unfortuately)