5 ms·
I can't help but feel like this is an X/Y problem. Apps on MacOS shouldn't need containerization to function. I get the point of isolation for build/test situa
by duped 3y ago
I can't help but feel like this is an X/Y problem. Apps on MacOS shouldn't need containerization to function.
I get the point of isolation for build/test situations. But Apple provides a neat virtualization framework, and you get security + isolation + reproducibility + decent performance.
It seems like if you feel the need to containerize the userspace on MacOS you're using MacOS wrong. It's not the same thing as the Linux userspace, and doesn't have the same kernel features that would let you do so cleanly or performantly.
Orbstack is moving mountains to provide Linux-native perf and support for containers and it still makes me beg the question: why are devs allergic to just using Linux natively? At least I understand why Orbstack is useful, I don't know why containerizing MacOS itself is.
- WesolyKubeczek 3y ago> But Apple provides a neat virtualization framework, and you get security + isolation + reproducibility + decent performance. You also get limits on how many VMs your machine can run, each VM needs gobs of storage and locked-out RAM blocks, and sharing directories between the host and guest, compared to bind mounts, is something that makes me remember for my root canal dental jobs wistfully.
- duped 3y agoI've only used it with Linux kernels, but that has not been my experience with the new Virtualization.framework. The perf of virtio shares is reasonably fast. I can see how you'd need a crap ton of disk for MacOS virtualization, but again, why do you need it? If it's isolation for builds, fix your build. If it's isolation for tests, live with it. If it's for running your app, write your app to properly run in the app sandbox.
- WesolyKubeczek 3y ago> reasonably fast. But still not "as fast as it gets". And I want it to be as fast as it gets.
- duped 3y agoNeither is using macfuse as a stand in for overlayfs and bind mounts. My point is "as fast as it gets" is using MacOS how MacOS is designed: ie, through sandboxing and not containerization that pretends the MacOS userspace is Linux. It's not Linux. There is a fundamental trade off between isolation and performance. You cannot securely share resources without overhead.
- slonopotamus 3y agoFUSE is only used for bind mounts. If you write to a directory that belongs to container, you get the raw speed of host OS.
- duped 3y agoHow do you support layers without overlayfs?
- slonopotamus 3y agoIt's not me, it's containerd "native" snapshotter. It turns to be efficient on macOS thanks to `clonefile` syscall.
- starttoaster 3y ago> If it's isolation for builds, fix your build Isolation fixes the problem for free and is more similar to how I build for Linux. Why would I want another solution?
- duped 3y agoMacOS apps are designed to be self contained and not require isolation, unlike most Linux distros, which are designed to use FHS and share their state/dependencies with everything else on the system. Further you can sandbox processes just fine on MacOS without needing to mock the whole userspace, like you do on Linux. This will give you the same degree of isolation that a container does.