10 ms·

OrbStack: The fast, light, and easy way to run Docker containers and Linux

307 points by rpgbr 2y ago

CatalystCoder 2y ago
[dead]
ta988 2y ago
Also a bit more expensive than docker desktop for companies.
- Dansvidania 2y ago
  perhaps, but much better in my experience.
dmeijboom 2y ago
Happy user since day one. Since adopting Orbstack most of our frustrations with Docker on Mac OS are gone.
kdrag0n 2y ago
Nice to see this here :) I work on OrbStack. Happy to answer questions!
- txdv 2y ago
  Is the underlying kernel emulated in QEMU?
  - kdrag0n 2y ago
    We use a custom virtualization stack instead of QEMU. It makes a lot of performance and stability improvements possible.
- saagarjha 2y ago
  What exactly is an Orb Stack
- highwaylights 2y ago
  What’s the security model for OrbStack and its containers? Is OrbStack rootless? Where is the security boundary for the containers? (Are they sandboxed completely from the host?) How does the virtualisation work? (I’d assume Virtualization.framework, so I can run it without Rosetta if all containers will share host architecture?) Does it support Docker-in-Docker and Docker-out-of-Docker? (M1 and M2 Mac’s don’t have hardware for nested virtualisation so I assume this also prevents DiD with OrbStack?) Thanks in advance, eager to try it out.
  - bakhtiari_rev 2y ago
    currently using orbstack with a devcontainer project, and in that devcontainer i'm bringing up some other nested containers via `testcontainers` via golang, so it's completely possible and is running sweetly
  - kdrag0n 2y ago
    It's a shared VM and kernel, so the security boundary between containers is only as strong as typical Linux containers, and we don't really use the VM as a strong security boundary right now. The security model is similar to running Docker containers on a native Linux machine for development. Admin privileges aren't required on the macOS side. You can optionally allow a privileged helper for some small niceties, but the VM process never runs as root. The virtualization stack is custom, which allows for a lot of performance and stability improvements. It's not Virtualization.framework or QEMU. Containers don't require virtualization, so Docker-in-Docker works. Not sure what you mean by Docker-out-of-Docker, but you can run Docker in OrbStack Linux machines, and you can use the managed engine from macOS.
    - bakhtiari_rev 2y ago
      I'm not completely sure about the use case of Docker-out-of-docker (maybe CI probably) but i guess a sibling container (a CI agent maybe) have access to docker.sock, and control other sibling containers, which i guess ( haven't tried yet) is possible with current implementation of orbstack.
    - 2y ago
- weikju 2y ago
  Please keep in mind I’m asking with genuine interest as I am a happy OrbStack user otherwise, (for private use). What is the reason Orbstack needs a connection to your license server for continued operation? I was moving and during nearly a month there was no home internet. My server was happily chugging along on wifi though, but one day I connected to it and saw a message that OrbStack couldn’t contact the license server and soon stop functioning. This put me off a bit and made me consider whether I want to run anything I depend on using this.
  - password4321 2y ago
    As you appear to be aware per the prefix to your question, this is the nature of all subscription software... what alternative would you choose if you were the author? Requiring the personal use edition to phone home once a month probably increases the potential sale price of the business by at least one order of magnitude. It would be more interesting to know the plans for tracking down commercial users abusing the personal license, maybe Oracle VirtualBox Extension Pack reverse IP address lookup style. The ins and outs of software license enforcement doesn't play well on HN, though I'm guessing there are few complaints about OrbStack requiring a subscription because they offer a free personal use license and the entry level commercial use license is so cheap vs. the value provided. It's actually exciting to see a dev tool where the developers have a sustainable business model, but this usually means there will be plenty of offers to cash out.
- rfoo 2y ago
  Hi, is it possible to add a virtual machine mode to OrbStack? See https://news.ycombinator.com/item?id=41423667 https://news.ycombinator.com/item?id=41423667 for why. I'm okay with most (or all) nice integrations unavailable. Basically I want a true UTM replacement, the one I can run my own kernel.
  - kdrag0n 2y ago
    Sorry, no plans for that. That vertical integration is a key part of OrbStack — it's not just for nice extras/integrations.
    - rfoo 2y ago
      Fair enough. Thanks for answering. Well, as someone who still lives in stone age (I guess?) I always run headless Linux VM on Windows/macOS and have all my projects/files inside VM so I unfortunately don't use your Docker/Kubernetes features, and fast file sharing is a nice to have. But, you and your team seems to really care about client virtualization on macOS, more so than Apple. So while being a niche, I sincerely hope you may consider this sometimes later.
- nrvn 2y ago
  I have been using colima as a lightweight alternative to docker desktop and the likes of it for almost two years. Looking at the comparison provided on the orbstack website (https://docs.orbstack.dev/compare/colima https://docs.orbstack.dev/compare/colima) it seems to be not very accurate or at least requires some explanations/clarifications. For instance: Low power/CPU usage is advertised as non-existent in colima. This is simply not true. Based on my perception I can't tell whether colima VM is running or not. Unlike docker desktop, especially with kubernetes on. Does not drain my battery, does not bog my CPU down unless I intentionally spin up something resource hungry. ease of use/performance: not everyone needs GUI. colima is fine UX/devex wise with fast startup times. What does "fast network" even mean? Linux machines/distros: not a fair comparison. colima stands for "containers on Lima" where lima is "linux machines" on macos. I.e. if you want arbitrary vms, use lima directly. colima is specifically built to spin up docker/containerd/k3s vms. containers/kubernetes networking: this is opinionated and depends on a specific use case. In general I prefer the idea when my local kubernetes setup looks like the end production setup in the sense that I cannot mess up much with networking, access clusterip services directly from localhost because clusterip services are supposed to be accessible from inside the cluster itself, not from outside. loadbalancer IP is accessible through NodePorts anyways. containers file access: there are plenty of ways you can access files in containers and images. But again, probably there are people who like to browse the guts of a kubernetes node in MacOS Finder. When it comes to files and networking I want to be able to re-use my toolbox used for dealing with remote kubernetes clusters and docker/containerd instances to my local ones. Creating a special case with convenient but non-standard ways to access files as if they were part of my host filesystem may be good for someone, but wrong for someone else because at times when something goes wrong this special case will work as an excuse for "works on my machine". Please take the above as my personal experience. And I am in the herd of those who tend to keep everything as minimal and bare as possible with as much standartization/ lack of deviations across different environments as possible. Came to colima after years of minikube just because minikube's experience was no longer good with apple silicon. And there must be a very strong reason to switch to something new when what you have already is good enough. Also, when it comes to GUI, what about Rancher Desktop?
- nkmnz 2y ago
  One reason I'm still using docker desktop in my (small) company is that our production systems are using docker compose and the networking with domains does not translate 1:1 between orbstack locally and docker compose + nginx in production. Is there an easy way to solve this?
  - kdrag0n 2y ago
    OrbStack domains can be nice but you don't have to use them. It's fully compatible with Compose, so you can just run the same commands with no changes to your setup. Did that not work for you?
    - nkmnz 2y ago
      I don't fully remember the issues, but I think it was somehow necessary to run all apps on port 80 inside of the containers in order to make the OrbStack domains work properly.
      - nkmnz 2y ago
        I do remember now. It was about container-to-container-communication: having FQDN is awesome because it helps you not to care about quirks of localhost:PORT everywhere in your code (SSL out of the box would be great, though). The problem is that, other than real world FQDN, the domain name of container A is not available inside of container B. This breaks frontend frameworks like next or nuxt which combine SSR on the first page load and do CSR on subsequent request: on the server, the API domain would be `host.docker.internal` and would need to change to `http://api.orb.local http://api.orb.local` for the client side. The docs didn't make this clear, so at first, I refactored everything to use the orbstack url, just to return back to the mix.
- styfle 2y ago
  I have a machine with Colima and don’t want to bork it if I try Orbstack. I think I used “brew install docker docker-compose colima” and then “colima start”. Is “brew install orbstack” a drop in replacement for colima or does it install other things that might conflict?
  - kdrag0n 2y ago
    Drop-in: "orb" to start, stop it + uninstall + restart Colima to revert. It can optionally install OrbStack's bundled `docker` and `docker compose` binaries, but you can also keep using the Homebrew ones.
    - _joel 2y ago
      use docker contexts, much easier :) # Switch to OrbStack docker context use orbstack # Switch to Colima docker context use colima
SEJeff 2y ago
I love that you can simply type `orb` and get dropped into a Linux vm. Some of the cpu features are super weird (cat /proc/cpuinfo and it is unlike literally any x86 cpu I've seen before), but unless you happen to build stuff that depends on lots of specific cpu features like I do, it works well enough.
- jbverschoor 2y ago
  Please try out my Docker shell container - https://github.com/jrz/container-shell https://github.com/jrz/container-shell which works great with orbstack
- saagarjha 2y ago
  I assume it matches whatever Rosetta advertises?
  - kdrag0n 2y ago
    It's because Rosetta doesn't seem to emulate /proc/cpuinfo, so the contents reflect that of the arm64 host.
    - SEJeff 2y ago
      Yeah, it makes for VERY confused builds when you select on cpu features available.
withinboredom 2y ago
I love how there is absolutely no mention that it is mac-only (or even what versions of mac are supported), even on the download page.
- raffraffraff 2y ago
  Was just about to post this. Apple heads tend to think that Mac is the default. Funny when you realise that the problem OrbStack is trying to fix is that MacOS isn't Linux.
  - pjmlp 2y ago
    Rather people using a UNIX, that isn't GNU/Linux, instead of sponsoring Linux OEMs.
    - withinboredom 2y ago
      Pretty sure orbstack won't run on other unix systems.
      - pjmlp 2y ago
        Buying a Linux powered laptop would have sorted out the problem in first place.
        withinboredom 2y ago
        Yeah, because it won't ever wake up from sleep. :p
- saagarjha 2y ago
  Which other platform would you expect it to be for?
  - fulafel 2y ago
    It advertises as an alternative to Docker Desktop which is for Windows and Linux as well.
jchw 2y ago
I don't generally prefer to work on macOS, but if I wind up using macOS to do work, I often find myself working a lot on things in virtual machines and containers. Using Docker Desktop to compile Envoy using the standard Docker build process took somewhere in the ball park of 3 to 4 hours depending on my luck. OrbStack, on the other hand, brought it down to a bit under an hour, much closer to inline with a fresh compilation natively. Needless to say, the kinds of performance benefits I was seeing with OrbStack were game changers, and absolutely justify the cost. Even if Docker Desktop improves to match the performance, OrbStack brings basically the whole WSL2 + Docker experience to macOS, while Docker just brings the usual Docker experience. If you get the value of WSL2 on Windows, you'll probably understand the value of OrbStack on macOS. Sure, macOS is a UNIX environment, so a lot of the same software as Linux does run natively. However, a lot of Linux technologies don't really map to Darwin, so if you're working on Linux stuff on your macOS machine, there are plenty of use cases for virtual machines (case in point, Docker itself) not to mention simply being able to test software and build processes on Linux. The tight integration that OrbStack gives you is far better than just using Parallels or VMware. I have licenses for both at varying versions, but they're largely collecting dust on macOS, as now I basically only ever use traditional virtual machine products on macOS for the purpose of running Windows VMs. I'm sure some people don't have any use for this: their Docker performance is fine, they don't need Linux for anything else, etc. However, for me, it's one of those things that makes macOS much more usable for development work.
- magnio 2y ago
  Funny how WSL2 makes Windows much more usable than macOS for development. None of the free options (colima, multipass, etc) I've tried on macOS are as smooth, though OrbStack might be it. I have also moved towards using devcontainers for my projects whenever I can, so that I can spin up my environment on whatever machine I have, or connect to a remote one if the machine doesn't allow it.
  - jchw 2y ago
    > None of the free options (colima, multipass, etc) I've tried on macOS are as smooth, though OrbStack might be it. Yes, I am generally not terribly impressed by colima. Of course, it's great to have as an option, but in practice I ran into issues trying to use it in various places. One issue that I am sure isn't a huge deal to most users is that as far as I could tell, colima did not support IPv6. I didn't try multipass, but I did try Podman Desktop. It had its niceities but largely was behind even Docker Desktop. If you really miss WSL2 on macOS, you might genuinely find OrbStack enticing. Then again, it's not free, and obviously, I don't want to give anyone false hope. For "home" use, I just run desktop Linux, using native containers and libvirt for everything. If I had to pay for a decent development experience on my personal machines, I would definitely struggle to justify a subscription charge even if it was good. On the flip side, it's easy to budget OrbStack into the equation for professional use. For your employer it's virtually a no-brainer.
novolunt 2y ago
The problem with wsl2 is that it not only requires a virtual machine, but also uses the windows kernel, not the linux kernel
- dwattttt 2y ago
  WSL2 doesn't run under the Windows kernel, it runs the Linux kernel under the Windows hypervisor, side-by-side with the Windows kernel (in another lightweight VM). Honestly it's kinda crazy that Windows natively now runs as a VM.
haberman 2y ago
I have been happily using OrbStack for a while now, and I've had nothing but good experiences. The UI is polished and responsive, the containers have great performance and nice integration with the host, and overall the product seems to be constantly pushing itself to be even better. I admit my greatest confusion about this software is how a product that appears to be a one-man show so quickly became more compelling than the well-funded incumbent (Docker Desktop). This is even more impressive considering that the developer appears to be a college student. Hats off, this is amazing work.
- saagarjha 2y ago
  I’ll let the actual developer respond but OrbStack has several people working on it now.
- kdrag0n 2y ago
  Love to hear that. We're actually a small team at OrbStack now!
xyst 2y ago
I’m curious how orbstack is able to achieve the performance they claim.
- sunaookami 2y ago
  They have an architecture overview here: https://docs.orbstack.dev/architecture https://docs.orbstack.dev/architecture
  - quantumwoke 2y ago
    This is pretty light on the details.
- moondev 2y ago
  It appears to be lxd, I assume a single vm with multiple lxd inside. https://github.com/orbstack/orbstack/issues/461#issuecomment-1643507209 https://github.com/orbstack/orbstack/issues/461#issuecomment...
  - kdrag0n 2y ago
    The issue submitter just happened to be running LXD in their OrbStack machine.
marvin-hansen 2y ago
I switched to Orbstack about 2 weeks ago after having read about it here on HN. I develop a cloud native system entirely writen in Rust. All my own containers are build without Docker thanks to rules oci in Bazel. However, for integration testing, I'm using internal tools that fire up, say a database container and run the tests all from within Bazel to leverage test caching and parallelization. For a while, i was struggling to get around Dockers slow startup time on Mac. My CI server uses Firecracker VM's to isolate OCI containers so it's really only a docker on Mac issue. My main take away: - I am so close to delete Docker permanently. There is no comparison, not even close. All integration tests run so much faster. - Especially parallel container starts a noticable faster. - I've developed custom docker utils for testing and, believe me, the official Docker API is a humongous pile of garbage that I ended up re-implementing everything by wrapping the Docker command line. To nobody's surprise, even the custom docker utils work way faster and more reliable with OrbStack. - Zero issues. I am still a little bit puzzled that OrbStack basically runs bug-free no matter what I throw at it. Take it as a compliment. What I would like to see: - A Ressource monitor or at least some graph that plots CPU and memory usage. In some rare cases the application in the container runs close to the limit probably because a query takes too long, a process got stuck or whatever. Stuff just happenens. Point is, having an eye on ressource usage helps to spot those corner cases early on. For me, OrbStack is a clear win and a clear keeper. Well done Orb team and I wish you guys all the success in the world.
- oarmstrong 2y ago
  > My CI server uses Firecracker VM's to isolate OCI containers Is this something you built yourself? I've been looking for a CI tool that uses Firecracker but never found anything, I started building something myself but it never really got finished. Would love to drop that project and use something off the shelf.
  - aayushshah15 2y ago
    I'm obviously biased here but this is what we do at blacksmith dot sh. We run you GitHub Actions on consumer grade desktop CPUs with high single core performance, all inside ephemeral Firecracker VMs. Give us a shot!
commandersaki 2y ago
OrbStack is by far some of the best software I've encountered on Mac, but unfortunately I have difficulty convincing my employer to pay for a commercial license, and with my sparse Docker usage, I'm confined to using it only for personal/hobby usage. What's amazing is it fixes an (almost) show stopper bug when using libuv (or software that uses it like CMake) with Rosetta 2 [1], with the bug present on all Docker/VMs I've tried except OrbStack. It just seems to get everything right. [1]: https://github.com/libuv/libuv/issues/4279 https://github.com/libuv/libuv/issues/4279
- cedws 2y ago
  Sorry to be blunt but your employer must be real penny pinchers, it’s not that expensive, and it’s a tool that would help you get the job done.
  - commandersaki 2y ago
    Fair criticism and I agree -- to that point, we're asked to bring our own devices to work without any compensation or the like (though it does have its advantages). I've considered paying out of my own pocket, but I just don't use Docker outside of work, and that's kind of where I draw the line at paying for software to do work.
    - DandyDev 2y ago
      You have to bring your own device? Do you have a major stake in the company you work for? Do you get an outrageously high salary? If the answer is no on both, you are taken major advantage of and you should quit asap
  - danmur 2y ago
    Spent all the budget on Apple hardware
    - nkmnz 2y ago
      MacBook Air M2 16gb ram leasing: 30€ per month orbstack pro business license: 10€ per month I don't think the hardware cost is prohibitive here. It's the death of a thousand paper cuts of a startup. I agree that orbstack would be a good investment, though.
renewiltord 2y ago
Orbstack is great. I use it in order to build a library cross-platform (Linux/Mac amd64/aarch64 all combinations) and it's great how I can do it on my Mac. You can even run a quick shell in a VM that has all your stuff mounted. Perfect user experience.
mkermani144 2y ago
It's not as battery-hungry as official Docker desktop. That's the main reason I switched to it. Now, I'm happier than before.
webprofusion 2y ago
Err, you guys know that about 80% of desktops are Windows right? There's a bit of a myth that developers are all using macOS but in practice that's not really the case.
- selcuka 2y ago
  I can't see how 80% of desktops being Windows is proof that most developers use macOS is a myth. Developers probably represent much less than 20% of all desktops, so it's a moot point.
- EasyMark 2y ago
  Maybe they like developing for Mac and that’s their niche, at least to begin with? You have to start somewhere.
cedws 2y ago
Have been using OrbStack since beta and with a commercial license since February. I can’t praise it enough, it’s elegant, performant software that just works.
KingMob 2y ago
OrbStack is great in a lot of ways, and I universally prefer it over Docker for Mac. That being said, it wasn't always been smooth sailing. Under the hood, OrbStack uses an 8TB sparse disk image, which doesn't play nice with most backup software. https://github.com/orbstack/orbstack/issues/29 https://github.com/orbstack/orbstack/issues/29 It caused me problems with Backblaze, but the Github issues for this show that it also breaks all sorts of backup software, including tarsnap, Druva inSync, Carbon Cloner, iDrive, Carbonite, and even Time Machine itself when formatted with HFS+, apparently. The official position for a year was "won't fix", because it's an Apple technology, and backup software should support that. While technically correct, realistically, sparse image backup support was not very widespread at the time. (I have no idea about now, since I gave up trying to back up my Orbstack image with my whole disk backup.) I like Orbstack, but I wish the devs had moved to exclude the disk image from backups immediately, instead of arguing with people about it for a year first. All that being said, I do still like OrbStack a lot, and I hope to never see a repeat of this problem and how it was handled.
- nwienert 2y ago
  The first reply on the issue you linked seems incredibly professional and well handled, and even recommends excluding the file from backups, I can't see a single issue there.
  - KingMob 2y ago
    Being polite is not quite the same thing as being handled professionally, and definitely not the same thing as handling it correctly. Telling people to exclude the file from backup came too late for many. E.g., Time Machine users with older disks formatted with HFS+ would find their drives crashed/corrupted/wiped, and lost all their backups. Only afterwards would they start googling to see what happened. (Even now, the relevant FAQ still says "Time Machine supports them, so your backups will not be affected" which is not always correct.) From the time the issue was opened, to the time they said they admitted they were wrong and excluded the Orbstack image from backups by default, was 13 months. Even if other solutions were on the table, the professional thing to do would have been to exclude the images ASAP, so customers weren't at risk of data loss, and then work on alternatives afterwards.
rahen 2y ago
I'm not sure I fully understand the technical differences between an OrbStack VM and a container, as both seem to use a shared kernel. What would be the closest alternative on Linux? LXD? I've grown accustomed to the convenience of OrbStack.
- suprjami 2y ago
  A Buildroot VM which runs just enough Linux to provide Docker and virtio file sharing? You can achieve almost the same thing with Alpine Linux, that's how I run all my containers, one VM per container. Edit: Further down the comments it says OrbStack is a single Linux VM running LXD containers. Oh well, I was close.
  - rahen 2y ago
    I currently use Vagrant on Linux, but it's slow and resource heavy. With OrbStack, the ability to set up an Ubuntu or Fedora 'VM' in a few seconds, then install even complex SDN workloads inside is incredible. Now I want something similar on Linux, especially once I switch to Asahi. I haven't tried LXD yet, but it seems to work similarly to OrbStack with the added benefit of having a full Linux kernel and the ability to modprobe modules and create snapshots, something that isn’t possible with OrbStack. I'll have to give it a try.
    - suprjami 2y ago
      LXD is a manager for LXC containers. I have the vague idea that it's like k8s for LXC but I don't really know either orchestration tools well enough to say. LXC containers are like Docker/Podman containers except they usually run an init process, so you're not running just one binary inside the container. You can make LXC "app containers" which just run one binary Docker/Podman containers.
- rahen 2y ago
  Answering my own question for anyone else who might be curious: OrbStack is essentially LXD for macOS, so on Linux, LXD indeed provides an identical workflow. In fact, LXD is a bit better. The command line is more powerful, it supports snapshots, the network configuration is more comprehensive, there's a direct access to the host kernel, and the web UI is a nice touch since it can work from a headless VM if needed. This was one of the few things I was missing on Asahi and Linux in general. Feels good.
fake-name 2y ago
OrbStack: The fast, light, and easy way to run Docker containers and Linux* * On MacOS Hosts only. I feel like there should be a rule that if the submission is basically a "Show HN" style post (or a link to s piece of software), it should be mentioned in the title if its platform specific.
rudi_mk 2y ago
OrbStack has been an absolute lifesaver. Rancher Desktop was great for running a quick K3s cluster locally, but OrbStack's VMs are just great. For someone who likes to run separate envs on Linux, Orb's VMs are great. Pretty performant on my older M1 MBP too.
pawelduda 2y ago
OrbStack is great for me on MacOS and nothing else I tried comes close.
Quarrel 2y ago
It would be handy if it mentioned somewhere near the top of the front page that OrbStack is a macOS utility. So that Linux & Windows people know they can look away. (Looks like a cool tool though!)
fnordlord 2y ago
Does anyone know if you can run arm64 images on a x86 Linux machine? I'm currently doing it with Docker and QEMU but it is super slow.
- _joel 2y ago
  Emulation will generally be pretty slow, much slower than native virtualisation (although Rosetta has tricks to make this quicker). Ideally use multi-arch images or build your own.
vinnymac 2y ago
I have been using OrbStack for 8 months now for personal use. I haven’t experienced a single issue in that time, and use it daily. Can’t say that for much software to be honest.
julian37 2y ago
kdrag0n's first post about this on HN, afaict: https://news.ycombinator.com/item?id=34100779 https://news.ycombinator.com/item?id=34100779 Amazing how far they've got since, in just two years. As others have pointed out, it's already "boring" software in that it just works. And that's no small feat because this kind of tool requires all kinds of low-level hackery to make work, and make work fast. Hats off! (Happy user here if you couldn't tell.)
shepherdjerred 2y ago
The absolute best feature that OrbStack has is debug shells. Essentially, it lets you attach to any container with all of your favorite tools already present, e.g. vim. https://docs.orbstack.dev/features/debug https://docs.orbstack.dev/features/debug OrbStack is well worth the price IMO
- hinkley 2y ago
  How the hell do they do that?
  - omnicognate 2y ago
    There's a "how it works" bit at https://orbstack.dev/blog/debug-shell https://orbstack.dev/blog/debug-shell > In particular, mount namespaces are what Docker and runc use to give each container its own image and view of the filesystem. But unlike chroot(2), you can copy an existing mount namespace into a new one. Debug Shell uses this to copy a container's namespace, creating a new view where we can inject things without them showing up in the original mount namespace or filesystem.
  - atombender 2y ago
    Linux, at the kernel level, doesn't have any concept of a "container". What you have instead are namespaces. File systems, process lists, networking etc. are all namespaced, and you can set these up "a la carte". For example, you can create a new process that has as its file system root /home/blah. It will see every process in the system, it can do networking, etc. — but "ls" can only show the files under /home/blah, which appears as /. Inside this process, you can't see any files above this directory. A Docker container is simply a process which has set all its namespaces in such a way as to isolate it from others. "Entering" a Docker container is done by setting up your namespace to be the same as that of the container. For example, you can create a new process (a shell, for example) that is a normal process in every way — full access to the root file system and networking and so on — but has the process tree root as the container. The process will see only the processes inside the container. You can do this on Linux today using the nsenter [1] tool. (This is also a way to create simple namespaced processes without Docker.) This allows a mix of namespaces; you can enter the container's namespaces but also retain the ability to run tools that aren't available inside the container. In short, I assume the OrbStack debug command does the exact same thing. It's coincidentally the same concept as an ephemeral container on Kubernetes. [1] https://man7.org/linux/man-pages/man1/nsenter.1.html https://man7.org/linux/man-pages/man1/nsenter.1.html
mootpt 2y ago
also supports ipv6.
zero0529 2y ago
Wished they had a Nix package, but looks good I will check it out! (Request to devs please a nix package, nix-darwin is very good for defining work machines)
oars 2y ago
Great alternative to Docker Desktop on MacOS.
tonygiorgio 2y ago
[dead]

307 points by rpgbr 2y ago

CatalystCoder 2y ago

[dead]

ta988 2y ago

Also a bit more expensive than docker desktop for companies.

Dansvidania 2y ago
perhaps, but much better in my experience.

dmeijboom 2y ago

Happy user since day one. Since adopting Orbstack most of our frustrations with Docker on Mac OS are gone.

kdrag0n 2y ago

Nice to see this here :) I work on OrbStack. Happy to answer questions!

txdv 2y ago
Is the underlying kernel emulated in QEMU?
- kdrag0n 2y ago
  We use a custom virtualization stack instead of QEMU. It makes a lot of performance and stability improvements possible.
saagarjha 2y ago
What exactly is an Orb Stack
highwaylights 2y ago
What’s the security model for OrbStack and its containers? Is OrbStack rootless? Where is the security boundary for the containers? (Are they sandboxed completely from the host?) How does the virtualisation work? (I’d assume Virtualization.framework, so I can run it without Rosetta if all containers will share host architecture?) Does it support Docker-in-Docker and Docker-out-of-Docker? (M1 and M2 Mac’s don’t have hardware for nested virtualisation so I assume this also prevents DiD with OrbStack?) Thanks in advance, eager to try it out.
- bakhtiari_rev 2y ago
  currently using orbstack with a devcontainer project, and in that devcontainer i'm bringing up some other nested containers via `testcontainers` via golang, so it's completely possible and is running sweetly
- kdrag0n 2y ago
  It's a shared VM and kernel, so the security boundary between containers is only as strong as typical Linux containers, and we don't really use the VM as a strong security boundary right now. The security model is similar to running Docker containers on a native Linux machine for development. Admin privileges aren't required on the macOS side. You can optionally allow a privileged helper for some small niceties, but the VM process never runs as root. The virtualization stack is custom, which allows for a lot of performance and stability improvements. It's not Virtualization.framework or QEMU. Containers don't require virtualization, so Docker-in-Docker works. Not sure what you mean by Docker-out-of-Docker, but you can run Docker in OrbStack Linux machines, and you can use the managed engine from macOS.
  - bakhtiari_rev 2y ago
    I'm not completely sure about the use case of Docker-out-of-docker (maybe CI probably) but i guess a sibling container (a CI agent maybe) have access to docker.sock, and control other sibling containers, which i guess ( haven't tried yet) is possible with current implementation of orbstack.
  - 2y ago
weikju 2y ago
Please keep in mind I’m asking with genuine interest as I am a happy OrbStack user otherwise, (for private use). What is the reason Orbstack needs a connection to your license server for continued operation? I was moving and during nearly a month there was no home internet. My server was happily chugging along on wifi though, but one day I connected to it and saw a message that OrbStack couldn’t contact the license server and soon stop functioning. This put me off a bit and made me consider whether I want to run anything I depend on using this.
- password4321 2y ago
  As you appear to be aware per the prefix to your question, this is the nature of all subscription software... what alternative would you choose if you were the author? Requiring the personal use edition to phone home once a month probably increases the potential sale price of the business by at least one order of magnitude. It would be more interesting to know the plans for tracking down commercial users abusing the personal license, maybe Oracle VirtualBox Extension Pack reverse IP address lookup style. The ins and outs of software license enforcement doesn't play well on HN, though I'm guessing there are few complaints about OrbStack requiring a subscription because they offer a free personal use license and the entry level commercial use license is so cheap vs. the value provided. It's actually exciting to see a dev tool where the developers have a sustainable business model, but this usually means there will be plenty of offers to cash out.
rfoo 2y ago
Hi, is it possible to add a virtual machine mode to OrbStack? See https://news.ycombinator.com/item?id=41423667 https://news.ycombinator.com/item?id=41423667 for why. I'm okay with most (or all) nice integrations unavailable. Basically I want a true UTM replacement, the one I can run my own kernel.
- kdrag0n 2y ago
  Sorry, no plans for that. That vertical integration is a key part of OrbStack — it's not just for nice extras/integrations.
  - rfoo 2y ago
    Fair enough. Thanks for answering. Well, as someone who still lives in stone age (I guess?) I always run headless Linux VM on Windows/macOS and have all my projects/files inside VM so I unfortunately don't use your Docker/Kubernetes features, and fast file sharing is a nice to have. But, you and your team seems to really care about client virtualization on macOS, more so than Apple. So while being a niche, I sincerely hope you may consider this sometimes later.
nrvn 2y ago
I have been using colima as a lightweight alternative to docker desktop and the likes of it for almost two years. Looking at the comparison provided on the orbstack website (https://docs.orbstack.dev/compare/colima https://docs.orbstack.dev/compare/colima) it seems to be not very accurate or at least requires some explanations/clarifications. For instance: Low power/CPU usage is advertised as non-existent in colima. This is simply not true. Based on my perception I can't tell whether colima VM is running or not. Unlike docker desktop, especially with kubernetes on. Does not drain my battery, does not bog my CPU down unless I intentionally spin up something resource hungry. ease of use/performance: not everyone needs GUI. colima is fine UX/devex wise with fast startup times. What does "fast network" even mean? Linux machines/distros: not a fair comparison. colima stands for "containers on Lima" where lima is "linux machines" on macos. I.e. if you want arbitrary vms, use lima directly. colima is specifically built to spin up docker/containerd/k3s vms. containers/kubernetes networking: this is opinionated and depends on a specific use case. In general I prefer the idea when my local kubernetes setup looks like the end production setup in the sense that I cannot mess up much with networking, access clusterip services directly from localhost because clusterip services are supposed to be accessible from inside the cluster itself, not from outside. loadbalancer IP is accessible through NodePorts anyways. containers file access: there are plenty of ways you can access files in containers and images. But again, probably there are people who like to browse the guts of a kubernetes node in MacOS Finder. When it comes to files and networking I want to be able to re-use my toolbox used for dealing with remote kubernetes clusters and docker/containerd instances to my local ones. Creating a special case with convenient but non-standard ways to access files as if they were part of my host filesystem may be good for someone, but wrong for someone else because at times when something goes wrong this special case will work as an excuse for "works on my machine". Please take the above as my personal experience. And I am in the herd of those who tend to keep everything as minimal and bare as possible with as much standartization/ lack of deviations across different environments as possible. Came to colima after years of minikube just because minikube's experience was no longer good with apple silicon. And there must be a very strong reason to switch to something new when what you have already is good enough. Also, when it comes to GUI, what about Rancher Desktop?
nkmnz 2y ago
One reason I'm still using docker desktop in my (small) company is that our production systems are using docker compose and the networking with domains does not translate 1:1 between orbstack locally and docker compose + nginx in production. Is there an easy way to solve this?
- kdrag0n 2y ago
  OrbStack domains can be nice but you don't have to use them. It's fully compatible with Compose, so you can just run the same commands with no changes to your setup. Did that not work for you?
  - nkmnz 2y ago
    I don't fully remember the issues, but I think it was somehow necessary to run all apps on port 80 inside of the containers in order to make the OrbStack domains work properly.
    - nkmnz 2y ago
      I do remember now. It was about container-to-container-communication: having FQDN is awesome because it helps you not to care about quirks of localhost:PORT everywhere in your code (SSL out of the box would be great, though). The problem is that, other than real world FQDN, the domain name of container A is not available inside of container B. This breaks frontend frameworks like next or nuxt which combine SSR on the first page load and do CSR on subsequent request: on the server, the API domain would be `host.docker.internal` and would need to change to `http://api.orb.local http://api.orb.local` for the client side. The docs didn't make this clear, so at first, I refactored everything to use the orbstack url, just to return back to the mix.
styfle 2y ago
I have a machine with Colima and don’t want to bork it if I try Orbstack. I think I used “brew install docker docker-compose colima” and then “colima start”. Is “brew install orbstack” a drop in replacement for colima or does it install other things that might conflict?
- kdrag0n 2y ago
  Drop-in: "orb" to start, stop it + uninstall + restart Colima to revert. It can optionally install OrbStack's bundled `docker` and `docker compose` binaries, but you can also keep using the Homebrew ones.
  - _joel 2y ago
    use docker contexts, much easier :) # Switch to OrbStack docker context use orbstack # Switch to Colima docker context use colima

SEJeff 2y ago

I love that you can simply type `orb` and get dropped into a Linux vm. Some of the cpu features are super weird (cat /proc/cpuinfo and it is unlike literally any x86 cpu I've seen before), but unless you happen to build stuff that depends on lots of specific cpu features like I do, it works well enough.

jbverschoor 2y ago
Please try out my Docker shell container - https://github.com/jrz/container-shell https://github.com/jrz/container-shell which works great with orbstack
saagarjha 2y ago
I assume it matches whatever Rosetta advertises?
- kdrag0n 2y ago
  It's because Rosetta doesn't seem to emulate /proc/cpuinfo, so the contents reflect that of the arm64 host.
  - SEJeff 2y ago
    Yeah, it makes for VERY confused builds when you select on cpu features available.

withinboredom 2y ago

I love how there is absolutely no mention that it is mac-only (or even what versions of mac are supported), even on the download page.

raffraffraff 2y ago
Was just about to post this. Apple heads tend to think that Mac is the default. Funny when you realise that the problem OrbStack is trying to fix is that MacOS isn't Linux.
- pjmlp 2y ago
  Rather people using a UNIX, that isn't GNU/Linux, instead of sponsoring Linux OEMs.
  - withinboredom 2y ago
    Pretty sure orbstack won't run on other unix systems.
    - pjmlp 2y ago
      Buying a Linux powered laptop would have sorted out the problem in first place.
      - withinboredom 2y ago
        Yeah, because it won't ever wake up from sleep. :p
saagarjha 2y ago
Which other platform would you expect it to be for?
- fulafel 2y ago
  It advertises as an alternative to Docker Desktop which is for Windows and Linux as well.

jchw 2y ago

I don't generally prefer to work on macOS, but if I wind up using macOS to do work, I often find myself working a lot on things in virtual machines and containers. Using Docker Desktop to compile Envoy using the standard Docker build process took somewhere in the ball park of 3 to 4 hours depending on my luck. OrbStack, on the other hand, brought it down to a bit under an hour, much closer to inline with a fresh compilation natively. Needless to say, the kinds of performance benefits I was seeing with OrbStack were game changers, and absolutely justify the cost. Even if Docker Desktop improves to match the performance, OrbStack brings basically the whole WSL2 + Docker experience to macOS, while Docker just brings the usual Docker experience. If you get the value of WSL2 on Windows, you'll probably understand the value of OrbStack on macOS. Sure, macOS is a UNIX environment, so a lot of the same software as Linux does run natively. However, a lot of Linux technologies don't really map to Darwin, so if you're working on Linux stuff on your macOS machine, there are plenty of use cases for virtual machines (case in point, Docker itself) not to mention simply being able to test software and build processes on Linux. The tight integration that OrbStack gives you is far better than just using Parallels or VMware. I have licenses for both at varying versions, but they're largely collecting dust on macOS, as now I basically only ever use traditional virtual machine products on macOS for the purpose of running Windows VMs. I'm sure some people don't have any use for this: their Docker performance is fine, they don't need Linux for anything else, etc. However, for me, it's one of those things that makes macOS much more usable for development work.

magnio 2y ago
Funny how WSL2 makes Windows much more usable than macOS for development. None of the free options (colima, multipass, etc) I've tried on macOS are as smooth, though OrbStack might be it. I have also moved towards using devcontainers for my projects whenever I can, so that I can spin up my environment on whatever machine I have, or connect to a remote one if the machine doesn't allow it.
- jchw 2y ago
  > None of the free options (colima, multipass, etc) I've tried on macOS are as smooth, though OrbStack might be it. Yes, I am generally not terribly impressed by colima. Of course, it's great to have as an option, but in practice I ran into issues trying to use it in various places. One issue that I am sure isn't a huge deal to most users is that as far as I could tell, colima did not support IPv6. I didn't try multipass, but I did try Podman Desktop. It had its niceities but largely was behind even Docker Desktop. If you really miss WSL2 on macOS, you might genuinely find OrbStack enticing. Then again, it's not free, and obviously, I don't want to give anyone false hope. For "home" use, I just run desktop Linux, using native containers and libvirt for everything. If I had to pay for a decent development experience on my personal machines, I would definitely struggle to justify a subscription charge even if it was good. On the flip side, it's easy to budget OrbStack into the equation for professional use. For your employer it's virtually a no-brainer.

novolunt 2y ago

The problem with wsl2 is that it not only requires a virtual machine, but also uses the windows kernel, not the linux kernel

dwattttt 2y ago
WSL2 doesn't run under the Windows kernel, it runs the Linux kernel under the Windows hypervisor, side-by-side with the Windows kernel (in another lightweight VM). Honestly it's kinda crazy that Windows natively now runs as a VM.

haberman 2y ago

I have been happily using OrbStack for a while now, and I've had nothing but good experiences. The UI is polished and responsive, the containers have great performance and nice integration with the host, and overall the product seems to be constantly pushing itself to be even better. I admit my greatest confusion about this software is how a product that appears to be a one-man show so quickly became more compelling than the well-funded incumbent (Docker Desktop). This is even more impressive considering that the developer appears to be a college student. Hats off, this is amazing work.

saagarjha 2y ago
I’ll let the actual developer respond but OrbStack has several people working on it now.
kdrag0n 2y ago
Love to hear that. We're actually a small team at OrbStack now!

xyst 2y ago

I’m curious how orbstack is able to achieve the performance they claim.

sunaookami 2y ago
They have an architecture overview here: https://docs.orbstack.dev/architecture https://docs.orbstack.dev/architecture
- quantumwoke 2y ago
  This is pretty light on the details.
moondev 2y ago
It appears to be lxd, I assume a single vm with multiple lxd inside. https://github.com/orbstack/orbstack/issues/461#issuecomment-1643507209 https://github.com/orbstack/orbstack/issues/461#issuecomment...
- kdrag0n 2y ago
  The issue submitter just happened to be running LXD in their OrbStack machine.

marvin-hansen 2y ago

I switched to Orbstack about 2 weeks ago after having read about it here on HN. I develop a cloud native system entirely writen in Rust. All my own containers are build without Docker thanks to rules oci in Bazel. However, for integration testing, I'm using internal tools that fire up, say a database container and run the tests all from within Bazel to leverage test caching and parallelization. For a while, i was struggling to get around Dockers slow startup time on Mac. My CI server uses Firecracker VM's to isolate OCI containers so it's really only a docker on Mac issue. My main take away: - I am so close to delete Docker permanently. There is no comparison, not even close. All integration tests run so much faster. - Especially parallel container starts a noticable faster. - I've developed custom docker utils for testing and, believe me, the official Docker API is a humongous pile of garbage that I ended up re-implementing everything by wrapping the Docker command line. To nobody's surprise, even the custom docker utils work way faster and more reliable with OrbStack. - Zero issues. I am still a little bit puzzled that OrbStack basically runs bug-free no matter what I throw at it. Take it as a compliment. What I would like to see: - A Ressource monitor or at least some graph that plots CPU and memory usage. In some rare cases the application in the container runs close to the limit probably because a query takes too long, a process got stuck or whatever. Stuff just happenens. Point is, having an eye on ressource usage helps to spot those corner cases early on. For me, OrbStack is a clear win and a clear keeper. Well done Orb team and I wish you guys all the success in the world.

oarmstrong 2y ago
> My CI server uses Firecracker VM's to isolate OCI containers Is this something you built yourself? I've been looking for a CI tool that uses Firecracker but never found anything, I started building something myself but it never really got finished. Would love to drop that project and use something off the shelf.
- aayushshah15 2y ago
  I'm obviously biased here but this is what we do at blacksmith dot sh. We run you GitHub Actions on consumer grade desktop CPUs with high single core performance, all inside ephemeral Firecracker VMs. Give us a shot!

commandersaki 2y ago

OrbStack is by far some of the best software I've encountered on Mac, but unfortunately I have difficulty convincing my employer to pay for a commercial license, and with my sparse Docker usage, I'm confined to using it only for personal/hobby usage. What's amazing is it fixes an (almost) show stopper bug when using libuv (or software that uses it like CMake) with Rosetta 2 [1], with the bug present on all Docker/VMs I've tried except OrbStack. It just seems to get everything right. [1]: https://github.com/libuv/libuv/issues/4279 https://github.com/libuv/libuv/issues/4279

cedws 2y ago
Sorry to be blunt but your employer must be real penny pinchers, it’s not that expensive, and it’s a tool that would help you get the job done.
- commandersaki 2y ago
  Fair criticism and I agree -- to that point, we're asked to bring our own devices to work without any compensation or the like (though it does have its advantages). I've considered paying out of my own pocket, but I just don't use Docker outside of work, and that's kind of where I draw the line at paying for software to do work.
  - DandyDev 2y ago
    You have to bring your own device? Do you have a major stake in the company you work for? Do you get an outrageously high salary? If the answer is no on both, you are taken major advantage of and you should quit asap
- danmur 2y ago
  Spent all the budget on Apple hardware
  - nkmnz 2y ago
    MacBook Air M2 16gb ram leasing: 30€ per month orbstack pro business license: 10€ per month I don't think the hardware cost is prohibitive here. It's the death of a thousand paper cuts of a startup. I agree that orbstack would be a good investment, though.

renewiltord 2y ago

Orbstack is great. I use it in order to build a library cross-platform (Linux/Mac amd64/aarch64 all combinations) and it's great how I can do it on my Mac. You can even run a quick shell in a VM that has all your stuff mounted. Perfect user experience.

mkermani144 2y ago

It's not as battery-hungry as official Docker desktop. That's the main reason I switched to it. Now, I'm happier than before.

webprofusion 2y ago

Err, you guys know that about 80% of desktops are Windows right? There's a bit of a myth that developers are all using macOS but in practice that's not really the case.

selcuka 2y ago
I can't see how 80% of desktops being Windows is proof that most developers use macOS is a myth. Developers probably represent much less than 20% of all desktops, so it's a moot point.
EasyMark 2y ago
Maybe they like developing for Mac and that’s their niche, at least to begin with? You have to start somewhere.

cedws 2y ago

Have been using OrbStack since beta and with a commercial license since February. I can’t praise it enough, it’s elegant, performant software that just works.

KingMob 2y ago

OrbStack is great in a lot of ways, and I universally prefer it over Docker for Mac. That being said, it wasn't always been smooth sailing. Under the hood, OrbStack uses an 8TB sparse disk image, which doesn't play nice with most backup software. https://github.com/orbstack/orbstack/issues/29 https://github.com/orbstack/orbstack/issues/29 It caused me problems with Backblaze, but the Github issues for this show that it also breaks all sorts of backup software, including tarsnap, Druva inSync, Carbon Cloner, iDrive, Carbonite, and even Time Machine itself when formatted with HFS+, apparently. The official position for a year was "won't fix", because it's an Apple technology, and backup software should support that. While technically correct, realistically, sparse image backup support was not very widespread at the time. (I have no idea about now, since I gave up trying to back up my Orbstack image with my whole disk backup.) I like Orbstack, but I wish the devs had moved to exclude the disk image from backups immediately, instead of arguing with people about it for a year first. All that being said, I do still like OrbStack a lot, and I hope to never see a repeat of this problem and how it was handled.

nwienert 2y ago
The first reply on the issue you linked seems incredibly professional and well handled, and even recommends excluding the file from backups, I can't see a single issue there.
- KingMob 2y ago
  Being polite is not quite the same thing as being handled professionally, and definitely not the same thing as handling it correctly. Telling people to exclude the file from backup came too late for many. E.g., Time Machine users with older disks formatted with HFS+ would find their drives crashed/corrupted/wiped, and lost all their backups. Only afterwards would they start googling to see what happened. (Even now, the relevant FAQ still says "Time Machine supports them, so your backups will not be affected" which is not always correct.) From the time the issue was opened, to the time they said they admitted they were wrong and excluded the Orbstack image from backups by default, was 13 months. Even if other solutions were on the table, the professional thing to do would have been to exclude the images ASAP, so customers weren't at risk of data loss, and then work on alternatives afterwards.

rahen 2y ago

I'm not sure I fully understand the technical differences between an OrbStack VM and a container, as both seem to use a shared kernel. What would be the closest alternative on Linux? LXD? I've grown accustomed to the convenience of OrbStack.

suprjami 2y ago
A Buildroot VM which runs just enough Linux to provide Docker and virtio file sharing? You can achieve almost the same thing with Alpine Linux, that's how I run all my containers, one VM per container. Edit: Further down the comments it says OrbStack is a single Linux VM running LXD containers. Oh well, I was close.
- rahen 2y ago
  I currently use Vagrant on Linux, but it's slow and resource heavy. With OrbStack, the ability to set up an Ubuntu or Fedora 'VM' in a few seconds, then install even complex SDN workloads inside is incredible. Now I want something similar on Linux, especially once I switch to Asahi. I haven't tried LXD yet, but it seems to work similarly to OrbStack with the added benefit of having a full Linux kernel and the ability to modprobe modules and create snapshots, something that isn’t possible with OrbStack. I'll have to give it a try.
  - suprjami 2y ago
    LXD is a manager for LXC containers. I have the vague idea that it's like k8s for LXC but I don't really know either orchestration tools well enough to say. LXC containers are like Docker/Podman containers except they usually run an init process, so you're not running just one binary inside the container. You can make LXC "app containers" which just run one binary Docker/Podman containers.
rahen 2y ago
Answering my own question for anyone else who might be curious: OrbStack is essentially LXD for macOS, so on Linux, LXD indeed provides an identical workflow. In fact, LXD is a bit better. The command line is more powerful, it supports snapshots, the network configuration is more comprehensive, there's a direct access to the host kernel, and the web UI is a nice touch since it can work from a headless VM if needed. This was one of the few things I was missing on Asahi and Linux in general. Feels good.

fake-name 2y ago

OrbStack: The fast, light, and easy way to run Docker containers and Linux* * On MacOS Hosts only. I feel like there should be a rule that if the submission is basically a "Show HN" style post (or a link to s piece of software), it should be mentioned in the title if its platform specific.

rudi_mk 2y ago

OrbStack has been an absolute lifesaver. Rancher Desktop was great for running a quick K3s cluster locally, but OrbStack's VMs are just great. For someone who likes to run separate envs on Linux, Orb's VMs are great. Pretty performant on my older M1 MBP too.

pawelduda 2y ago

OrbStack is great for me on MacOS and nothing else I tried comes close.

Quarrel 2y ago

It would be handy if it mentioned somewhere near the top of the front page that OrbStack is a macOS utility. So that Linux & Windows people know they can look away. (Looks like a cool tool though!)

fnordlord 2y ago

Does anyone know if you can run arm64 images on a x86 Linux machine? I'm currently doing it with Docker and QEMU but it is super slow.

_joel 2y ago
Emulation will generally be pretty slow, much slower than native virtualisation (although Rosetta has tricks to make this quicker). Ideally use multi-arch images or build your own.

vinnymac 2y ago

I have been using OrbStack for 8 months now for personal use. I haven’t experienced a single issue in that time, and use it daily. Can’t say that for much software to be honest.

julian37 2y ago

kdrag0n's first post about this on HN, afaict: https://news.ycombinator.com/item?id=34100779 https://news.ycombinator.com/item?id=34100779 Amazing how far they've got since, in just two years. As others have pointed out, it's already "boring" software in that it just works. And that's no small feat because this kind of tool requires all kinds of low-level hackery to make work, and make work fast. Hats off! (Happy user here if you couldn't tell.)

shepherdjerred 2y ago

The absolute best feature that OrbStack has is debug shells. Essentially, it lets you attach to any container with all of your favorite tools already present, e.g. vim. https://docs.orbstack.dev/features/debug https://docs.orbstack.dev/features/debug OrbStack is well worth the price IMO

hinkley 2y ago
How the hell do they do that?
- omnicognate 2y ago
  There's a "how it works" bit at https://orbstack.dev/blog/debug-shell https://orbstack.dev/blog/debug-shell > In particular, mount namespaces are what Docker and runc use to give each container its own image and view of the filesystem. But unlike chroot(2), you can copy an existing mount namespace into a new one. Debug Shell uses this to copy a container's namespace, creating a new view where we can inject things without them showing up in the original mount namespace or filesystem.
- atombender 2y ago
  Linux, at the kernel level, doesn't have any concept of a "container". What you have instead are namespaces. File systems, process lists, networking etc. are all namespaced, and you can set these up "a la carte". For example, you can create a new process that has as its file system root /home/blah. It will see every process in the system, it can do networking, etc. — but "ls" can only show the files under /home/blah, which appears as /. Inside this process, you can't see any files above this directory. A Docker container is simply a process which has set all its namespaces in such a way as to isolate it from others. "Entering" a Docker container is done by setting up your namespace to be the same as that of the container. For example, you can create a new process (a shell, for example) that is a normal process in every way — full access to the root file system and networking and so on — but has the process tree root as the container. The process will see only the processes inside the container. You can do this on Linux today using the nsenter [1] tool. (This is also a way to create simple namespaced processes without Docker.) This allows a mix of namespaces; you can enter the container's namespaces but also retain the ability to run tools that aren't available inside the container. In short, I assume the OrbStack debug command does the exact same thing. It's coincidentally the same concept as an ephemeral container on Kubernetes. [1] https://man7.org/linux/man-pages/man1/nsenter.1.html https://man7.org/linux/man-pages/man1/nsenter.1.html

mootpt 2y ago

also supports ipv6.

zero0529 2y ago

Wished they had a Nix package, but looks good I will check it out! (Request to devs please a nix package, nix-darwin is very good for defining work machines)

oars 2y ago

Great alternative to Docker Desktop on MacOS.

tonygiorgio 2y ago

[dead]