4 ms·

sandbox the cli util included with macOS allows you to conure basically anything Then, using docker/orbstack, I’ve created an easy chroot shell on steroids. It

• jchw 2y ago
  Not trying to be condescending but simply put the sandbox-exec functionality is a toy compared to what is offered in many other UNIX-likes. It's not that it's useless (both Nix and Bazel use macOS's native sandboxing to great effect) but it is just limited compared to what's out there. Like yes, you can do relatively fine-grained limiting of resource use, but you're limited on how you can isolate resource use. On Linux, network namespaces allow you to get an entire separate networking environment, including a separate loopback, separate IP tables rules, etc. This is very powerful. An example of why it matters: Let's say you want to run some fully hermetic, isolated build. Sometimes it is very useful to have a network stack even if there is no actual access to a network. An example from Nix is that you can shim central package repo protocols and provide vendored packages over localhost. On macOS, the sandbox can't give you an isolated localhost, so instead Nix has an escape hatch that lets you just give specific derivations access to the regular localhost, only in the Darwin sandbox. (This obviously has the downsides you'd expect; you might connect to other processes on the machine by mistake, and you might run into port conflicts trying to listen on ports.) Can this be resolved without more macOS features? Honestly, I bet you could do it. You'd probably need to inject a usermode network stack somehow, though, and that might just be a bit tricky to do on Darwin. Ultimately, I fully understand why Apple won't implement something like network namespaces in the kernel (it's complicated and it introduces a large surface area for bugs) but not having them is a bummer. They're awesome. I use them for a variety of things. An end user use case that I think is really cool is isolating processes into a network jail where the only route out is a Wireguard VPN tunnel. (And to be clear, I'm not saying if Darwin had network namespaces it'd suddenly be on the same level as everything else, but it would be a great start IMO.)
  • jbverschoor 1y ago
    For that I'd use OrbStack or a VM. It creates bridge devices with a unique address/range for my dockers automatically. I can firewall / isolate it. OrbStack also supports nix btw. OrbStack runs a (lightweight) VM internally, so it's not completely the same. That said, I personally don't want nix on my system. I'd either want it overlayed (similar to what orbstack does), or as the OS itself. Cluttering my os with nix, or any development installations drives me nuts. I prefer having my shell tool, and have many isolated / COW-toolsets for my use. Almost no (cli/*nix) application requires more access than the CWD, and depending on how much I distrust it, I'll block network access as well.
    • jchw 1y ago
      I do use OrbStack but that doesn't do much good for native Nix on Darwin stuff.