4 ms·

What about macOS being derived from BSD? Isn’t that where containers came from: BSD jails? I know the container ecosystem largely targets Linux just curious wh

What about macOS being derived from BSD? Isn’t that where containers came from: BSD jails? I know the container ecosystem largely targets Linux just curious what people’s thoughts are on that.

hangonhn 1y ago
Conceptually similar but different implementations. Containers uses cgroups in Linux and there is also file system and network virtualization as well. It's not impossible but it would require quite a bit of work.
McAlpine5892 1y ago
BSD jails are architected wholly differently from what something like Docker provides. Jails are first-class citizens that are baked deep into the system. A tool like Docker relies using multiple Linux features/tools to assemble/create isolation. Additionally, iirc, the logic for FreeBSD jails never made it into the Darwin kernel. Someone correct me please.
- dboreham 1y ago
  > what something like Docker provides Docker isn't providing any of the underlying functionality. BSD jails and Linux cgroups etc aren't fundamentally different things.
  - nyrikki 1y ago
    Jails were explicitly designed for security, cgroups were more generalized as more about resource control, and leverages namespaces, capabilities, apparmor/SELinux to accomplish what they do. > Jails create a safe environment independent from the rest of the system. Processes created in this environment cannot access files or resources outside of it.[1] While you can accomplish similar tasks, they are not equivalent. Assume Linux containers are jails, and you will have security problems. And on the flip side, k8s pods share UTM,IPC, Network namespaces, yet have independent PID and FS namespaces. Depending on your use case they may be roughly equivalent, but they are fundamentally different approaches. [1] https://freebsdfoundation.org/freebsd-project/resources/introduction-to-freebsd-jails/ https://freebsdfoundation.org/freebsd-project/resources/intr...
- AdieuToLogic 1y ago
  > BSD jails are architected wholly differently from what something like Docker provides. > Jails are first-class citizens that are baked deep into the system. Both very true statements and worth remembering when considering: > Additionally, iirc, the logic for FreeBSD jails never made it into the Darwin kernel. You are quite correct, as Darwin is is based on XNU[0], which itself has roots in the Mach[1] microkernel. Since XNU[0] is an entirely different OS architecture than that of FreeBSD[3], jails[4] do not exist within it. The XNU source can be found here[2]. 0 - https://en.wikipedia.org/wiki/XNU https://en.wikipedia.org/wiki/XNU 1 - https://en.wikipedia.org/wiki/Mach_(kernel) https://en.wikipedia.org/wiki/Mach_(kernel) 2 - https://github.com/apple-oss-distributions/xnu https://github.com/apple-oss-distributions/xnu 3 - https://cgit.freebsd.org/src/ https://cgit.freebsd.org/src/ 4 - https://man.freebsd.org/cgi/man.cgi?query=jail&apropos=0&sektion=0&manpath=FreeBSD+14.3-RELEASE&arch=default&format=html https://man.freebsd.org/cgi/man.cgi?query=jail&apropos=0&sek...
  - bandoti 1y ago
    Thank you for the links I will take a closer look at XNU. It’s neat to see how these projects influence each other.
    - AdieuToLogic 1y ago
      > Thank you for the links I will take a closer look at XNU. Another great resource regarding XNU and OS-X (although a bit dated now) is the book: Mac OS X Internals A Systems Approach[0] 0 - https://openlibrary.org/books/OL27440934M/Mac_OS_X_Internals https://openlibrary.org/books/OL27440934M/Mac_OS_X_Internals
  - McAlpine5892 1y ago
    This is great! Thank you!
formerly_proven 1y ago
„Container“ is sort of synonymous with „OCI-compatible container“ these days, and OCI itself is basically a retcon standard for docker (runtime, images etc.). So from that perspective every „container system“ is necessarily „docker-like“ and that means Linux namespaces and cgroups.
- pjmlp 1y ago
  With a whole generation forgetting they came first in big iron UNIX like HP-UX.
  - 9dev 1y ago
    Does it really matter, tho?
    - pjmlp 1y ago
      Some people think it matters to properly learn history, instead of urban myths.
      - 9dev 1y ago
        History is one thing, who-did-it-first is often just a way to make a point in faction debates. In the broader picture, it makes little difference IMHO.
    - bandoti 1y ago
      Another reason it matters is they might have done it differently which could inspire future improvements. :) I like to read bibliographies for that reason—to read books that inspired the author I’m reading at the time. Same goes for code and research papers!
  - jeberle 1y ago
    Interesting. My experience w/ HP-UX was in the 90s, but this (Integrity Virtual Machines) was released in 2005. I might call out FreeBSD Jails (2000) or Solaris Zones (2005) as an earlier and a more significant case respectively. I appreciate the insight, though, never knew about HP-UX. https://en.wikipedia.org/wiki/HP_Integrity_Virtual_Machines https://en.wikipedia.org/wiki/HP_Integrity_Virtual_Machines
p_ing 1y ago
OS X pulls some components of FreeBSD into kernel space, but not all (and those are very old at this point). It also uses various BSD bits for userspace. Good read from horse mouth: https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/KernelProgramming/BSD/BSD.html https://developer.apple.com/library/archive/documentation/Da...
- bandoti 1y ago
  Thank you—I’ll give that a read. :)
sarlalian 1y ago
Another really good read about containers, jails and zones. https://blog.jessfraz.com/post/containers-zones-jails-vms/ https://blog.jessfraz.com/post/containers-zones-jails-vms/

What about macOS being derived from BSD? Isn’t that where containers came from: BSD jails? I know the container ecosystem largely targets Linux just curious what people’s thoughts are on that.

hangonhn 1y ago

Conceptually similar but different implementations. Containers uses cgroups in Linux and there is also file system and network virtualization as well. It's not impossible but it would require quite a bit of work.

McAlpine5892 1y ago

BSD jails are architected wholly differently from what something like Docker provides. Jails are first-class citizens that are baked deep into the system. A tool like Docker relies using multiple Linux features/tools to assemble/create isolation. Additionally, iirc, the logic for FreeBSD jails never made it into the Darwin kernel. Someone correct me please.

dboreham 1y ago
> what something like Docker provides Docker isn't providing any of the underlying functionality. BSD jails and Linux cgroups etc aren't fundamentally different things.
- nyrikki 1y ago
  Jails were explicitly designed for security, cgroups were more generalized as more about resource control, and leverages namespaces, capabilities, apparmor/SELinux to accomplish what they do. > Jails create a safe environment independent from the rest of the system. Processes created in this environment cannot access files or resources outside of it.[1] While you can accomplish similar tasks, they are not equivalent. Assume Linux containers are jails, and you will have security problems. And on the flip side, k8s pods share UTM,IPC, Network namespaces, yet have independent PID and FS namespaces. Depending on your use case they may be roughly equivalent, but they are fundamentally different approaches. [1] https://freebsdfoundation.org/freebsd-project/resources/introduction-to-freebsd-jails/ https://freebsdfoundation.org/freebsd-project/resources/intr...
AdieuToLogic 1y ago
> BSD jails are architected wholly differently from what something like Docker provides. > Jails are first-class citizens that are baked deep into the system. Both very true statements and worth remembering when considering: > Additionally, iirc, the logic for FreeBSD jails never made it into the Darwin kernel. You are quite correct, as Darwin is is based on XNU[0], which itself has roots in the Mach[1] microkernel. Since XNU[0] is an entirely different OS architecture than that of FreeBSD[3], jails[4] do not exist within it. The XNU source can be found here[2]. 0 - https://en.wikipedia.org/wiki/XNU https://en.wikipedia.org/wiki/XNU 1 - https://en.wikipedia.org/wiki/Mach_(kernel) https://en.wikipedia.org/wiki/Mach_(kernel) 2 - https://github.com/apple-oss-distributions/xnu https://github.com/apple-oss-distributions/xnu 3 - https://cgit.freebsd.org/src/ https://cgit.freebsd.org/src/ 4 - https://man.freebsd.org/cgi/man.cgi?query=jail&apropos=0&sektion=0&manpath=FreeBSD+14.3-RELEASE&arch=default&format=html https://man.freebsd.org/cgi/man.cgi?query=jail&apropos=0&sek...
- bandoti 1y ago
  Thank you for the links I will take a closer look at XNU. It’s neat to see how these projects influence each other.
  - AdieuToLogic 1y ago
    > Thank you for the links I will take a closer look at XNU. Another great resource regarding XNU and OS-X (although a bit dated now) is the book: Mac OS X Internals A Systems Approach[0] 0 - https://openlibrary.org/books/OL27440934M/Mac_OS_X_Internals https://openlibrary.org/books/OL27440934M/Mac_OS_X_Internals
- McAlpine5892 1y ago
  This is great! Thank you!

formerly_proven 1y ago

„Container“ is sort of synonymous with „OCI-compatible container“ these days, and OCI itself is basically a retcon standard for docker (runtime, images etc.). So from that perspective every „container system“ is necessarily „docker-like“ and that means Linux namespaces and cgroups.

pjmlp 1y ago
With a whole generation forgetting they came first in big iron UNIX like HP-UX.
- 9dev 1y ago
  Does it really matter, tho?
  - pjmlp 1y ago
    Some people think it matters to properly learn history, instead of urban myths.
    - 9dev 1y ago
      History is one thing, who-did-it-first is often just a way to make a point in faction debates. In the broader picture, it makes little difference IMHO.
  - bandoti 1y ago
    Another reason it matters is they might have done it differently which could inspire future improvements. :) I like to read bibliographies for that reason—to read books that inspired the author I’m reading at the time. Same goes for code and research papers!
- jeberle 1y ago
  Interesting. My experience w/ HP-UX was in the 90s, but this (Integrity Virtual Machines) was released in 2005. I might call out FreeBSD Jails (2000) or Solaris Zones (2005) as an earlier and a more significant case respectively. I appreciate the insight, though, never knew about HP-UX. https://en.wikipedia.org/wiki/HP_Integrity_Virtual_Machines https://en.wikipedia.org/wiki/HP_Integrity_Virtual_Machines

p_ing 1y ago

OS X pulls some components of FreeBSD into kernel space, but not all (and those are very old at this point). It also uses various BSD bits for userspace. Good read from horse mouth: https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/KernelProgramming/BSD/BSD.html https://developer.apple.com/library/archive/documentation/Da...

bandoti 1y ago
Thank you—I’ll give that a read. :)

sarlalian 1y ago

Another really good read about containers, jails and zones. https://blog.jessfraz.com/post/containers-zones-jails-vms/ https://blog.jessfraz.com/post/containers-zones-jails-vms/