3 ms·

My only experience with VMs on macOS is colima+docker, and it's relatively painful and inefficient (but usable).

embedding-shape 6mo ago
Recently got a Mac Mini for local CI purposes (together with Forgejo Actions), took a broad look at the ecosystem and decided to just roll with "build on host" instead. Setting up signing/notarization just looked like an insurmountably task together with isolating it from the host, even with agents. At least the macOS builds are really fast now and the signing/notarization just ~200 lines of Bash...
- latexr 6mo ago
  > the signing/notarization just ~200 lines of Bash 200 lines?! That’s two orders of magnitude too many. What exactly are you doing that you need so such code for signing and notarisation?
  - embedding-shape 6mo ago
    From the top of my head, unlocking the keychain, finding the right identity, notarizing two parts, the binary itself and the .dmg that the .app ships in and some other stuff I'm sure. Can do a deeper look in a bit when I can. Most of the hassle is because it's 100% unattended and I had to do stuff to avoid GUI-prompts for passwords/unlocks, and that the Forgejo Runner has a different security context.
    - hamandcheese 6mo ago
      This matches my experience. Keychain + fully unattended increases the complexity and adds a bunch of landmines that need to be dodged (e.g. GUI prompts like you mentioned).
    - latexr 6mo ago
      > unlocking the keychain, finding the right identity You don’t need to do that, you can give options to the CLI to define what profile to use. > Most of the hassle is because it's 100% unattended and I had to do stuff to avoid GUI-prompts for passwords/unlocks I have a shell function to which I point my code and it compiles, signs, and notarises it without any more intervention, GUI or password prompts, and I’m pretty sure signing and notarising are literally two lines. Unfortunately I’m not at my computer now or I’d paste them, but from your description that script is definitely too long.
      - saagarjha 6mo ago
        I assume you're using notarytool but I doubt that it will work unless you have your keychain unlocked
- yohannparis 6mo ago
  Could you share your recipe please ? I’m interested
woadwarrior01 6mo ago
Try Apple's container CLI. I moved a project of mine from colima+docker to it relatively easily, a couple of weekends ago. https://github.com/apple/container https://github.com/apple/container
- yokoprime 6mo ago
  Thank you for this, will check it out!
- highpost 6mo ago
  Here's an example of how to build a simple Alpine Linux container using Apple's containerization CLI. It also demonstrates how to connect to the container through Tailscale SSH using a Tailscale auth key stored in Apple Keychain: https://github.com/highpost/tailscale-macos-container https://github.com/highpost/tailscale-macos-container
  - e40 6mo ago
    Why would this be preferred over the Tailscale macOS app? What are the advantages of this method? Thanks.
    - highpost 6mo ago
      The macOS app manages the host Tailscale service, while this example demonstrates how to connect with a *macOS container* using Tailscale SSH based on the Tailscale service under userspace networking mode. This gives the container its own dedicated Tailnet IP and identity without needing to port-forward through the host. edit: For example, I can create a container on my MacBook to run an application. A colleague *in my Tailnet* can then connect to this container to interact with that application from a coffeeshop or airliner while not exposing the rest of my MacBook.
      - e40 6mo ago
        Thanks for the answer. I understand now.
isityettime 6mo ago
OrbStack is pretty good. I don't find it inefficient, really.
- CraigJPerry 6mo ago
  OrbStack is impressive on the performance and energy efficiency fronts. I'm not aware of anything that comes close. But they're doing something funky under the covers. You can't just start any OS in a VM. It has to be somehow mangled to suit their VM. Thankfully NixOS is available so I'm fine for my use cases. It's still remarkable how efficient it is.
  - isityettime 6mo ago
    Yeah, it's like WSL. It starts just one VM and then your individual "machines" are LXC containers underneath. If you peek at the vendor-supplied file your NixOS OrbStack Machine includes you can see some of it. They're constantly doing other optimizations in other ways, too. But that's the one you were pointing at, I think.
    - mgaunard 6mo ago
      That's also what Colima does. OrbStack isn't open-source though and I can't justify buying a license for every single person in my company just for something functionally equivalent but performing better. These kinds of things should just be provided by Apple as a first-class thing.
sharts 6mo ago
I use limactl. What’s so inefficient/painful about colima?

Recently got a Mac Mini for local CI purposes (together with Forgejo Actions), took a broad look at the ecosystem and decided to just roll with "build on host" instead. Setting up signing/notarization just looked like an insurmountably task together with isolating it from the host, even with agents. At least the macOS builds are really fast now and the signing/notarization just ~200 lines of Bash...

latexr 6mo ago
> the signing/notarization just ~200 lines of Bash 200 lines?! That’s two orders of magnitude too many. What exactly are you doing that you need so such code for signing and notarisation?
- embedding-shape 6mo ago
  From the top of my head, unlocking the keychain, finding the right identity, notarizing two parts, the binary itself and the .dmg that the .app ships in and some other stuff I'm sure. Can do a deeper look in a bit when I can. Most of the hassle is because it's 100% unattended and I had to do stuff to avoid GUI-prompts for passwords/unlocks, and that the Forgejo Runner has a different security context.
  - hamandcheese 6mo ago
    This matches my experience. Keychain + fully unattended increases the complexity and adds a bunch of landmines that need to be dodged (e.g. GUI prompts like you mentioned).
  - latexr 6mo ago
    > unlocking the keychain, finding the right identity You don’t need to do that, you can give options to the CLI to define what profile to use. > Most of the hassle is because it's 100% unattended and I had to do stuff to avoid GUI-prompts for passwords/unlocks I have a shell function to which I point my code and it compiles, signs, and notarises it without any more intervention, GUI or password prompts, and I’m pretty sure signing and notarising are literally two lines. Unfortunately I’m not at my computer now or I’d paste them, but from your description that script is definitely too long.
    - saagarjha 6mo ago
      I assume you're using notarytool but I doubt that it will work unless you have your keychain unlocked
yohannparis 6mo ago
Could you share your recipe please ? I’m interested

woadwarrior01 6mo ago

Try Apple's container CLI. I moved a project of mine from colima+docker to it relatively easily, a couple of weekends ago. https://github.com/apple/container https://github.com/apple/container

yokoprime 6mo ago
Thank you for this, will check it out!
highpost 6mo ago
Here's an example of how to build a simple Alpine Linux container using Apple's containerization CLI. It also demonstrates how to connect to the container through Tailscale SSH using a Tailscale auth key stored in Apple Keychain: https://github.com/highpost/tailscale-macos-container https://github.com/highpost/tailscale-macos-container
- e40 6mo ago
  Why would this be preferred over the Tailscale macOS app? What are the advantages of this method? Thanks.
  - highpost 6mo ago
    The macOS app manages the host Tailscale service, while this example demonstrates how to connect with a *macOS container* using Tailscale SSH based on the Tailscale service under userspace networking mode. This gives the container its own dedicated Tailnet IP and identity without needing to port-forward through the host. edit: For example, I can create a container on my MacBook to run an application. A colleague *in my Tailnet* can then connect to this container to interact with that application from a coffeeshop or airliner while not exposing the rest of my MacBook.
    - e40 6mo ago
      Thanks for the answer. I understand now.

isityettime 6mo ago

OrbStack is pretty good. I don't find it inefficient, really.

CraigJPerry 6mo ago
OrbStack is impressive on the performance and energy efficiency fronts. I'm not aware of anything that comes close. But they're doing something funky under the covers. You can't just start any OS in a VM. It has to be somehow mangled to suit their VM. Thankfully NixOS is available so I'm fine for my use cases. It's still remarkable how efficient it is.
- isityettime 6mo ago
  Yeah, it's like WSL. It starts just one VM and then your individual "machines" are LXC containers underneath. If you peek at the vendor-supplied file your NixOS OrbStack Machine includes you can see some of it. They're constantly doing other optimizations in other ways, too. But that's the one you were pointing at, I think.
  - mgaunard 6mo ago
    That's also what Colima does. OrbStack isn't open-source though and I can't justify buying a license for every single person in my company just for something functionally equivalent but performing better. These kinds of things should just be provided by Apple as a first-class thing.

sharts 6mo ago

I use limactl. What’s so inefficient/painful about colima?