5 ms·
To clarify a few comments here: this is not only OCI containers: container machines add support for persistence and filesystem mounting, making container machin
by timsneath 4mo ago
To clarify a few comments here: this is not only OCI containers: container machines add support for persistence and filesystem mounting, making container machines a great lightweight Linux environment for developers using macOS. More details here: https://developer.apple.com/videos/play/wwdc2026/389 https://developer.apple.com/videos/play/wwdc2026/389
- Onavo 4mo agoAh, the Darwin/BSD Subsystem for Linux.
- CGamesPlay 4mo agoNot quite, it’s still a VM. And while it supports virtio balloon for growing RAM, it doesn’t yet support releasing that RAM back to the host. And there isn’t a convenient way to shrink the sparse disk images as they grow yet, either.
- AlexB138 4mo agoIsn't the Windows subsystem for Linux (the reference there) also a VM?
- gsnedders 4mo agoOnly WSL2; WSL1 was an actual subsystem.
- selcuka 4mo agoSo this is Darwin/BSD Subsystem for Linux 2.
- rvz 4mo agoYes.
- LoganDark 4mo agoWSL1 was so cool, WSL2 made it boring and isolated.
- TylerE 4mo agoBack in my day you to to download a couple GB worth of cygwin, and that wasn't an actual environment, basically just a GNU toolchain compiled for windows. But it got you like....grep and bash and stuff that ran natively on windows which was kinda cool.
- _blk 4mo ago... Now it's just called git bash
- michaelsbradley 4mo agoJust install and use MSYS2, git bash is derived from it anyway, and a regular MSYS2 installation offers a lot more.
- noduerme 4mo agoCygwin was fun. I'd done zero development on Windows, but about 10 years ago I had to figure out how to deploy some nightly shell scripts across a bunch of local computers in a few dozen offices, where about 80% were MacOS and the rest were Windows. I don't remember exactly how I rigged it, but basically cygwin allowed me to keep the scripts as they were and trigger them in place, with a few small modifications. I never want to deal with that again ;) [edit] fwiw, Termux on Android is similarly a fun pseudo-environment. It's a nice and helpful toy.
- TylerE 4mo agoThe biggest issue I remember is directory seperators... windows of course using \ which bash would then interpret as an escape. Cygwin mostly papered over that from what I can recall, but it could lead to some weirdness, like sometimes you'd get C:\\path\\es\\like\\this
- pjmlp 4mo agoWSL 1 is long gone for all practical purposes, yet it still dominates conversations. Also everyone on FOSS gets it wrong, WSL wasn't a subsystem like classical Windows NT ones. It was based on Drawbridge research using picoprocesses, a new approach for library OSes. https://learn.microsoft.com/en-us/archive/blogs/wsl/pico-process-overview https://learn.microsoft.com/en-us/archive/blogs/wsl/pico-pro...
- embedding-shape 4mo ago> Also everyone on FOSS gets it wrong, WSL wasn't a subsystem like classical Windows NT ones. Everyone in FOSS? How about Microsoft got it wrong, since they actually named it The Windows Subsystem for Linux (WSL)? It wasn't the FOSS community who chose the name for them.
- pjmlp 4mo agoWhat has that to do with a version number and not keeping up with the times?
- embedding-shape 4mo agoWhat version number? WSL1 vs WSL2? I'm not sure if you see the quoted part. My comment is about the part that starts with "> " that you wrote earlier.
- jayd16 4mo agoMac Subsystem for Linux 2
- BodyCulture 4mo agoThis is not a problem at all as most Apple computers come with plenty of RAM and lots of disk space! We are so lucky that Apple engineers always think so differently into the future!
- alerighi 4mo agoAnd a limited VM, for example I look at the documentation and it's not possible to share USB devices with the VM, making it perfectly useless for doing embedded development where you have to connect to the boards with USB. I will continue to use UTM for that reason...
- mrpippy 4mo agoVirtualization.framework just gained USB passthrough support in macOS 27. It might be a niche feature for containers to add, but other VM software will likely add support soon.
- hedora 4mo agoSo, heavier than running docker in qemu?
- burnte 4mo agoWSL is a VM too, but that's still what this is. WSL for MacOS. It's great!
- musicale 3mo agomacOS is basically already a POSIX subsystem for macOS, which is already a UNIX™. But (some) people still criticize it because it's not Linux or FreeBSD (though it is closer to the latter than the former).
- pseudosavant 4mo agoExactly what I thought. The Mac equivalent to WSL. Which is a great thing for Mac devs. Lots of stuff expects Linux these days, not POSIX. Mach isn’t Linux.
- deleted 4mo ago[deleted]
- jjtheblunt 4mo ago> ... highly integrated Linux environment that works seamlessly on your Mac. ... Which kernel is running, and is it hosted in hypervisor.framework, as is done with UTM (when not using the qemu mode)?
- Scarbutt 4mo agoThe katas container kernel by default.
- bogantech 4mo ago> filesystem mounting How is this different to bind mounts
- jdub 4mo agoVery different: Linux running in a virtual machine can't bind mount into a macOS host's filesystem. So they use virtiofs.
- lxgr 4mo agoThis applies to both containers and container machines though, right?
- jdub 4mo agoContainers (those popularised on Linux by Docker) are built on Linux primitives like cgroups and namespaces, so they're running directly on the same kernel, same VFS, often the same FS, etc. Their isolation properties rely on (a) all those Linux features working as expected, and (b) the container runtime setting them up properly. Depending on your threat model, that's fine, but a lot of people (including me) will say that containers are not a security mechanism. But macOS requires[1] virtualisation for containers anyway; the security is just a bonus. [1] at least for a real Linux kernel...
- lxgr 4mo agoThe surface of an OS is definitely larger than that of many hypervisors, which is e.g. why browsers often provide their own much narrower sandbox. On the other hand, in other scenarios, people trust the security boundaries of their working as expected all the time, no? This is the basis of e.g. Android app isolation (every app runs under its own Linux UID/GID), and true multi-user Unix systems trusting the OS's security boundaries to hold have decades of history.
- jdub 4mo agoDifferent threat models. Your typical Android device (and Linux server for that matter, at home or at scale) is not usually running security-sensitive general workloads for multiple tenants in the same OS instance. :-)
- oulipo2 4mo agohow does that compare to something like, eg, Orbstack?
- CaptainCyber99 4mo agoStill feels like a apple-ified microvm
- jt2190 4mo ago> container runs containers differently. Using the open source Containerization package, it runs a lightweight VM for each container that you create. This approach has the following properties: > - Security: Each container has the isolation properties of a full VM, using a minimal set of core utilities and dynamic libraries to reduce resource utilization and attack surface. > - Privacy: When sharing host data using container, you mount only necessary data into each VM. With a shared VM, you need to mount all data that you may ever want to use into the VM, so that it can be mounted selectively into containers. > -Performance: Containers created using container require less memory than full VMs, with boot times that are comparable to containers running in a shared VM. More details, including technical limitations (they’re looking for bug reports and contributions): “Container: Technical Overview” https://github.com/apple/container/blob/main/docs/technical-overview.md https://github.com/apple/container/blob/main/docs/technical-...
- mikepurvis 4mo agoSounds like a lot of the same choices/compromises that are in wsl2.
- sqquima 4mo agoYes, this looks similar to wslc announced at Microsoft Build. They should have joined forces, Apple and Microsoft. Can you imagine?
- parl_match 4mo agoYou mean like for the first 20 years or so of Apple and Microsoft's history?