Hacker News Reader

Comment by fiddlerwoaroof | Hacker News Reader

Is there anyway to make docker-style Darwin containers?

I don't think Mac/Darwin has cgroups but it's based on BSD to it might have jails?

So my somewhat shaky understanding is that Apple does have some form of jails in Darwin, because they use it on iOS (hence, "jailbreaking"), but for some reason doesn't ship it in desktop Darwin (aka macOS).

As far as I'm aware, macOS' sandbox isn't like the kernel namespaces and cgroups available on Linux.

It exists on macOS but doesn’t support the mount namespacing you’d need to create something like a docker container on macOS.

> Apple does have some form of jails in Darwin

Thinking about the names Apple might call this tech is amusing, with their use of ‘me’ ‘I’ ‘Apple’ etc. I assume ‘Jail’ wouldn’t be in the name.

iSolation

Apple’s sandbox focuses on isolating the OS from non-platform binaries. It doesn’t have namespaces or cgroups.

Jailbreaking on iOS is mostly about that sandbox. It doesn’t relate to BSD jails.

On macOS, Apple made the sandbox more lenient and implemented it a bit differently than on iOS. But both have roughly the same goals. They’re also alike in that both use the same kernel-level framework (MACF) to do their job.

But the MACF is completely off-limits to everyone outside Apple. Not even accredited kext developers can use it. So I think that no one except Apple could possibly add container-style isolation to macOS.

A lot of people assume that, but it's only partially true.

Darwin's userland is taken from FreeBSD, the kernel is from NeXTSTEP, although it also borrowed some things from FreeBSD, but I don't think they incorporated jails[1].

[1] https://github.com/apple/darwin-xnu/search?q=jail

XNU itself is Mach plus a BSD "personality" taken from FreeBSD[1].

[1] https://developer.apple.com/library/archive/documentation/Da...

You are right, although doesn't look like jails was included.

Yeah, it feels like only the minimum needed for Unixy BSD support was adopted from FreeBSD and included in XNU and the userland.

The thing that’s a bit surprising to me is that this didn’t include FreeBSD’s Linux emulation

I don't think it is, they started with NeXTSTEP as a base and just copied interesting bits from FreeBSD. If FreeBSD was the base then that would be surprising.

Darwin and MacOS aren't really all that related to NeXTSTEP, on purpose.

NeXTSTEP had proprietary UNIX code in it, and required a UNIX license from AT&T to distribute. Additionally, the display manager (infamously) was based on Display Postscript, which also required a license from Adobe.

My understanding (which is by no means 100% certain! the following is my best guess) is XNU and Darwin were almost complete "rewrites" of NeXTSTEP, preserving the "idea" but with new code.

NeXT's Mach 2 based kernel and BSD userland, which seems to have been very similar to the system developed by Avie Tevanian at CMU and used on their VAXen, was replaced with XNU, which used a Mach 3 derivative from DEC's OSF/1 project, coupled with a new (non-AT&T encumbered!) BSD userland and kernel "module"/personality based on an amalgam of then forks of 4.4BSD-Lite/386BSD, namely FreeBSD and NetBSD (several big bits of libc are from NetBSD).

Point being, I doubt they've copied/pasted large chunks of Free/NetBSD into Darwin/XNU since the late 90s/early 2000s. There was been code flow between the two, but I doubt they'd backport big features like jails (and linux emulation).

(not to mention that Apple's own MACF framework seems to take the place of jails in the code -- see https://github.com/apple/darwin-xnu/blob/main/bsd/kern/kern_... vs https://github.com/freebsd/freebsd-src/blob/main/sys/kern/ke...)

MacOS doesn't have jails as FreeBSD does. But they are using some kind of isolation for Mac applications, so they can not see data of other applications.

I don't see reason why it wouldn't be possible. Windows did just that.

Although at that point having x86_64-linux, x86_64-windows and armv8-darwin would further remove benefits of docker reducing it to a fancy tarball.

The closest you're probably going to get is sandbox-exec https://jmmv.dev/2019/11/macos-sandbox-exec.html

Probably should look at https://veertu.com/

Are those containers or VMs?

They’re VMs. It’s based on the Hypervisor.framework, so it’s actually faster than I thought, but it’s VMs.

Do you know if the VMs have accelerated graphics? The new version of Hypervisor.framework in 12.x supports accelerated macOS guests but I didn't know if they figured out a way to do it without Apple's tricks.

(https://developer.apple.com/documentation/virtualization/vzm... is the best citation I have, unfortuately)

Reply on news.ycombinator.com