HackerTrans
TopNewTrendsCommentsPastAskShowJobs

slonopotamus

no profile record

comments

slonopotamus
·3 yıl önce·discuss
If you want to follow my upstream attempts, subscribe to

https://github.com/moby/buildkit/pull/4059

https://github.com/moby/moby/pull/46558
slonopotamus
·3 yıl önce·discuss
You mean, Earthly has macOS arm64 runners? I am failing to find any info on its website.
slonopotamus
·3 yıl önce·discuss
Okay, let's call them "labeled code snapshots")
slonopotamus
·3 yıl önce·discuss
Haha, what a mess)
slonopotamus
·3 yıl önce·discuss
Yeah, I undestand the situation with #8789.
slonopotamus
·3 yıl önce·discuss
It's not me, it's containerd "native" snapshotter. It turns to be efficient on macOS thanks to `clonefile` syscall.
slonopotamus
·3 yıl önce·discuss
> Technical limitations aren’t excuses for a bad design.

Tomorrow Apple might decide it is safe to chroot with SIP enabled (I actually do not understand why they restrict it, chroot is a tool to increase security). Does that suddenly convert bad design into a good design? But this is exactly the same design.
slonopotamus
·3 yıl önce·discuss
One might develop a game that by some kind of a miracle releases for macOS too. So they way to run CI tests on macOS. Or they might target iOS. And use macOS build machines to produce builds. The world is not only about web, you know?
slonopotamus
·3 yıl önce·discuss
OrbStack is about Linux containers. What we're talking about in this topic is the only software in the world for macOS containers.
slonopotamus
·3 yıl önce·discuss
> My preferred course of action in such situations is not specify a version at all.

This doesn't work because, well, I do make releases and they need some numbers)
slonopotamus
·3 yıl önce·discuss
FUSE is only used for bind mounts. If you write to a directory that belongs to container, you get the raw speed of host OS.
slonopotamus
·3 yıl önce·discuss
I believe that could be optimized in the future. At least, by splitting amd64/arm64 code.
slonopotamus
·3 yıl önce·discuss
This is a failed attempt to upstream part of containerd changes: https://github.com/containerd/containerd/pull/8789

Other part of containerd changes waits for gods-know-what: https://github.com/containerd/containerd/pull/9054

But I haven't gave up yet.
slonopotamus
·3 yıl önce·discuss
> macOS doesn't provide a stable system call API

I'm really wondering, do you have any links about macOS syscall stability over versions?
slonopotamus
·3 yıl önce·discuss
SIP won't save you from wrong file permissions.

And SIP doesn't defend you from editing files in /bin. They are guarded by the fact that root filesystem is mounted read-only.
slonopotamus
·3 yıl önce·discuss
Original author here. I wanted to clearly indicate early-prealpha-unstable-not-for-production-yet state of this software. Using "1.0.0" and even "1.0.0-alpha" would give false expectations about maturity of this project.
slonopotamus
·3 yıl önce·discuss
No. For the same reason you cannot run Windows containers on Linux. You need a working macOS kernel.
slonopotamus
·3 yıl önce·discuss
> But most it’s still very niche.

I'd say that the whole containerization topic is niche

> Is there a way to make a separate partition of MacOS and have one copy with SIP and one without?

I think you can install macOS VM on your macOS host and disable SIP _inside VM_.
slonopotamus
·3 yıl önce·discuss
> Who would use that and for what?

I believe this project can be useful for CI and testing scenarios.

> On MacOS desktop software distribution is largely a solved problem since ages

Are you talking about App Store? Or Homebrew? Or MacPorts? Or... Wait, isn't this too many tools for a problem that was solved?
slonopotamus
·3 yıl önce·discuss
> Also not sure if it can be dynamically set by a parent process for a child?

Yes, it can. See sandbox-exec tool. And I actually plan to use it: https://github.com/macOScontainers/rund/issues/15