8 ms·
To clarify a few comments here: this is not only OCI containers: container machines add support for persistence and filesystem mounting, making container machin
by timsneath 3mo ago
To clarify a few comments here: this is not only OCI containers: container machines add support for persistence and filesystem mounting, making container machines a great lightweight Linux environment for developers using macOS. More details here: https://developer.apple.com/videos/play/wwdc2026/389 https://developer.apple.com/videos/play/wwdc2026/389
- Onavo 3mo agoAh, the Darwin/BSD Subsystem for Linux.
- CGamesPlay 3mo agoNot quite, it’s still a VM. And while it supports virtio balloon for growing RAM, it doesn’t yet support releasing that RAM back to the host. And there isn’t a convenient way to shrink the sparse disk images as they grow yet, either.
- musicale 3mo agomacOS is basically already a POSIX subsystem for macOS, which is already a UNIX™. But (some) people still criticize it because it's not Linux or FreeBSD (though it is closer to the latter than the former).
- AlexB138 3mo agoIsn't the Windows subsystem for Linux (the reference there) also a VM?
- gsnedders 3mo agoOnly WSL2; WSL1 was an actual subsystem.
- selcuka 3mo agoSo this is Darwin/BSD Subsystem for Linux 2.
- rvz 3mo agoYes.
- LoganDark 3mo agoWSL1 was so cool, WSL2 made it boring and isolated.
- TylerE 3mo agoBack in my day you to to download a couple GB worth of cygwin, and that wasn't an actual environment, basically just a GNU toolchain compiled for windows. But it got you like....grep and bash and stuff that ran natively on windows which was kinda cool.
- _blk 3mo ago... Now it's just called git bash
- michaelsbradley 3mo agoJust install and use MSYS2, git bash is derived from it anyway, and a regular MSYS2 installation offers a lot more.
- noduerme 3mo agoCygwin was fun. I'd done zero development on Windows, but about 10 years ago I had to figure out how to deploy some nightly shell scripts across a bunch of local computers in a few dozen offices, where about 80% were MacOS and the rest were Windows. I don't remember exactly how I rigged it, but basically cygwin allowed me to keep the scripts as they were and trigger them in place, with a few small modifications. I never want to deal with that again ;) [edit] fwiw, Termux on Android is similarly a fun pseudo-environment. It's a nice and helpful toy.
- TylerE 3mo agoThe biggest issue I remember is directory seperators... windows of course using \ which bash would then interpret as an escape. Cygwin mostly papered over that from what I can recall, but it could lead to some weirdness, like sometimes you'd get C:\\path\\es\\like\\this
- pjmlp 3mo agoWSL 1 is long gone for all practical purposes, yet it still dominates conversations. Also everyone on FOSS gets it wrong, WSL wasn't a subsystem like classical Windows NT ones. It was based on Drawbridge research using picoprocesses, a new approach for library OSes. https://learn.microsoft.com/en-us/archive/blogs/wsl/pico-process-overview https://learn.microsoft.com/en-us/archive/blogs/wsl/pico-pro...
- embedding-shape 3mo ago> Also everyone on FOSS gets it wrong, WSL wasn't a subsystem like classical Windows NT ones. Everyone in FOSS? How about Microsoft got it wrong, since they actually named it The Windows Subsystem for Linux (WSL)? It wasn't the FOSS community who chose the name for them.
- pjmlp 3mo agoWhat has that to do with a version number and not keeping up with the times?
- embedding-shape 3mo agoWhat version number? WSL1 vs WSL2? I'm not sure if you see the quoted part. My comment is about the part that starts with "> " that you wrote earlier.
- jayd16 3mo agoMac Subsystem for Linux 2
- BodyCulture 3mo agoThis is not a problem at all as most Apple computers come with plenty of RAM and lots of disk space! We are so lucky that Apple engineers always think so differently into the future!
- alerighi 3mo agoAnd a limited VM, for example I look at the documentation and it's not possible to share USB devices with the VM, making it perfectly useless for doing embedded development where you have to connect to the boards with USB. I will continue to use UTM for that reason...
- mrpippy 3mo agoVirtualization.framework just gained USB passthrough support in macOS 27. It might be a niche feature for containers to add, but other VM software will likely add support soon.
- hedora 3mo agoSo, heavier than running docker in qemu?
- burnte 3mo agoWSL is a VM too, but that's still what this is. WSL for MacOS. It's great!
- pseudosavant 3mo agoExactly what I thought. The Mac equivalent to WSL. Which is a great thing for Mac devs. Lots of stuff expects Linux these days, not POSIX. Mach isn’t Linux.
- deleted 3mo ago[deleted]
- jjtheblunt 3mo ago> ... highly integrated Linux environment that works seamlessly on your Mac. ... Which kernel is running, and is it hosted in hypervisor.framework, as is done with UTM (when not using the qemu mode)?
- Scarbutt 3mo agoThe katas container kernel by default.
- bogantech 3mo ago> filesystem mounting How is this different to bind mounts
- jdub 3mo agoVery different: Linux running in a virtual machine can't bind mount into a macOS host's filesystem. So they use virtiofs.
- lxgr 3mo agoThis applies to both containers and container machines though, right?
- jdub 3mo agoContainers (those popularised on Linux by Docker) are built on Linux primitives like cgroups and namespaces, so they're running directly on the same kernel, same VFS, often the same FS, etc. Their isolation properties rely on (a) all those Linux features working as expected, and (b) the container runtime setting them up properly. Depending on your threat model, that's fine, but a lot of people (including me) will say that containers are not a security mechanism. But macOS requires[1] virtualisation for containers anyway; the security is just a bonus. [1] at least for a real Linux kernel...
- lxgr 3mo agoThe surface of an OS is definitely larger than that of many hypervisors, which is e.g. why browsers often provide their own much narrower sandbox. On the other hand, in other scenarios, people trust the security boundaries of their working as expected all the time, no? This is the basis of e.g. Android app isolation (every app runs under its own Linux UID/GID), and true multi-user Unix systems trusting the OS's security boundaries to hold have decades of history.
- jdub 3mo agoDifferent threat models. Your typical Android device (and Linux server for that matter, at home or at scale) is not usually running security-sensitive general workloads for multiple tenants in the same OS instance. :-)
- oulipo2 3mo agohow does that compare to something like, eg, Orbstack?
- CaptainCyber99 3mo agoStill feels like a apple-ified microvm
- jt2190 3mo ago> container runs containers differently. Using the open source Containerization package, it runs a lightweight VM for each container that you create. This approach has the following properties: > - Security: Each container has the isolation properties of a full VM, using a minimal set of core utilities and dynamic libraries to reduce resource utilization and attack surface. > - Privacy: When sharing host data using container, you mount only necessary data into each VM. With a shared VM, you need to mount all data that you may ever want to use into the VM, so that it can be mounted selectively into containers. > -Performance: Containers created using container require less memory than full VMs, with boot times that are comparable to containers running in a shared VM. More details, including technical limitations (they’re looking for bug reports and contributions): “Container: Technical Overview” https://github.com/apple/container/blob/main/docs/technical-overview.md https://github.com/apple/container/blob/main/docs/technical-...
- mikepurvis 3mo agoSounds like a lot of the same choices/compromises that are in wsl2.
- sqquima 3mo agoYes, this looks similar to wslc announced at Microsoft Build. They should have joined forces, Apple and Microsoft. Can you imagine?
- parl_match 3mo agoYou mean like for the first 20 years or so of Apple and Microsoft's history?