News for hackers. Stuff that matters.

A comment on Sailor, a native and portable container system for NetBSD and Mac OS X.

Re:Sailor, a native and portable container system for NetBSD... by noselasd on Saturday January 16, 2016 @09:16AM (#10915300)
While neat and useful - is it fair to call this a container ? It seems to only partition/isolate the filesystem(perhaps network interface too) - while (arguably) the benefit of containers is being able to also partition and isolate CPU, memory, network, routing, etc.
[ Parent | on HN ]
Re:Sailor, a native and portable container system for NetBSD... by jacques_chester on Saturday January 16, 2016 @10:29AM (#10915491)
Smarter people than me say that "true" containerizing on OS X is not really a thing[1].

[1] https://github.com/vito/houdini

[ Parent | on HN ]
Re:Sailor, a native and portable container system for NetBSD... by geofft on Saturday January 16, 2016 @12:26PM (#10915919)
OS X doesn't provide kernel features directly equivalent to Linux's CLONE_* and cgroups. But it does provide Seatbelt, a sandboxing policy layer, which you could use with effort to implement something similar in end result. This is what both iOS apps and desktop App Store apps use for security isolation.

Alternatively, you could ship a kernel module that added these features (although that might be ridiculously complicated).

[ Parent | on HN ]
Re:Sailor, a native and portable container system for NetBSD... by jacques_chester on Saturday January 16, 2016 @01:05PM (#10916112)
Alex (aka vito) likes implementing things from scratch on weekends. So if you surprised him with a github issue he might just take you up on that challenge.
[ Parent | on HN ]
Re:Sailor, a native and portable container system for NetBSD... by geggam on Saturday January 16, 2016 @09:46AM (#10915371)
The cpu / memory / network "isolation" is done with cgroups and can be done without containers
[ Parent | on HN ]
Re:Sailor, a native and portable container system for NetBSD... by vidarh on Saturday January 16, 2016 @10:48AM (#10915560)
cgroups are Linux-specific - they're not relevant for a OS X/NetBSD tool.
[ Parent | on HN ]
Re:Sailor, a native and portable container system for NetBSD... by geggam on Saturday January 16, 2016 @11:54AM (#10915779)
no kidding ? sarcasm

They also don't isolate anything. especially when the container system is running as root. Neither does chroot.

[ Parent | on HN ]