So my somewhat shaky understanding is that Apple does have some form of jails in Darwin, because they use it on iOS (hence, "jailbreaking"), but for some reason doesn't ship it in desktop Darwin (aka macOS).

Apple’s sandbox focuses on isolating the OS from non-platform binaries. It doesn’t have namespaces or cgroups.

Jailbreaking on iOS is mostly about that sandbox. It doesn’t relate to BSD jails.

On macOS, Apple made the sandbox more lenient and implemented it a bit differently than on iOS. But both have roughly the same goals. They’re also alike in that both use the same kernel-level framework (MACF) to do their job.

But the MACF is completely off-limits to everyone outside Apple. Not even accredited kext developers can use it. So I think that no one except Apple could possibly add container-style isolation to macOS.

As far as I'm aware, macOS' sandbox isn't like the kernel namespaces and cgroups available on Linux.

> Apple does have some form of jails in Darwin

Thinking about the names Apple might call this tech is amusing, with their use of ‘me’ ‘I’ ‘Apple’ etc. I assume ‘Jail’ wouldn’t be in the name.

iSolation

It exists on macOS but doesn’t support the mount namespacing you’d need to create something like a docker container on macOS.

A lot of people assume that, but it's only partially true.

Darwin's userland is taken from FreeBSD, the kernel is from NeXTSTEP, although it also borrowed some things from FreeBSD, but I don't think they incorporated jails[1].

[1] https://github.com/apple/darwin-xnu/search?q=jail

XNU itself is Mach plus a BSD "personality" taken from FreeBSD[1].

[1] https://developer.apple.com/library/archive/documentation/Da...

You are right, although doesn't look like jails was included.

Darwin and MacOS aren't really all that related to NeXTSTEP, on purpose.

NeXTSTEP had proprietary UNIX code in it, and required a UNIX license from AT&T to distribute. Additionally, the display manager (infamously) was based on Display Postscript, which also required a license from Adobe.

My understanding (which is by no means 100% certain! the following is my best guess) is XNU and Darwin were almost complete "rewrites" of NeXTSTEP, preserving the "idea" but with new code.

NeXT's Mach 2 based kernel and BSD userland, which seems to have been very similar to the system developed by Avie Tevanian at CMU and used on their VAXen, was replaced with XNU, which used a Mach 3 derivative from DEC's OSF/1 project, coupled with a new (non-AT&T encumbered!) BSD userland and kernel "module"/personality based on an amalgam of then forks of 4.4BSD-Lite/386BSD, namely FreeBSD and NetBSD (several big bits of libc are from NetBSD).

Point being, I doubt they've copied/pasted large chunks of Free/NetBSD into Darwin/XNU since the late 90s/early 2000s. There was been code flow between the two, but I doubt they'd backport big features like jails (and linux emulation).

(not to mention that Apple's own MACF framework seems to take the place of jails in the code -- see https://github.com/apple/darwin-xnu/blob/main/bsd/kern/kern_... vs https://github.com/freebsd/freebsd-src/blob/main/sys/kern/ke...)

Yeah, it feels like only the minimum needed for Unixy BSD support was adopted from FreeBSD and included in XNU and the userland.

The thing that’s a bit surprising to me is that this didn’t include FreeBSD’s Linux emulation

I don't think it is, they started with NeXTSTEP as a base and just copied interesting bits from FreeBSD. If FreeBSD was the base then that would be surprising.

MacOS doesn't have jails as FreeBSD does. But they are using some kind of isolation for Mac applications, so they can not see data of other applications.