[HN Gopher] Docker-OSX: Run macOS VM in a Docker
___________________________________________________________________
Docker-OSX: Run macOS VM in a Docker
Author : axiomdata316
Score : 425 points
Date : 2023-01-13 22:20 UTC (1 days ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| stevebmark wrote:
| Should this work on Mac (using Docker Desktop for Mac)? I don't
| see why not, but trying to run it results in:
|
| > docker: Error response from daemon: error gathering device
| information while adding custom device "/dev/kvm": no such file
| or directory.
| bityard wrote:
| KVM is a Linux hypervisor
| stevebmark wrote:
| I don't follow. Docker for Mac uses a Linux VM
| pxc wrote:
| It's hardware-accelerated paravirtualization. You can't
| just use that inside an arbitrary VM. Every layer
| (hardware, host OS, every guest OS but the last in the
| chain) has to support 'nested virtualization', and you have
| to enable/configure it.
|
| On Linux, this project doesn't require nested
| virtualization. On any other operating system, it does. In
| that way, the host OS ends up mattering.
|
| Docker Desktop makes me wanna scream.
| [deleted]
| cpuguy83 wrote:
| It's possible docker4mac doesn't enable nested virt?
| moondev wrote:
| Fun fact: apple silicon doesn't support nested virt
| stevebmark wrote:
| I'm on intel fwiw
| saagarjha wrote:
| New Apple silicon devices do, but it's not exposed yet.
| britneybitch wrote:
| I hate to give Apple any ideas... but I've always wondered why
| macOS/iOS support falling back to software rendering, when all of
| their devices ship with a known GPU configuration. Without that
| fallback, getting the OS running on non-Apple hardware would take
| a lot more work.
| cmeacham98 wrote:
| Apple has documentation on installing OS X in a VM:
| https://developer.apple.com/documentation/virtualization/ins...
|
| While _this_ usecase obviously isn't officially supported, it
| does seem like they support VMs in some capacity officially.
| sigjuice wrote:
| This document is about running macOS in a VM on Apple's own
| hypervisor. Wouldn't this count as official support?
| OJFord wrote:
| GP's ' _this_ ' refers to the submission, i.e. macOS in a
| container. (Aside: I hate 'a Docker', a Docker what? Image?
| Container? Registry?)
| naikrovek wrote:
| yeah, "a Docker" is incomplete and incorrect. and
| annoying. It could have been a character limitation, I
| guess, but edit it down so it makes sense instead of just
| ending the sentence prematurely.
|
| "Do you have a Facebook? Or an insta?"
|
| No one cares about correctness at all, anymore.
| chrisweekly wrote:
| It's a Docker on the intertubes, I can't even.
| dylan604 wrote:
| Who calls it instagram? Like Reebok->RBK. Only old out of
| touch people say instagram or reebok
| Fnoord wrote:
| And that is how we descended to the madness of the word
| crypto.
| nipponese wrote:
| I would have loved to ask Turning if he (p)owned any
| crypto, and then told him it was "up" 5% today.
| jbverschoor wrote:
| ig.. insta.. oh you mean instacart? or did you mean to
| say 'the gram' ?
|
| These abbreviations are location/culture dependent. For
| example, here when you say "I'll app you", it means
| sending a message on whatsapp.
| NikolaNovak wrote:
| I honestly don't know if that is sarcasm. If not I'm
| gleefully both old and out of touch :-)
|
| P.S. For bonus points, ask me how I pronounce INXS :-D
| rstupek wrote:
| I pronounced it inks for the longest time
| dylan604 wrote:
| that's an interesting take on it. we cant get INXS, but
| we're okay wth the omttng lettrs in modrn compny names
| and terms lke ROTFLMAO
| rideontime wrote:
| What letter is omitted from "ROTFLMAO"?
| dylan604 wrote:
| like, a whole bunch: olling n he loor aughing y ss ff to
| spell it out. obviously, some letters are used more than
| once, so my math teacher will deduct points for not
| reducing the fraction.
| IncRnd wrote:
| You missed the firetruck letter that your parent poster
| had likely indicated.
| dylan604 wrote:
| It is and isn't. Just like the state of an electron. To
| truly know if it is sarcasm or not, it will cost you one
| cat.
|
| However, it's no less serious than the GGP's arms in the
| air upsettedness about calling the 'gram insta. oops,
| see, i called it two different shortened names back-to-
| back. uh-oh, somebody's going to be upset!! ;-)
|
| If you don't pronounce INXS as INXS, you're doing it
| wrong.
|
| Edit: the name I just gave up trying to understand is
| Musk's kid's name. talking about a name that a kid will
| grow up to resent their parents about.
| [deleted]
| easton wrote:
| I wonder if that's GPU accelerated, the last time I used a
| macOS VM on a Mac it wasn't, but it wasn't with the newest
| version of the hypervisor.
| saagarjha wrote:
| It is. There's a paravirtualized Metal driver.
| incrudible wrote:
| Without that fallback, getting the OS running on _Apple_
| hardware would take a lot more work, as well.
| spijdar wrote:
| Presumably they use it internally. IIRC there are drivers for
| VirtIO devices in modern MacOS, implying they use KVM/QEMU for
| something.
| smoldesu wrote:
| It's also used when you load into the recovery partition,
| IIRC. It may be redundant nowadays, but it's a nice
| redundancy to have for sure.
| ace2358 wrote:
| Makes sense to have that working if there are gpu hardware
| issues... which did happen for many years
| Eleison23 wrote:
| [dead]
| BudaDude wrote:
| I would imagine battery life may be a part of it
| Kab1r wrote:
| Everytime I tried to use this project, I ran into trouble with
| iCloud logins persisting across boots
| randompi wrote:
| But why? Whats the use case?
| stingraycharles wrote:
| I can imagine this being useful for CI builds, for instance. On
| the other hand, this is probably against Apple's license
| agreement, so businesses would want to stay away from it.
| fulafel wrote:
| Some people need to run macOS-only software, this potentially
| makes it a bit less painful than the alternatives for the same
| reason containerized versions of other finicky setups do.
|
| In the README there's a blurb with:
|
| > Run Mac OS X in Docker with near-native performance! X11
| Forwarding! iMessage security research! iPhone USB working!
| macOS in a Docker container!
|
| > Conduct Security Research on macOS using both Linux &
| Windows!
| c7DJTLrn wrote:
| Nitpick but macOS hasn't been "OS X" for many years now.
| aequitas wrote:
| This is a pet peeve of mine, just macOS is infinitely more
| searchable than all the ways you can spell Mac OS X, macosx,
| osx, OS X, mac-os-x, I've seen them all at least once. You
| either always and up with to much results because os and x
| match to many things, or to little because an exact match on
| Mac OS X excludes all the other ways people write it.
| timvisee wrote:
| Can this be (safely) used without an Apple developer account or
| signing a contract?
| mosselman wrote:
| Can you then install docker on that macos and run macos again
| within that docker?
| pfoof wrote:
| Microsoft supports Windows in Docker natively (assuming win host)
| so what the hell are they waiting for, this would help in CI so
| much
|
| *they = Apple
| TylerE wrote:
| They're a hardware company. They want to sell Macs.
| remram wrote:
| On the other hand this has a lot of stars and has been up
| since June 2020, so Apple doesn't seem too eager to cease-
| and-desist this kind of efforts. Maybe it's out of PR
| considerations, though.
| tveyben wrote:
| ...iPhones...
| [deleted]
| [deleted]
| pxc wrote:
| Great question, but pretty much a completely different use case
| than the OP. The whole point of this project is to make it easy
| to run macOS on _foreign_ host operating systems, presumably
| because the intended user does not own a Mac.
|
| If I had to venture a guess as to why macOS doesn't support its
| own containers in any way, though, I'd say:
|
| The core use case for containers is deploying apps to servers,
| and macOS isn't really used on the server. Apple themselves
| abandoned supporting macOS as a server operating system many
| years ago.
| pfoof wrote:
| >The core use case for containers is deploying apps to server
|
| Which includes servers that build applications with Xcode.
| pxc wrote:
| Sure, but Apple evidently doesn't view that use case as
| central to macOS' purpose, and the likely reason for that
| is that enterprises show little interest in running macOS
| as a general purpose server operating system. People are
| not running their web apps or game servers or storage
| networks or transcoders or scientific supercomputers or
| Kubernetes clusters or videogame lobbies on macOS servers.
|
| This isn't new, and Apple has rolled with it; they gave up
| making server hardware more than 10 years ago. They finally
| completely EOL'd the software package they called 'macOS
| server' like a year or two ago.
|
| Compare all the macOS changes from a 2 year period to the
| equivalent changelogs to the Linux kernel. It's very clear
| that macOS is neither widely used as a server operating
| system nor developed as one.
|
| If macOS were widely deployed as a general-purpose server
| operating system, Apple would have implemented some kind of
| container support years ago.
|
| This isn't the only server-centric area in which macOS lags
| compared to other operating systems. APFS' featureset is
| anemic for such a recent filesystem with a copy-on-write
| design.
|
| The core use case of containers is central neither to
| existing macOS usage nor to Apple's vision for macOS. If
| there's a question here, it has to be _why_ that is so, not
| the fact that it is.
| toastal wrote:
| Which is why we should vote with our wallets and not buy their
| hardware if they, Apple, want to keep neglecting part of the
| software that developers demand.
| shortformblog wrote:
| I did an interview with Sickcodes a couple of years ago when this
| first emerged. He does extremely interesting stuff and his point
| of view is unique.
|
| https://www.vice.com/en/article/akdmb8/open-source-app-lets-...
| nier wrote:
| This is the first time I read about this. How on earth is this
| not an April's fools joke?
|
| Apple allows you to run a maximum of 2 virtual machines on
| Apple hardware.
|
| Someone is going to get sued by Apple for going against this
| part of the license agreement and I must say I really like that
| thought because the result of that trial will give clarity to
| the rest of us.
|
| We had to deal with a gray area in our project as well. DeepL
| does not allow use of their translator in critical
| infrastructure. Our client is in the transportation business
| and has been using DeepL for years to translate emails. They
| wanted to integrate DeepL into a customer portal that we
| develop for them. When we told them that we will not be
| complicit in breaking DeepL's license agreement, they weren't
| too happy.
| zxcvbn4038 wrote:
| I think there is a different perspective - MacBooks are great
| development machines, pretty much everything builds without
| modification, if you need a true linux environment you can
| always spin one up with docker. I'd bet you that people
| running MacOS in VMs leads to people running MacOS on their
| shiny new MacBook.
|
| If you had told me thirty years ago that one day I'd be
| developing on a Mac I would have laughed, but once I had one
| I realized developing under Windows was a pain - everything
| is unnecessarily difficult because Microsoft wants you to
| develop FOR windows and they want you giving money to all
| their partners who forever have their hands out, and they
| make everything else hard.
|
| It's like a pain that never goes away - you can learn to
| ignore it but at some level it's always there.
| userbinator wrote:
| Apple has largely left the Hackintosh community alone. It
| seems like they're not interested in going after anything but
| those trying to commercialise it:
| https://en.wikipedia.org/wiki/Psystar_Corporation
| philjohn wrote:
| It won't be an issue for much longer - once support is
| phased out for Intel-based macs they'll be left behind.
| userbinator wrote:
| Don't underestimate the Hackintosh community --- if they
| could create an _SSSE3 emulator_ to allow installing
| macOS on CPUs that didn 't even have the required
| instructions, and completely rebuild kernels too, I don't
| think getting macOS to run on whatever other non-Apple
| ARM system happens to become popular is out of the
| question.
|
| Shortly after the M1 released, this happened:
| https://news.ycombinator.com/item?id=25064593
| bmitc wrote:
| What drives the Hackintosh community?
| [deleted]
| joshmn wrote:
| It's really quite fun. Maddening at times, but fun.
|
| For me, back in the day, it was about power: I wanted a
| Trash Can Pro for development (I had a fully-specced
| retina MacBook Pro) but I didn't want to pay Apple tax; I
| already had a gaming rig. So I dual booted.
| gary17the wrote:
| iOS development has to be performed exclusively under
| macOS. Effectively, many iOS developers not only do not
| want to pay for Apple hardware that is usually grossly
| overpriced for its capabilities, but also strongly desire
| to use absolutely top-of-the-line non-Apple hardware that
| is way more powerful than what Apple is offering, to run
| their daily macOS development workstations.
|
| ... And hacking entire operating systems under virtual
| machines is just fun :).
| moralestapia wrote:
| Great find, thanks!
|
| I've set up some tests that require OS X and usually set up
| remote VMs for that. This could be a nice alternative to run
| those using regular (and cheaper) linux instances.
|
| I know you can do the same with KVM but nothing beats a one liner
| command.
| sally_glance wrote:
| Could be or is? Please drop a result once you tried it :)
| fulafel wrote:
| Is there something Docker specific in this or would it work with
| Podman or other container runtimes?
| trollian wrote:
| This should be called "Docker for Mac".
| lioeters wrote:
| Surely you mean Mac Subsystem for Docker.
| hackernudes wrote:
| Wouldn't that be Docker Subsystem for Mac? DSM, WSL, WTF?
| efrecon wrote:
| LoL
| pxc wrote:
| Ok, so this _is_ just OSX-KVM with extra steps. Seems like a very
| weird use case for Docker, but okay.
| tjbiddle wrote:
| IIRC, when compiling any iOS apps, etc. you need a Mac machine.
| I remember in the past, when I was creating CI/CD pipelines we
| had to ensure that there was a Mac Mini or some other machine
| that we had access to in order to automate this.
|
| Seems like this solution would make it much simpler, as we used
| Docker for everything else.
| devmor wrote:
| I wonder how the performance is compared to a mac mini.
| BHSPitMonkey wrote:
| Surely you mean fewer steps (e.g. "docker run [image]" versus
| the long set of prep/install steps in the OSX-KVM README)?
| thejosh wrote:
| I recently wanted to build Python wheels for a whole bunch of
| Python versions and packages on Mac ARM64. I ended up using
| OSX-KVM, and then using cibuildwheel to crossbuild to arm64.
| Pretty dang easy.
|
| I set up OSX-KVM (https://github.com/kholia/OSX-KVM) and it
| worked really well. Having archlinux is a huge plus for this
| (it's why the docker image uses it), as qemu is super simple to
| setup and get running. Was surprised how easy it was, but given
| how much effort the bootloaders have had over the recent years
| for Hackintosh, qemu users can just yoink that bootloader and
| use it.
| netsharc wrote:
| He seems to have made some typos in the readme, because some
| sentences end with a period instead of an exclamation mark!
| SillyUsername wrote:
| Can someone explain why I'd use this instead of a regular VM
| please?
| pxc wrote:
| Because you don't know how to configure KVM or don't want to
| bother, I guess. This project just wraps another project for
| setting up normal KVM guests running macOS.
| lapser wrote:
| This _is_ a regular VM. Specially it 's qemu-kvm. The
| difference being that this is running qemu-kvm inside a
| container (remember, containers are mostly just processes). The
| advantage this gives you is that your run command is much
| simpler than the alternative.
| sroussey wrote:
| Great, so can this be used to have stable diffusion in a
| container on a Mac and still be able to use M2 GPU and Metal
| acceleration?
| top_sigrid wrote:
| This is not, what this is about. This is about running macOS in
| a docker container on another system - most likely Linux or
| Windows.
| tambourine_man wrote:
| It's not clear to me if it's graphic accelerated. GPU pass
| through or similar tricks.
| satvikpendem wrote:
| GPU acceleration is in their Todo section
| tambourine_man wrote:
| Thanks, that's the turning point for making it truly good for
| everyday use rather than an experimental project.
| AnthonBerg wrote:
| To my knowledge, there are two ways to get accelerated
| graphics in a macOS VM: GPU passthrough, and
| paravirtualized GPU.
|
| GPU passthrough from a Linux host to a Mac VM is already
| possible. Even with Docker in the sandwich. Then it's a
| question of Docker-OSX being furnished for it.
|
| I believe the GPU passthrough foundation is already there:
|
| PR #132: https://github.com/sickcodes/Docker-OSX/pull/132
|
| _"[...] this PR introduces GPU passthrough support. This
| requires extensive configuration on the host"_
|
| --
|
| Then there's "paravirtualized" graphics. I don't get the
| name; as far as I know, this is when the guest OS has a
| virtual graphics device and a driver for it - with
| acceleration -- and the virtual graphics device is actually
| served and accelerated like any other graphics-accelerated
| software by a GPU on the host.
|
| As mentioned elsewhere, paravirtualized graphics are
| available on mac-host-to-mac-guest, and to my knowledge
| only mac-inside-mac.
|
| (But the "outside" mac can probably be a virtual machine as
| long as it has a GPU. Even if it's a passthrough device.
| Should be technically possible at least and I would guess
| that it just works.)
|
| Finally, un-accelerated graphics in a macOS VM are
| surprisingly fast these days. At least on my Linux machine
| in qemu-kvm, recent versions of kernel / qemu etc. It's
| noticeably slower than having properly accelerated graphics
| but muuuuch faster than I was expecting from macOS VMs I've
| used before.
|
| Finally, headless access to virtualized macOS goes _really
| fast_. Working on a mac VM through mosh-shell is excellent.
| FlyingSnake wrote:
| Can this be used to run CI/CD in Docker for iOS projects?
|
| If that's possible then it's huge.
|
| Edit: Best way to know is to just do it. I'll try this and report
| back.
| jbverschoor wrote:
| https://developer.apple.com/xcode-cloud/ ;-)
| FlyingSnake wrote:
| I'm aware of this but I'm looking more into ephemeral docker
| containes that builds an iOS app and runs XCTests. Something
| like Gitlab CI for Android1
|
| 1: https://hub.docker.com/r/jangrewe/gitlab-ci-android
| nazka wrote:
| Oh wow I didn't know about that. That's huge. I remember
| people some time ago buying dozens of Macs to create their
| own CI/CD with racks of half open MacBooks running 24/365.
|
| Great they have that now!
| psnehanshu wrote:
| Really eager to know if this works. But I don't have the
| capability "yet" to do it myself.
| monkpit wrote:
| Is anyone using it in for production software? Are there any
| legal issues?
|
| I've considered using this for running simulators but I always
| get asked about how legal this is.
| remram wrote:
| I'm not sure why you are getting downvoted.
|
| I personally wouldn't have any scruples using this for
| testing/building OSS, but I would also think twice about using
| it at my job.
| spijdar wrote:
| The general consenus I've seen is that 1) projects/code that
| enables MacOS to be emulated is legal, but 2) running MacOS VMs
| on non-Apple hardware is a violation of the EULA you agree to
| when installing MacOS.
|
| So if it's on an Apple device (even one not running MacOS as
| the host) it's fine, otherwise it's a violation of the EULA,
| and something a business probably doesn't want to get tangled
| in.
| monkpit wrote:
| Thank you!
| monkpit wrote:
| To clarify, by simulators I meant: iOS simulators running under
| a Linux docker host.
| anthlax wrote:
| Can the method of generating MacOS serial tooens be used for
| iMessage on android??
| kaladin-jasnah wrote:
| Yes. But it has been very unstable for me and broke iMessage on
| my Apple branded Mac. The answer is if you have enough patience
| and luck, it'll work.
| xrd wrote:
| Anyone building, signing and notarizing osx software inside this?
| I've got two machines dedicated for that and am terrified if they
| fail I'll never remember how to set them up. This could be game
| changing.
| pugz wrote:
| It might be less effort to use something like this:
| https://gregoryszorc.com/blog/2021/04/14/pure-rust-implement...
|
| Might even be able to modify `gon` to use that instead of
| Apple's `codesign` and then you'll have notarization too:
| https://github.com/mitchellh/gon
| thenickdude wrote:
| I'm successfully notarizing software inside a QEMU macOS VM, so
| the same thing in the backend.
|
| I'm not submitting to the app store though.
| password4321 wrote:
| https://news.ycombinator.com/item?id=32386762
| [deleted]
___________________________________________________________________
(page generated 2023-01-14 23:02 UTC)