Eric Chiang

If this struck your interest, but you want more nitty gritty examples and details, you may find the following article interesting: https://ericchiang.github.io/post/containers-from-scratch/

If I'm remembering correctly from when I ran through the instructions at home, it was written for the original cgroup sysfs interface rather than the more modern cgroup2 [0]. You can figure out which you're running with

> mount | grep cgroup > cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)

which turns the examples is a nice "check your understanding"

[0]: https://docs.kernel.org/admin-guide/cgroup-v2.html#basic-operations

> How does this work?

Essentially, like this:

https://ericchiang.github.io/post/containers-from-scratch/

https://earthly.dev/blog/chroot/

> The way Docker Desktop (and podman.io) implement "containers on macOS" is a bit of a cop-out

It's not, it's a requirement for running Linux containers: https://news.ycombinator.com/item?id=37656401

DfM is more like running the CLI locally to a remote Linux machine, and all it does is conveniently expose /Users in the same place through the VM folder share so that you have the convenient illusion that it happens locally.

If Darwin had process namespacing features it would not make it magically able to run Linux processes.

I find plain Linux namespaces as sufficient for many things, for example:

unshare --map-root-user chroot ~/rootfs /bin/sh

Sure, it might not be able to clone the rootfs for you, but you don't need snapd to install it and it comes as part of util-linux, essentially being part of almost all Linux systems. (https://ilearnedhowto.wordpress.com/tag/unshare/ is a nice introduction.)

Edit: https://ericchiang.github.io/post/containers-from-scratch/ is also interesting.