MacOS?

[DavSanchez]

Hello!

I was following your post on containers and (of course) the code is not fully portable. For example the clone() function is not available in OS X, I tried to implement something similar using pthread, but again when it comes to clear environment variables (using environ = NULL; because celarenv() is also not available) not all of them are cleared. PWD remains, for example, and there is also a variable _ that cannot be cleared...

I assume there is some way to make OS X clear these variables, and also a way equivalent to your use of signals in clone() to achieve several things through your post. I have been skimming a bit through the internet (and even the Apple Developer site) to no avail. There must be some OS X specific libraries or something.

Do you have any clue of where should I begin looking into this? Of course I can set a VM and check your code as is, but I want to tackle this challenge. Thanks in advance!

[cesarvr]

Hi David,

Thanks for taking time to read the article, much appreciated.

Umm, usingpthread won't work because in the best case it will only make a copy the running process (like fork), once the copy is done the process will still share context with other processes (no isolation at all), if that process touch a share resource (like an environment variable), it will affect the rest of the system.

The problem is that clone does much more than just spawning new processes, it also provides the isolation mechanism (UTC, MOUNT, PID, etc...) which unfortunately are not available on MacOSX.

If you still want to try I would take a look at this API called jailkit which maybe can help you.

Cheers :).
César.

[DavSanchez]

Thank you for the quick reply! I'll take a look into jailkit to see if I can follow your post contents more faithfully... Awesome work, by the way!

Best,
David