As someone working in developer tools for a company with thousands of people developing software on MacBooks, MAN do I resent SIP. I've recently started calling it "Systems Implementation Prevention".
It's incredible that it's 2024 and I can't cobble together anything vaguely container-like on macOS because:
* bind mounts don't exist (?!)
* clonefile() could maaaybe do the job but doesn't work cross-volume and a lot of the stuff outside of /Users is a different volume
* there's no filesystem namespace.
* chroot doesn't work either because /usr/lib/libsystem.B.dylib is required, but also pretend.
* And it sounds like chroot runs afoul of some SIP rule nowadays even if you can get past the above.
* A lot of this could be worked around with FUSE, but in order to turn that on, we'd have to turn off a lot of SIP.
The closest we can get without virtualization is sandbox-exec, which just allows allowing/denying file reads by path, with no path translation. And also is deprecated.
Nevermind that dtrace exists but you're not allowed to use it either.
Truly, the worst UNIX.
It's incredible that it's 2024 and I can't cobble together anything vaguely container-like on macOS because:
* bind mounts don't exist (?!)
* clonefile() could maaaybe do the job but doesn't work cross-volume and a lot of the stuff outside of /Users is a different volume
* there's no filesystem namespace.
* chroot doesn't work either because /usr/lib/libsystem.B.dylib is required, but also pretend.
* And it sounds like chroot runs afoul of some SIP rule nowadays even if you can get past the above.
* A lot of this could be worked around with FUSE, but in order to turn that on, we'd have to turn off a lot of SIP.
The closest we can get without virtualization is sandbox-exec, which just allows allowing/denying file reads by path, with no path translation. And also is deprecated.
Nevermind that dtrace exists but you're not allowed to use it either.
Truly, the worst UNIX.