feat: add Apple Silicon support via Rosetta emulation#70
Open
feat: add Apple Silicon support via Rosetta emulation#70
Conversation
Add workarounds for running instant-bosh on Apple Silicon Macs using Colima with Rosetta x86_64 emulation. Director patches (director/Dockerfile): - Enable BPM privileged mode to bypass seccomp filter failures - Drop privileges to vcap user in startup scripts (required for postgres) Stemcell patches (stemcell/Dockerfile): - Disable MemoryDenyWriteExecute and other systemd security features that conflict with Rosetta JIT compilation - Mask systemd-binfmt to preserve host binfmt_misc registrations Includes build scripts and documentation.
- Add wait-for-postgres-role.sh to handle race condition with postgres role creation - Preserve environment variables when dropping privileges to vcap user - Fix blobstore tmp directory permissions for nginx worker (nobody user) - Fix director nginx tmp directory permissions - Change upload_store_access to all:rw for uploaded files - Use vcap user for oid2name check in create-database.erb
3 tasks
Replace the complex privileged mode + privilege dropping approach with a cleaner solution that compiles BPM from a branch with Rosetta emulation detection (cloudfoundry/bpm-release#201). Changes: - Dockerfile: Multi-stage build compiles BPM with sysfeat package that detects Rosetta via /proc/sys/fs/binfmt_misc/rosetta - build.sh: Add BPM_BRANCH and BPM_REPO env vars for flexibility - README.md: Add Requirements section documenting that Colima with VZ+Rosetta is required and Podman Machine is NOT supported (uses QEMU instead of Rosetta, see containers/podman#28181) This approach only disables seccomp (the actual problem) without granting additional privileges or requiring privilege dropping scripts.
Add script to enable Rosetta emulation in Podman 5.6+ on macOS Tahoe, based on the fix documented in the Podman blog post. This allows running x86_64 instant-bosh containers on Apple Silicon Macs using Podman. Ref: https://blog.podman.io/2025/08/podman-5-6-released-rosetta-status-update/
Owner
Author
|
postgres workaround won't be needed after: cloudfoundry/bosh#2687 gets released |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add workarounds for running instant-bosh on Apple Silicon Macs using Colima with Rosetta x86_64 emulation.
Problem
Two main issues prevent instant-bosh from working on Apple Silicon with Rosetta:
Director Container:
error loading seccomp filter: invalid argument)Stemcell VMs:
MemoryDenyWriteExecute=yesin systemd services conflicts with Rosetta JIT compilation, causingsystemd-journald,systemd-resolved,auditd, etc. to crashSolution
Director Patches (
apple-silicon/director/)Dockerfile that patches BOSH release templates at build time:
privileged: trueto all BPM configs (disables seccomp)Stemcell Patches (
apple-silicon/stemcell/)Dockerfile that creates systemd drop-in overrides:
MemoryDenyWriteExecute,SystemCallFilter, etc. for affected servicessystemd-binfmt.serviceto preserve host binfmt_misc registrationsUsage
Testing
Successfully deployed a 5-node zookeeper cluster with all VMs in
runningstate.