The File System: APFS

Everything the last six chapters covered — Darwin, the Unix toolset, Homebrew's installs, .app bundles — ultimately sits on top of a filesystem. This chapter goes there directly: APFS, Apple's own modern replacement for the decades-old HFS+, and the one place on this site where macOS's own filesystem choices can be set directly against Linux Filesystems' real, detailed coverage of ext4, Btrfs, and ZFS.

From HFS+ to APFS

APFS (Apple File System) shipped in 2017 with macOS High Sierra (10.13), replacing HFS+ — a filesystem whose lineage traces back to the original 1985 HFS, extended in 1998, and never fundamentally redesigned for the storage hardware that had taken over by the 2010s. HFS+ was built with spinning hard drives in mind; APFS was purpose-built for flash/SSD storage (while still working fine on spinning disks), and fixed several real, concrete limitations along the way — most notably HFS+'s 32-bit inode numbering, which put a hard, practical ceiling on how many files a volume could ever hold. APFS uses 64-bit inode numbers instead, removing that ceiling for any realistic modern use.

Snapshots: Copy-on-Write, Apple's Way

APFS's standout feature is the snapshot — a point-in-time, read-only capture of a volume's state, made possible by copy-on-write: creating a snapshot doesn't copy the whole volume, it just marks the current state and only starts consuming extra space once existing data actually changes afterward. This is the exact same underlying idea Linux Filesystems 3 covered in real depth for Btrfs — copy-on-write snapshots as a headline filesystem feature, not a bolted-on backup tool.

macOS leans on this constantly, often invisibly: Time Machine (Chapter 9) keeps hourly local snapshots on the internal drive even before a Time Machine backup disk is ever connected, and macOS's own installer can snapshot the current system state before a major OS update, enabling a rollback if the update goes wrong.

Containers & Space Sharing: A Different Model Than Fixed Partitions

Rather than carving a disk into fixed-size partitions the way traditional partitioning schemes do, APFS groups related volumes inside one container, and every volume in that container dynamically shares the same underlying free space. Creating a new APFS volume doesn't require deciding a fixed size up front the way creating a new partition would — every volume in the container can grow or shrink as needed, up to the container's total capacity.

The Signed System Volume: Integrity Built Into the Filesystem

Since macOS Big Sur (11), the entire system volume — the read-only portion of macOS holding the OS itself — is cryptographically hashed at the block level into what Apple calls the Signed System Volume. Any unauthorized modification to system files is detectable, because the volume's own cryptographic seal would no longer match. This extends Chapter 6's own signing/notarization/Gatekeeper trust chain one level deeper: it isn't just individual apps being checked for integrity anymore, but the operating system's own files, verified at the filesystem layer itself.

APFS vs. ext4, Btrfs & ZFS

Where This Course Is Headed

The built-in security stack in full — Gatekeeper's own neighbors XProtect, FileVault, and System Integrity Protection — Time Machine and Recovery (leaning directly on this chapter's own snapshot material), networking and sharing, everyday troubleshooting tools, and a capstone setting up and securing a complete new Mac end to end.

Hands-On Exercises