macOS Container Machines

https://github.com/apple/container/blob/main/docs/container-machine.md

by timsneath • 1 month ago

1269 419 1 month ago

github.com

m4633• 1 month ago

looks like apple wrote a native docker in swift

you can now run linux containers on your mac

... but it could be better.

what about (totally contrived):

  FROM apple/macos:10.11.6

  RUN xcodebuild -project myapp.xcodeproj -scheme MyScheme -configuration Release

webXL• 1 month ago

Nice, but expect to page through a few pages of ToS during the build

m4633• 1 month ago

lol

  ENV XCODE_FRONTEND=unattended
  ENV XCODE_LICENSES=accept,firstborn,applepay,appleid=sjobs@me.com

trollbridge2• 1 month ago

Close - but it would be more like this:

  services:
    macos:
      image: dockurr/macos
      container_name: macos
      environment:
        VERSION: "15"

(And indecently slow.)

jadar• 1 month ago

i wish!

windowliker2• 1 month ago

It would be wonderful if this ran on older versions of macOS, but according to the README they only support 26.

m4633• 1 month ago

you do not understand... Not run on, run IN :)

I'm saying the older version of macos could build/run INSIDE the container

just like on a ubuntu 24.04 system you can do:

  FROM ubuntu:16.04

  docker run ubuntu:16.04

and though I haven't tried it, I believe docker can do arm in x86 using an emulator (like rosetta)

egorfine2• 1 month ago

FROM apple/macos:10.11.6

Yeah I was working on that, created a prototype. I don't see a business in it, so abandoned.

jaimehrubiks• 1 month ago

Will this be able to replace docker desktop an equivalents, removing the expensive Linux VM that runs alongside them?

trollbridge2• 1 month ago

That sure would be nice. I seem to rm -rf ~/.colima every few days.

thejazzman• 1 month ago

It mostly removes the big shared background VM and replaces it with smaller, more isolated Apple-native VMs.

I did an experiment migrating my Podman workload to Apple's container @ https://gist.github.com/jmonster/39e14585e107dbf990a90966c0f...

TL;DR reduces ram/storage usage; minimizes it's existence

deathanatos2• 1 month ago

How does that work, realistically?

Memory defaults to half of host memory

That's the most expensive part of the whole transaction, b/c AFAIK, RAM is then dedicated to the VM. It can be swapped out, I suppose, but that's not great.

nozzlegear3• 1 month ago

Nice, thanks for this. My plan is to swap over to Apple's containers for local dev, and keep using podman quadlets in production.

usernametaken29• 1 month ago

My first thought as well, docker desktop overhead is pretty bad, would be awesome to see this land natively in DD. By my estimate this could happen, seeing as Docker has historically tried to improve performance but quickly had to accept platform limitations… would only be natural to settle DD over to containers

deathanatos2• 1 month ago

Well, you can avoid the Docker Desktop tax by not running Docker Desktop. colima is a perfectly usable implementation of Docker for macOS, without the bloat of Docker Desktop.

That said, colima still has the expensive VM that upthread is mentioning.

lostlogin• 1 month ago

Others here mention it and I’m a new convert to Colima.

The pain of working around Docker Desktop is bad.

binsquare4• 1 month ago

Linux VMs on doesn't have to be expensive!

lxgr6• 1 month ago

This explicitly provides a Linux VM, which seems hard to do without providing a Linux VM.

The use case is actually the opposite of what you seem to want (i.e. running Linux containers on macOS without a Linux VM); this uses a Linux-based container implementation of macOS to provide a long-lived Linux VM that looks more like a VM itself than a container.

prmoustache• 1 month ago

this is more like toolbox/distrobox equivalent for MacOs, but running in individual VMs.

namegulf• 1 month ago

Would be nice if they also support Intel based macs, what prevents?

danhon• 1 month ago

Allocation of a finite amount of engineering resources.

joshuat• 1 month ago

And a legitimate business interest to further incentivize the adoption of Apple Silicon devices. Same with Rosetta deprecation after macOS 27.

MBCook7• 1 month ago

Apple won’t support them with MacOS 27, and it seems they announced this tool as part of this year’s WWDC.

Basically: they’ve moved on.

jdub8• 1 month ago

The underlying Virtualization Framework works on Intel Macs, but they'll miss out on new features landing in macOS 27 and beyond.

zackmorris• 1 month ago

I started with System 3 on a Mac Plus with floppy disks back in the late 1980s, and ported original C code from around System 7 all the way through modern versions of macOS X. Apple has a long track record of deprecating basically everything, as part of its business model IMHO. That's why I don't target native macOS/iOS anymore.

Nobody is coming to save us. But I think that with AI, we have an opportunity to create a zero-cost runtime layer that provides something like Wine or SDL on all platforms. It could/should be the intersection of all mainstream OS features (a bit like the web), with the option to drop down to native components like how Cordova works.

I've been out of the game too long to know if something like this already exists, but would love to contribute.

Note that the thing to get to the thing is runway. With our currently broken open source software (OSS) funding model, we don't have a way to pay developers a stipend of perhaps $24-48k per year (minimum) for their OSS efforts. So they have to work pro bono. That leads to design-by-committee thinking that stands in the way of getting real work done.

So unfortunately we have to pick ourselves up by our bootstraps. I hope to see the creation of a maker's guild someday, where membership provides the stipend, with proceeds coming from the 1 in 10 or 1 in 100 apps that generate a return on investment, to cover the commercial failures. Like Humble Bundle on steroids.

- digression -

Imagine a corporate model, but without gatekeeping, minimum hours or profit. A pure meritocracy working to manifest a gift economy for all.

I'm not aware of an automation-based (instead of artificial-scarcity-based) economic model like this. Solarpunk is more of a cultural revolution, but comes close. Some examples of how it might work:

- Abandoning patents, copyrights and other intellectual property rights in favor of a commons owned by everyone

- Funding drug research but giving away the resulting medication for the cost of production or free

- Universal Basic Income (UBI) or its cousin Universal Basic Capital (UBC) that provides the resources for labor to participate in the exponential gains of capitalism (the missing ladder that the wealthy currently pull up behind them)

China is well on its way to achieving these goals and more by 2049 under its Second Centenary Goal. Meaning that the US is/has been left behind. You can feel it in every way: widespread underemployment, the collapse of our social safety nets, the return of prejudice, our national debt higher than our GDP, CEOs getting compensated hundreds of times more than workers, the upcoming crowning of the first trillionaire. Times 1000 other injustices.

Solving the thing that gets to the thing is akin to solving all things.

Edit: I was wrong about intellectual property (IP) in China. It sounds like they will instead pursue high-value IP to fund their economy, a bit like the UBI funding model. I don't think that's an equitable path, so am suggesting something above and beyond what they're attempting.

blahgeek• 1 month ago

OrbStack works really well for me. I wonder how it’s compared to this performance wise

kdrag0n12• 1 month ago

(OrbStack dev here.) Instead of Virtualization.framework, we have a custom Rust virtualization stack with custom devices and protocols for things like filesystem sharing. It's a highly optimized vertically integrated stack specifically for running our Linux machines and containers.

Our biggest perf/resource gain is dynamic memory, which reduces memory usage a lot by releasing unused memory back to macOS. Nothing else supports this, including Containerization.

I gave Container Machines a try and it seems to be much closer to OCI containers with a default bind mount than OrbStack machines. It has fewer integrations and doesn't run systemd or any other normal init system, so it's hard to run services.

egernst2• 1 month ago

Thanks for the info kdrag0n! Big fan of OrbStack; good call out on dynamic memory.

If the guest image has /sbin/init, we use that.

We'd recommend using a base image for the guest that includes systemd. ie: https://github.com/apple/container/blob/main/docs/container-...

kxxx3• 1 month ago

Apple says that `systemctl` is supported... hmm am I missing something?

"Real Linux services for testing. Run a database or whatever your stack needs as a system service — systemctl start postgresql works on images with systemd installed."

jhancock• 1 month ago

I’ve been using podman on Mac. It’s been a nice fit as the container build files are identical to what I use on my fedora server. I have noticed my 2 virtual core 4 gb Linode vps runs apps faster in the same container as when run on my MacBook Air M2 16 gb. I expected some performance overhead but didn’t think it would be noticeable as it is. Overall happy with podman. How might OrbStack differ?

saltamimi• 1 month ago

I know this is off topic, but I do thank you for your Android work, the idea and elegance of fastboot.js and that SafetyNet workaround trick was truly really cool.

vsgherzi• 1 month ago

I love orbstack, is there any code I could read on the rust side? Seems very interesting

CGamesPlay3• 1 month ago

Our biggest perf/resource gain is dynamic memory, which reduces memory usage a lot by releasing unused memory back to macOS. Nothing else supports this, including Containerization.

Wow, missed this when reviewing OrbStack. I assumed that you just used Containerization and therefore would have the same limitation.

trueno• 1 month ago

just dropping in to say orbstack super owns and i use it every day. huge respect to rethinking this experience, for a minute there i thought docker was just going to be the only path. i dont think ive looked back for docker since. orbstack just feels right, and damn its so fast and good with resources, and the UI is just insanely straight forward. props!

TheTaytay• 1 month ago

We love OrbStack too! Thank you for it,

I wanted to make its VM/machine our default secure agent sandbox, but I couldn’t figure out how to isolate this VM from the host properly. This thread prompted me to find the issue though, and I saw this was recently implemented! https://github.com/orbstack/orbstack/issues/169

mescalito• 1 month ago

Super happy orbstack customer. Just curious on your statement:

I gave Container Machines a try and it seems to be much closer to OCI containers with a default bind mount than OrbStack machines. It has fewer integrations and doesn't run systemd or any other normal init system, so it's hard to run services.

The linked md document says:

Real Linux services for testing. Run a database or whatever your stack needs as a system service — systemctl start postgresql works on images with systemd installed.

Was that not the case when you used container machines?

blackqueeriroh3• 1 month ago

When are y’all gonna support sandboxing? Preferably Docker Sandboxes?

d3v1an7• 1 month ago

just adding a 'hell yeah: orbstack is so good' to the thread. i mainly avoid containers where i can, but when containers need to happen, orbstack is 'just enough' for me. lovely and well considered ui, stable, performant. don't need much else. thank you for your work and care!

bjt12345• 1 month ago

Orbstack plays well with Pycharms BTW.

rswail• 1 month ago

I changed over to Orbstack just for local builds and it is one of those apps that makes owning a Mac that much better.

This post reminded me to buy a license, just done it, worth it for the time saved.

torarnv• 1 month ago

Those are awesome features! The one missing for me is bridge networking. Any idea why orbstack doesn’t have that?

https://github.com/orbstack/orbstack/issues/342

rubnogueira• 1 month ago

Just to give a thumbs up to you and OrbStack. I've been using it every day since the first releases, and it is one of the most stable and performant drop-in replacements that I've seen.

rahen• 1 month ago

What kind of virtualization do you use internally? I assume some kind of LXD fork? OrbStack really feels like a single-node Incus host.

bekantan• 1 month ago

Amazing software, thanks!

kxxx3• 1 month ago

I really like OrbStack and am also not sure why I'd use Container Machines over it, at the moment...

pojzon2• 1 month ago

OrbStack still uses a single big VM, Container Mashines each spawn its own MicroVM. Isolation level on Container Machines is better from that point of view.

emmelaich• 1 month ago

I'd like to see a comparison to https://tart.run/ as well.

AFAICT it's pretty similar.

eatonphil• 1 month ago

Tart was just bought by OpenAI so its future is suspect.

cpuguy83• 1 month ago

Not a full docker env, I aimed this as doing builds though you can run dockerd as an option, https://github.com/cpuguy83/crucible uses the containerization framework to run either build kitd or dockerd and wire it up to docker/buildx cli (or whatever client tooling you want to use).

The Containerization framework is a library that sits as a layer on top of the virtualization framework. So each container is its own VM.

Machine is tooling above the containerization framework to run multiple things in a container in a vm.

mpeg• 1 month ago

I like orbstack in theory, but I find it hard to justify a $96/yr license fee for something that has so many open source, free alternatives. As it is, I’d rather use podman or colima

Ghoelian• 1 month ago

It's free for personal use, and for a company 96/year is absolutely nothing, I'd hope.

baq• 1 month ago

The alternatives are all broken in some ways is the answer, including the official paid docker enterprise.

Personally I’d rather the company provisioned me MacBook hardware with Linux. Unless Fable or some other ai ports asahi properly to modern hardware I expect to retire before this is possible, orbstack is the next best thing, available today.

jbverschoor2• 1 month ago

Note that orbstack supports audio and usb pass through, which is super nice

gempir2• 1 month ago

I just wish bind mounts would be more performant/native. I get that this is probably impossible, and probably also sucks on Linux, haven't tried.

But like having containers that need file watchers like vite dev server, or frankenphp in watch mode will overload OrbStack real quick since It seems to fallback to polling instead of listening to fs events.

So I'm stuck running vite dev servers and the like on the host.

kdrag0n12• 1 month ago

Can you share more details? OrbStack has always supported inotify/fanotify (Linux fs watching APIs) on bind mounts and most people use watchers with no issues. Happy to look into whatever you're running into: danny@orbstack.dev

kiproping• 1 month ago

Thank you for mentioning this, I have been suffering under the yoke of docker.

garganzol• 1 month ago

Orbstack is essentially a happy-path-only contraption that quickly breaks once you happen to take a less visited corner of the street. For example, if you happen to have multiple users who needs to work with it... good luck trying to clean up your system afterwards. So, it's a yoke as well. Maybe a better one for some people, but still a yoke.

timsneath• 1 month ago

To clarify a few comments here: this is not only OCI containers: container machines add support for persistence and filesystem mounting, making container machines a great lightweight Linux environment for developers using macOS. More details here: https://developer.apple.com/videos/play/wwdc2026/389

Onavo• 1 month ago

Ah, the Darwin/BSD Subsystem for Linux.

CGamesPlay3• 1 month ago

Not quite, it’s still a VM. And while it supports virtio balloon for growing RAM, it doesn’t yet support releasing that RAM back to the host. And there isn’t a convenient way to shrink the sparse disk images as they grow yet, either.

pseudosavant• 1 month ago

Exactly what I thought. The Mac equivalent to WSL. Which is a great thing for Mac devs. Lots of stuff expects Linux these days, not POSIX. Mach isn’t Linux.

jjtheblunt• 1 month ago

... highly integrated Linux environment that works seamlessly on your Mac. ...

Which kernel is running, and is it hosted in hypervisor.framework, as is done with UTM (when not using the qemu mode)?

Scarbutt• 1 month ago

The katas container kernel by default.

bogantech2• 1 month ago

filesystem mounting

How is this different to bind mounts

jdub8• 1 month ago

Very different: Linux running in a virtual machine can't bind mount into a macOS host's filesystem. So they use virtiofs.

oulipo2• 1 month ago

how does that compare to something like, eg, Orbstack?

CaptainCyber99• 1 month ago

Still feels like a apple-ified microvm

TingPing• 1 month ago

Well yeah it’s a simple vm…

Melatonic3• 1 month ago

Basically is it sounds like

jt2190• 1 month ago

container runs containers differently. Using the open source Containerization package, it runs a lightweight VM for each container that you create. This approach has the following properties:
- Security: Each container has the isolation properties of a full VM, using a minimal set of core utilities and dynamic libraries to reduce resource utilization and attack surface.
- Privacy: When sharing host data using container, you mount only necessary data into each VM. With a shared VM, you need to mount all data that you may ever want to use into the VM, so that it can be mounted selectively into containers.
-Performance: Containers created using container require less memory than full VMs, with boot times that are comparable to containers running in a shared VM.

More details, including technical limitations (they’re looking for bug reports and contributions): “Container: Technical Overview” https://github.com/apple/container/blob/main/docs/technical-...

mikepurvis• 1 month ago

Sounds like a lot of the same choices/compromises that are in wsl2.

a1o• 1 month ago

With colima I can run AMD64 (x86) Linux containers in my Arm64 too. I think this is strictly for Arm64 Linux VMs, or is there some way to run x86 with this too?

frizlab• 1 month ago

Rosetta should be supported

whycombinetor2• 1 month ago

Not for long!

cpach• 1 month ago

What’s the performance when you do that?

jdub8• 1 month ago

You can run amd64 binaries inside an aarch64 Linux virtual machine. Although they're not supporting Rosetta for macOS apps from macOS 27, the Rosetta support in Virtualization Framework will remain.

andor• 1 month ago

Did Apple officially confirm this or is it based on the statement regarding games?

WatchDog• 1 month ago

Do these containers share a common kernel? Or are they each ran in a separate VM?

Edit: It's a VM per container. https://github.com/apple/container/blob/main/docs/technical-...

leshenka• 1 month ago

Isn't it wasteful? I know it's a "tiny" vm but still is a vm

pjmlp18• 1 month ago

See Kata containers.

https://katacontainers.io/

For ultimate security, containers alone aren't enough.

Windows is also having a similar feature on top of WSL, announced at BUILD.

https://github.com/microsoft/mxc

ChrisArchitect• 1 month ago

WWDC presentation video:

Discover container machines

https://developer.apple.com/videos/play/wwdc2026/389/

llimllib• 1 month ago

Is this new? I thought we had this already

In my testing (iirc) filesystem performance was not good enough to be usable with node/rust dev where lots of small files get stat-ed

update: what's new is the `container machine` subcommand. I went to test it out, but container failed to run at all for me: https://github.com/apple/container/issues/1681

kdrag0n12• 1 month ago

Curious if you've tried OrbStack? There's always more work to do (test workloads appreciated!) but we've put a lot of effort into optimizing for small files and other common developer workloads in OrbStack's customized filesystem sharing protocol (not standard virtiofs).

ahknight• 1 month ago

Podman is on macOS, FWIW. Uses the existing container framework to run the machine already. Root-full or not.

dchest• 1 month ago

Did you use their volumes for node_modules or a shared dir? I mounted the whole project directory (with node_modules) inside the container and it seems to work fine (MBA M1 8 GB RAM).

Barbing• 1 month ago

I found it hard to believe I didn’t have a simple way of staying safe by installing an arbitrary application in a sandbox on macOS. (Restoring using Time Machine doesn’t count! :) )

This is a step in the right direction but requires any given developer’s buy-in first, right?

commandersaki4• 1 month ago

Would be cool if you can redirect USB devices to the VM.

kdrag0n12• 1 month ago

We just released this in OrbStack :) https://docs.orbstack.dev/features/usb

Blog post soon

commandersaki4• 1 month ago

Yeah I find this useful for redirecting storage/sdcard*, so you can format linux filesystems or use other tools.

* need a usb sdcard reader for macbook pro cause the builtin is not usb)

calebm• 1 month ago

Thank you for sharing this - I looked into OrbStack a few months ago, and this was the reason I didn't use it (as my primary purpose was to have an external wifi adapter for wifi pwnage).

blackqueeriroh3• 1 month ago

What happened to Orbstack for like 9 months until earlier this year? Suddenly everything went silent for a bit and I was pretty concerned. Glad y’all are back!!!!

egernst2• 1 month ago

Agreed! There's some good improvements around Accessory Access in virtualization framework this year also - checkout: https://developer.apple.com/videos/play/wwdc2026/224/?time=2...

commandersaki4• 1 month ago

I wonder if the custom virtio can be used to support attaching the built-in sdcard readers on macs which aren't exposed as usb.

rgovostes• 1 month ago

I've successfully tinkered with USB/IP with Apple containers, but it does require loading a custom kernel (which they make pretty easy, thankfully). On the host side, macOS also doesn't make it easy to unload a driver that attaches automatically.

nikisweeting• 1 month ago

I just added this to Lima recently, hopefully the macOS container machines support it too: https://github.com/lima-vm/lima/pull/4866

numbsafari• 1 month ago

Wouldn’t it be nice if services like Codespaces or Coder or Gitlab would allow you to target running on their hosted/integrated platform, or let you launch that same container completely locally? Sometimes I wanna take my “remote” dev environment off-line but still benefit from the integrated UX.

CGamesPlay3• 1 month ago

If you can express that operation in Terraform, then Coder would let you do that. First problems I can think of are connectivity from the Coder provisioner to your local machine (Tailscale? Local?), and migrating disk images if you want to actually switch a workspace between environments (local provisioner could do this, but no matter what it’ll be slow and janky).

RossBencina• 1 month ago

This exists. It's called devcontainers and there is a cli for managing it locally.

https://github.com/devcontainers/ https://containers.dev/

jayd162• 1 month ago

Maybe I don't understand but why doesn't Gitlabs self hosted setup work?

sachinjoseph• 1 month ago

WSL-like implementation on macOS?

riffic3• 1 month ago

darwin containers when?

riffic3• 1 month ago

had to come back because there actually seems to be a project to build this:

https://github.com/darwin-containers

However it requires disabling SIP, so that's unfortunately a non-starter for anything serious today.

osigurdson• 1 month ago

I'm surprised they cared enough to do this. I'd still rather use Linux but MacBook value is incredible.

marssaxman• 1 month ago

I'd always rather use Linux, but sometimes your employer gives you a MacBook. I might use this tool.

0xbadcafebee• 1 month ago

Anyone know why you would use this instead of QEMU+Lima+Colima+Docker/containerd? The latter works on multiple OSes, has a very large ecosystem of tools, images, documentation, and lets you replace pieces as needed

CarlitosHighway2• 1 month ago

From a layman's POV ("I just want to run my containers I need for dev work"), there's no point in switching to this for now. It's just cool that Apple cares enough about containers and might come up with an Apple-like built-in solution some day, this is the groundwork.

I'd stick to Colima, or Orbstack if you trust them enough to not do a rug-pull once their users are reliant on them enough to pay any amount.

lxgr6• 1 month ago

QEMU has worse performance than Apple's native virtualization framework on macOS, for one thing. That said, Lima supports the latter as well.

einsteinx2• 1 month ago

Yeah I was gonna say I use Colima with Apple’s virtualization framework (it’s not the default for some reason but it’s a single command line flag), and found it works better than QEMU (better performance and resolved some bugs I was running into with the Supabase docker stack)

m1324• 1 month ago

Every time I see Apple flaunting Linux containers I can hardly consider it as anything but admitting defeat. It could easily be Darwin, if they still had the capacity.

groundzeros2015• 1 month ago

Just change 30 years of internet history

al_borland• 1 month ago

For what it's worth, the first web server was a NeXTcube, and NeXTSTEP was the foundation of macOS.

tw043• 1 month ago

What is the alternative? They gave up the server market a decade ago and before that they barely actually supported it.

If they were to support darwin containers, what would be the point? Literally nobody would build to it, Linux won.

riffic3• 1 month ago

Literally nobody would build to it

because nobody does ci/cd against macOS or iOS apps right?

TheDong• 1 month ago

Apple set itself up for defeat in the server and developer marketplace as soon as they decided macOS was proprietary code.

Why would any serious developer use closed-source code they can't debug and modify? Especially for a production server?

It's the same reason no serious developers or hackers use macOS, like part of the point of being a developer is being able to dig into the code at any layer and debug and fix things.

vehemenz• 1 month ago

No offense, but serious developers don’t think this way at all.

m1324• 1 month ago

OpenDarwin was a thing at one point, with mailing lists and other infrastructure hosted by Apple.

That being said, my point isn't that Apple should absolutely focus on making a server OS again. It just saddens me how far behind macOS has fallen as they stopped caring about the fundamentals; back in the day, it would be Linux trailing behind macOS. Nowadays, you can't even have multiple routing tables on the latter, the firewall code was probably last updated in Snow Leopard, and what Apple happily shows off on WWDC is a wrapper around Linux. Something functionally equal can be cobbled up together by anyone sufficiently experienced in minutes, using just Bash, OpenSSH, and QEMU.

I really wish macOS would let me have a similar level of control over applications as Linux with namespaces, without me having to do all the heavy lifting.

pjmlp18• 1 month ago

Apparently game, desktop and app devs aren't serious.

bschwindHN2• 1 month ago

It's the same reason no serious developers or hackers use macOS

I know I'm basically taking the bait, but I guess I've not been "seriously" developing stuff for the past decade or two, which is news to me!

Danox• 1 month ago

Darwin is open source still available (anyone who has the guts and talent) can pick up the gauntlet it’s been about 26 years. For example, those three engineers who left Apple to form Nuvia (to bad they didn’t want to do a OS to go along with hardware).

https://en.wikipedia.org/wiki/Darwin_(operating_system)

https://github.com/PureDarwin/PureDarwin

https://www.reddit.com/r/MacOS/comments/1b75xlv/why_is_darwi...

https://x.com/LeakerApple/status/2018467873308786771 Nuvia

t1234s• 1 month ago

Is this similar to what cygwin was for windows? Could this be an alternative to homebrew?

cogman105• 1 month ago

Is there any reason why macOS doesn't try a WSL1 style approach? I get why that didn't fully work out for windows, but it seems like macOS being another *nix would make a lot of what was hard for windows, easy for mac. It seems like it should be possible to run most linux applications natively on macOS with few additional new APIs.

BSD actually has this already.

twoodfin• 1 month ago

What would be the advantages over a VM infrastructure Apple needs anyway and that has a much simpler, more stable “ABI” compared to the Linux kernel?

cogman105• 1 month ago

Potentially faster application execution along much lower memory requirements. In the case of docker, even a possibility of shared library loading further reducing runtime costs (For example, containers based on the same base image could load glibc into memory only once).

There's also simply the possibility of using linux software directly in macos without doing OS dependent changes to the software.

qalmakka11• 1 month ago

FreeBSD has Linuxlator because there is a lot of binary only software that was never and never will be ported to BSD, so it's necessary for them in order to avoid bleeding users away. Conversely, macOS has basically all software ported natively to it, so when you _need_ a Linux environment 95% of the time it isn't because you need $XYZ that only run Linux, but because you need a proper Linux environment with systemd, cgroups etc. Implementing that stuff on top of XNU would probably be extremely expensive and it would arguably defeat the point of having their own kernel in the first place.

cogman105• 1 month ago

Implementing that stuff on top of XNU would probably be extremely expensive and it would arguably defeat the point of having their own kernel in the first place.

I'm not sure how it'd defeat the point of having their own kernel.

As for cost, possibly, but it would really be a huge boon to macOS for software devs. It's hard for me to believe that Rosetta isn't similarly costly, but it's been done because running x86 software is still very much a necessity for MacOS.

jwlake• 1 month ago

haven't we had hypervisor.framework for like years now?

michaelsbradley2• 1 month ago

Can macOS be run as a container machine on macOS?

blackqueeriroh3• 1 month ago

Yes

MBCook7• 1 month ago

Yep. For a few years. And they keep enhancing it too.

It’s the only legal way to do so, due to the software license on MacOS.

rickstanley• 1 month ago

I was wondering if it's possible to have the container volume change to, say, an external drive. I currently use QMEU with qcow2 images to achieve this, works well enough.

opengears• 1 month ago

Also works with UTM.

Joyfield• 1 month ago

We have WSL at home.

mkagenius• 1 month ago

Apple containers are great for providing a sandbox to your AI coding agents

I have made it a MCP so that it's easily discoverable by all the coding agents

https://github.com/instavm/coderunner

xiaodai• 1 month ago

so basically dockers

noobcoder• 1 month ago

The costs are startup time and image compatibility: dockerhub images don't work as machine images because container machine expects systemd

I am trying it on but its brekaing on homebrew 1.0.0. The formula puts plugins at opt/container/libexec/container-plugins/ and the apiserver looks in libexec/container/plugins/

This can be solved through a symlink or smth

masklinn3• 1 month ago

dockerhub images don't work as machine images because container machine expects systemd

Are you sure about that? A few comments above a commenter states that they don’t run inits at all (because they ran alpine), multiple people replied that it works fine if you give it an image with an init, and they acknowledged their error.

gigatexal• 1 month ago

I saw the video on this this is distrobox basically for Mac. It’s very cool. Seamless with your local files and the container. I’m very keen to try it.

vachanmn123• 1 month ago

Could this allow us to use proton on mac maybe?

xd1936• 1 month ago

This is hilarious. Next year, the PC gamers will be saying "The best Windows gaming experience is win32 on Linux on macOS Containers".

Gigachad3• 1 month ago

I mean at this point literally anything works better than Windows.

aurareturn• 1 month ago

The fastest (Geekbench 6) Windows laptop in the world is actually an M5 Max Macbook running Parallels running Windows.

kergonath2• 1 month ago

Wine works fine on macOS, there is no need for a Linux layer.

mohamedkoubaa• 1 month ago

I think there's one too many layers of graphics driver indirection for this to work

bel82• 1 month ago

I don't think so. This is a VM, closer to WSL2.

Proton is based on Wine which translates Windows instructions to Linux.

Besides there's already Wine for mac.

But I would love to be wrong here.

CSDude• 1 month ago

I know its not going to be there but wish we had Windows as well.

Cadwhisker• 1 month ago

Install Windows 11 ARM under the macOS "UTM" App. This lets you run x86 Windows programs on Apple silicon.

pjmlp18• 1 month ago

With the BUILD and WWDC 2026 announcements, it is the Year of Linux Containers Desktop.

Which for many folks is good enough for what they are doing, thus the status quo of desktop platforms will hardly change for current form factors.

jzer0cool• 1 month ago

In the intro it mentions automatically mapping user and home dir. So host files accessible the container. Any settings to control this?

golem142• 1 month ago

I belong to a rare breed of very opportunistic hobby-developers that like to use MacOS but also like to use linux machines or BSDs (rpi etc) sometimes.

I can create docker-images with docker compose, or use something like colima, which this seems to be close to (that should have some advantages over docker, although my hope of circumventing W^X page protection did not pan out).

I was perplexed that the repository does not put these container machines in context. The seem to be close to colima? When should I use which option (docker, collima, container machines ?)

Maybe others wonder too but are ashamed to ask. I have no shame ;)

Thanks for any pointers

klohto• 1 month ago

https://github.com/apple/container/blob/main/docs/technical-... read documentation mr. rare breed

startakovsky1• 1 month ago

Like, this doesn’t answer when to use this vs Docker. Any reference there?

djsavvy• 1 month ago

Why try to circumvent W^X page protection? Some sort of self-modifying program without extra pointer indirections?

bogantech2• 1 month ago

Bad legacy apps like Xilinx ISE

golem142• 1 month ago

I just do, Mr Cooch, I just do.

binsquare4• 1 month ago

I built this tool to solve that exact problem: https://github.com/smol-machines/smolvm

apitman• 1 month ago

Been playing with this lately. Definitely worth checking out. Makes really nice tradeoffs IMO.

chrisweekly• 1 month ago

smolvm's are awesome

zekrioca• 1 month ago

"LXC" for macOS?

jbverschoor2• 1 month ago

Just curious, Apple seems to copy orbstack.. haven’t they made an offer to acquire you guys?

phplovesong• 1 month ago

It was unclear to me, is this a native replacement for docker? I like docker (on mac) but its quite the resource hog.

I usually run like a db, redis, maybe something like rabbitmq/zeromq and have a app that uses these services (makefile/docker-compose).

I would love to switch if this in fact is a lightweight replacement.

masklinn3• 1 month ago

On the one hand yes, on the other hand there are already multiple lighter alternatives to docker on mac.

happyopossum3• 1 month ago

A native replacement for docker came last year with Apple Containers- this extends that.

katspaugh• 1 month ago

I've looked into replacing Lima with Apple Containers for https://runmachine.dev.

However, unlike Lima, an Apple Container is not a full VM, so you cannot SSH to it, or forward SSH-agent signatures into a machine.

So it's more of a devcontainer story, which is also a great use case. Nice to see Apple creating tooling around their VZ framework.

Edit: referential clarity.

binsquare4• 1 month ago

Might consider https://github.com/smol-machines/smolvm

It's a full vm

itsneulook42• 1 month ago

that thepolfus and the Otis and the bors and the alschweid and pretty much anyone in old the the gs gangstalk or just getting people info to sit in the same room as them to try and makr them go crazy deserve to brave hart quartered

khazhoux• 1 month ago

try unplugging your keyboard and then plugging it back in

rakel_rakel• 1 month ago

It's funny that the system config page (https://github.com/apple/container/blob/main/docs/container-...) lists pebibytes for RAM configurations... in this day and age where buying a 16GB stick for workstation would cause me to eat instant ramen for a couple of months because my dentist needs an LLM chatbot on their page to stay competitive!

UX wise it looks kinda neat though!

borborigmus• 1 month ago

Signed in just to say LoL at the dentist comment.

itsneulook42• 1 month ago

Yeah but sitting in the tweak circles just to gather personal data about people to make them lose their minds is no bueno. Otipolfueriborsklineypoo

tonymet2• 1 month ago

What FS mounts the Mac drives into the Linux container ?

cromka5• 1 month ago

So essentially both macOS and Windows now heavily support developing using Linux on them. They can't more openly admit that they are no match for Linux in that area.

There's some clever advertising in it for Linux, if Linux was advertising.

rahkiin• 1 month ago

I’d argue they both admin that Linux servers are the target for a lot of applications to run on. Not to develop on.

plutokras• 1 month ago

Enterprises would do anything to develop on Linux except using an actual Linux distro.

neop1x• 1 month ago

A lot of devs needs to use linux but they still use it just as a VM (Mac) or in some kind emulation (WSL). How pathetic.

cromka5• 1 month ago

If they need to, it's because it's their work computers. Otherwise it's a choice.

nozzlegear3• 1 month ago

What's pathetic?

artistonn• 1 month ago

Linux also can't openly admit that it's no match for macOS/Windows on the desktop, which is why we have this hybrid situation - macOS/Windows desktops running Linux VMs

krzyk3• 1 month ago

Unfortunately there are more and more users on Linux and as a result windowsization/macosization of Linux is in progress (systemd, wayland, some scary stuff Poettering is doing with boot, snap/flatpack).

regexorcist2• 1 month ago

This is a tired cliché. Today, a modern Linux desktop like KDE Plasma just works and more importantly, gets out of your way unlike obnoxious MacOS and Windows. Aside of that you get the most advanced OS in the world where the thing being discussed here is a decade old.

pjmlp18• 1 month ago

Not really, this means the complete defeat of The Year of Linux Desktop.

Linux games depend on Windows ecosystem as their content source.

By having Linux nicely packaged in containers, they get to keep the 90% combined market share, almost no one bothers to support the market of Linux OEMs selling pre-installed Linux desktops and laptops.

The other "distros" used by consumers are Android, WebOs and going forward Googlebooks as Chromebooks evolution.

Meaning in the end a Pyrrhic victory, when Apple Linux, Microsoft Linux, Google Linux, Asus Linux, LG Linux, is all that the general public cares about, and hence no incentive for IT departments to support Linux laptops.

ActorNightly• 1 month ago

Mac OS is adding support because they realize that they are gonna miss a good portion of consumer base to windows laptops running on Nvidia Spark since people can get the perfect machine for gaming and dev.

The big thing with Windows laptops is historically, they were slightly more sluggish than Macs because the os/hardware wasn't optimized. On desktops with enough performance, Windows has been king ever since WSL2, considering you can do everything with that system (WSL2 can even run I3WM if you care enough since they have an X server).

Now with Spark and ARM, you can pretty much get a perfect laptop that supports gaming as a first party, can run any windows only software (like CAD for example), and also has WSL2 which is very natively integrated with windows to where it supports CUDA with native like performance.

fg137• 1 month ago

miss a good portion of consumer base to windows laptops running on Nvidia Spark

I don't know which world you live in, but I can assure you that's not happening.

If you don't believe me, just go look

1) what laptops are sold at Best Buy

2) On HN and reddit, what machines people are using for running local LLM

qalmakka11• 1 month ago

This is all fine and dandy, but where are the native Darwin Jails Apple? Still scared that people will filling whole rooms of Mac Minis if you allow them to have multiple macOS containers and not only up to two fat VMs per machine?

jorisw• 1 month ago

[Replied to wrong comment]

qalmakka11• 1 month ago

That's totally unrelated to what I wrote

adastra22• 1 month ago

sandbox profiles?

qalmakka11• 1 month ago

macOS sandboxing is deliberately limited just enough to prevent anyone from truly implement Darwin-on-Darwin containers. People have been discussing about this for a while, see https://github.com/apple/container/discussions/611

In general I understand the rationale behind Apple's decision. They sell hardware, and there's real demand for macOS on servers to run build jobs and other Mac-only tools. Giving you the ability to run multiple containers on a single Mac would end up turning a 10 Mac Mini order into a 2 Mac Minis order for most people. Rest assured, even if it would be technically possible they'd find a way to cap it somehow via the EULA or whatever

cedws• 1 month ago

Darwin namespaces would be much more interesting and we are in dire need of them in the current security landscape.

I don’t really understand the hype for Apple’s Containerization, it’s just another container runtime alongside many others. It’s not really any better than OrbStack - in fact it’s worse.

gyoridavid• 1 month ago

+1 I'd love to have network namespaces

RationPhantoms• 1 month ago

Thank you for answering that question because I adore OrbStack and didn't find much difference.

whimblepop• 1 month ago

When Apple Sherlocks something, aren't their implementations usually worse? Typically the thing being Sherlock'd is very mature and featureful, and Apple's implementation is much less capable and has undergone much less user testing, at least at the outset.

tonymet2• 1 month ago

You would want a layer above darwin, e.g. Foundation, Appkit -- all the stuff that runs the full MacOS. but good idea overall

harrouet• 1 month ago

Why did they have to invent their own solution instead of just shipping docker or an equivalent clone ?

nottorp• 1 month ago

Isn't docker on mac os still a large preallocated linux VM that runs the containers inside itself? With this maybe you can separate them.

konaraddi• 1 month ago

Sounds like toolbox or distrobox for Mac!

beemboy• 1 month ago

Is this going to be good for AOSP builds on Macs?

ShinyLeftPad• 1 month ago

Can Podman support these eventually?

kosikond• 1 month ago

There _is_ Podman Desktop extension for Apple Containers, however its socktainer version is ancient.

k_bx• 1 month ago

Most of my team's development happens on beefy desktop machine in incus containers per dev+project (so you run yourname-projname-dev). It has its own tailscale inside so you can open it like regular https website or give to another dev to check out – no need to deploy your branch somewhere, just run it. New dev onboard takes 10 minutes from zero to dev env with VSCode remote development.

I would really love if apple could give inexpensive way to run amd64 containers for situations when dev wants to use their own hardware. We've used LIMA for now, was too much of a hussle. But if there's a more native experience – would give it another try.

tannhaeuser• 1 month ago

Just to clarify, this requires Mac OS 26 Tahoe for "container" doesn't it? So those of us holding out on Sequoia who can't stand the broken glass UI or what's called and the other undesired features need to stick to Docker desktop.

coldtea8• 1 month ago

those of us holding out on Sequoia who can't stand the broken glass UI or what's called

Maybe hold 1 release back, but other than that, I don't think "holding out" on macOS releases has ever been a winning strategy.

In the end, macOS model presupposes users moving to the latest release sooner rather than later.

niek_pas• 1 month ago

It seems macOS Golden Gate (the upcoming version) fixes quite a few of the problems with Tahoe, so you might consider skipping Tahoe entirely.

egorfine2• 1 month ago

Yeah I use Tahoe and I can't stand the liquid glass.

It looks like Golden Gate fixes this design a lot.

masklinn3• 1 month ago

Just to clarify, this requires Mac OS 26 Tahoe for "container" doesn't it?

Yes’n’t: https://github.com/apple/container/blob/main/docs/technical-...

container relies on the new features and enhancements present in macOS 26. You can run container on macOS 15, but you will need to be aware of some user experience and functional limitations. There is no plan to address issues found with macOS 15 that cannot be reproduced on macOS 26.

The issues are around networking.

jrochkind1• 1 month ago

I turned off what "glass" UI I could with config, and it's not too different than Sequoia, got used to it pretty quick. Obviously the things not supported on an old OS will keep increasing, until eventually it is EOL'd.

nozzlegear3• 1 month ago

I didn't make any adjustments and hardly ever notice Liquid Glass on macOS. To me, it's only ever noticed if I hang out in the control center/notification center all day.

LaFolle• 1 month ago

Python binary wheels now have to be built for aarch64 for them to work inside the container, unless they are built using the corresponding build system while installing. It is not common for python binary libs to publish arm64 binary wheels, as most often they target amd64.

KeplerBoy• 1 month ago

Isn't that just expected for modern macOS devices? They have been on arm64 for 6 years now.

coldtea8• 1 month ago

This however is for Linux containers on macOS, and for those the deployment target are not usually/necessarily arm.

(Plus, you could always even have amd64 linux containers on macOS AS, with good performance, via Rosetta2).

sdevonoes2• 1 month ago

Im running Multipass on M1 for full linux VMs. Are container machines better?

m1keil• 1 month ago

Isn't multiphase is Ubuntu only?

sdevonoes2• 1 month ago

It used to be. Any image is allowed now.

pmontra2• 1 month ago

How is this different from Virtualbox or similar products with a shared folder with the host machine? I expected that existing virtualization tech for Macs already did that. Maybe the improvement is having nothing to configure.

By the way, is it headless or can it run a full Linux desktop? Use case: buy a Mac, uninistall whatever can be uninstalled, run the Linux VM as primary desktop forgetting MacOS and without going through Asahi and the incomplete hardware support.

iririririr2• 1 month ago

it differs by lacking all the cool options that makes vmware and virtualbox good products, but apple users will praise it as a benefit

"bind mounts? I'm better without it"

coldtea8• 1 month ago

Funny how confidently people can mock while knowing nothing about the specific tech discussed and the different targets. I'd google: VirtualBox vs containers.

shelled• 1 month ago

I hope this brought us one step closer to being able to run our distros of choice very freely and easily on a Mac.

aspeckt_112• 1 month ago

This is pretty cool - being able to bring your own container machine image goes a long way to helping it's adoption.

I started using Colima a couple of years ago because I got bored of how bad Docker Desktop was and just started using the CLI / the "Services" tool window in whatever Jetbrains IDE I was using at the time anyway. I can't see myself moving away from it any time - having multiple profiles is an absolute winner of a feature for me there, but maybe the next time I set up a Mac from scratch I'll have a play with this.

Havoc• 1 month ago

Always nice to have more options especially without third party tools

rcarmo• 1 month ago

This blew up spectacularly when combined with Time Machine, I wonder if that’s fixed.

happyopossum3• 1 month ago

Considering that this project was published less than 24 hours ago I’m guessing you assume it’s a different project.

emulio• 1 month ago

This appears to be an LXC-style alternative for macOS; however, unlike native LXC on Linux, this tool relies on VMs. While Docker and Podman also utilize a VM on macOS, they offer the advantage of the Docker Compose format. In my view, the ability to use YAML for declarative configuration is the most critical feature for any container tool. I have nothing against CLI tools in general, but I prefer avoiding repetitive manual commands that could be easily automated via Docker Compose or Kubernetes manifests.

notpushkin• 1 month ago

Apple does have an OCI variant of this: https://github.com/apple/container

Doesn’t seem to have Compose support though, but it’s probably not impossible to build upon.

And of course, it also uses VMs, though unlike Docker, it’s one (micro-?) VM per container: https://github.com/apple/container/blob/main/docs/technical-...

kenanfyi4• 1 month ago

I don‘t understand why these tools always advertise about mounting the $HOME inside the container. Isn‘t it better to have a complete isolation? Isn‘t that the point of using such a thing?

LoganDark4• 1 month ago

No, the point of using such a thing is to be able to run Linux workloads. For example, I recently used Containerization to generate trace logs from the tup test suite so that I could bring it up to relative parity on macOS. If it had complete isolation, I would have difficulty getting the modified source code into the container and difficulty getting the trace logs back out of the container. Sure, you can paper over this with bind mounts or whatever the fuck but that's annoying

kenanfyi4• 1 month ago

Understand. And yeah that‘s annoying. I use containers only for development and to keep my main system secure from supply chain attacks. I have almost no build tooling in my Mac anymore. No npm, no cargo, no uv. Nothing. They all live inside the container which is completely isolated.

I guess my use case is not that important for the main user of these tools.

sigmoid102• 1 month ago

Containers only got so popular as a tool for developers to make developing/deploying easier. If you want to use them as a security layer that is a completely different goal and has many highly dangerous pitfalls [1]. Just last week there was a post where people were shocked how an AI agent used docker to bypass sudo on a system. I'd imagine this could happen to most people who installed docker. So if you want to use containers for anything but easier development, you need to be much more proficient than the average user already. In that case not exposing $HOME is just a small thing on your config to-do list.

[1] https://cheatsheetseries.owasp.org/cheatsheets/Docker_Securi...

kenanfyi4• 1 month ago

I see. Why this interests me is the similar stuff I have been reading lately. All these supply chain attacks regarding npm, Tanstack etc. Therefore I wanted to create a totally isolated sandbox and while considering options I have seen they all by default mount the $HOME. I needed to explicitly tell colima to not do that.

But yeah, I guess my use case is not the main use of such tools or their purpose in general. Thanks for the link, I‘ll take a look at it.

lxgr6• 1 month ago

Just last week there was a post where people were shocked how an AI agent used docker to bypass sudo on a system.

This was due to implicitly granting the LLM access to the host docker daemon, which has superuser privileges, not due to a "container breakout". That's arguably a very different scenario, but of course both are worth considering.

So if you want to use containers for anything but easier development, you need to be much more proficient than the average user already.

I'd disagree. Containers, at least without granting them additional privileges such as CAP_NET_ADMIN and without write-bind-mounting sensitive host directories into the container, offer a reasonable security boundary compared to the counterfactual, despite their bad reputation.

pojzon2• 1 month ago

Im currently working on an article about this very topic. And its amazing how hard and multi-dimensional agent sandboxing. LLMs architecture is by design insecure. Working with something like this and making it secure to run in production is extremely interesting topic.

stefan_• 1 month ago

No, the whole point of machines is their external interfaces? A Linux VM with no interfaces is just a closed box wasting power doing math.

And I think I would caution Apple to consider the lessons of WSL; having shared access to the filesystem is just the bare minimum. Next is networking (and god is this a rabbit hole with WSL), people will want to access their USB devices, X forwarding, GPU passthrough..

coldtea8• 1 month ago

The whole point of container machines is their isolation.

If we wanted access to all interfaces, we'd just run it locally.

We want the container as a closed box, "wasting power doing math", i.e. processing what we actually passed to it.

saljam• 1 month ago

the reason i use this (and just a container with -v $HOME:$HOME before) is to get an environment with all the command line tools i'm familiar with from debian, instead of using something like homebrew. in general, i mostly trust these with access to my home directory. a bonus is that i can throw it away and rebuild it easily if i need to.

i'd still use less permissive containers for things i don't feel comfortable installing on the host, e.g. npm.

avsm• 1 month ago

I looked at this last year when it came out in Tahoe: https://anil.recoil.org/notes/apple-containerisation and this looks like more of the same.

They've now added a WSL-style virtual machine layer, but there's no x86 container story (Apple's killing Rosetta) so I imagine some qemu shimming will be required.

There's still no equivalent to VPNKit or GVisor for networking so you'll be bridging I think. See: https://cacm.acm.org/research/a-decade-of-docker-containers/ for how Docker for Mac does this

I can't spot any support for dynamic memory ballooning to prevent the hypervisor from gobbling up too much memory. We've had this in Xen since forever! https://xenproject.org/blog/ballooning-rebooting-and-the-fea...

And, most obviously: NO SUPPORT FOR MACOS. This is the single feature that only Apple can do, and they're choosing not to implement it deliberately, and it's so stupid given the pains we all have to go through to implement CI for macOS. In the land of OCaml, we were forced to implement a custom ZFS snapshotter to get reasonably cost effective macOS CI for our package repository: https://tarides.com/blog/2023-08-02-obuilder-on-macos/. This was fun to build, but it sucks to have to maintain it.

Also, I'm really curious what the GPU passthrough story here is for LLMs, since the Apple Silicon -> Linux kernel support is gated on Asahi's support, but that's been lagging beyond M2 due to the efforts of reverse engineering.

Do better for your developers, Apple. This is a half-baked sweep across third-party software without addressing the core needs around your own operating system.

throw1234567891• 1 month ago

And no GPU passthrough? So colima with libkit remains the only method on Apple Silicon?

Igor_Wiwi• 1 month ago

Interesting from a Docker perspective, but I’m more interested in it as a sandbox for AI agents and untrusted code execution.

I wrote about that angle here: https://igorstechnoclub.com/sandbox-exec/

Feels like the spiritual successor to sandbox-exec, but with VM-level isolation.

avel• 1 month ago

Yes, that article states that as well under limitations: "Deprecation status: While functional, Apple discourages its direct use in favor of App Sandbox for developers."

almaight• 1 month ago

It's been over a year since it came out, based on kata-container

naikrovek• 1 month ago

ah, a rare step closer to plan9.

(you remote into a system and part of your environment comes with you; that's very Plan9-like.)

yurimo• 1 month ago

I'm pretty sure this is not the use case at all but man do I miss bootcamp. Even for games if we could just run linux without a need for crossover, gaming on mac machines would be a dream.

krzyk3• 1 month ago

Oh, I hoped it would be macos contained in those containers. Container for Linux are in millions, while I don't know if there are any with macos inside.

ExoticPearTree• 1 month ago

Will this come to MacOS 27?

LE: nevermind, it is already on MacOS. Did not read everything.

asxndu2• 1 month ago

Available from 15

cdnsteve• 1 month ago

Is it just me or is the experience to get this up and running not feeling very Apple like? Is there no one liner to install or did I miss something?

asxndu2• 1 month ago

Could this be an analogue of WSL on windows but for MacOS?

alwinaugustin• 1 month ago

Why it is important ? We have Docker for containers, right ?

yeswecatan• 1 month ago

How would I replace docker compose containing multiple services that communicate with each other with this? Seems cool for an individual service.

bicepjai• 1 month ago

So are there any benchmarks that compare all containers / docker / Lima / Colima / virtual box / VMware / orbstack and others ?

solenoid0937• 1 month ago

They shouldn't bury the details about how the containerization actually works.

zer0zzz2• 1 month ago

I just want thunderbolt pci passthrough for these things.

kdrag0n12• 1 month ago

Interesting, what devices would you want to pass through?

zer0zzz2• 1 month ago

Gpus of course

exabrial2• 1 month ago

Handy for sure!

In production though, I've moved completely to systemd isolation of apps, rather than Docker-like containers; essentially blackboxes and present a supply chain threat. There's also a DRY principle here. Verification of a host presents a much smaller surface area.

bityard• 1 month ago

moved completely to systemd isolation

On MacOS?

exabrial2• 1 month ago

Negative:

In Production

running101• 1 month ago

Seems like wsl (windows subsystem for linux)

thedougd• 1 month ago

I still can’t use Containers because of a broken DNS implementation. I suppose I could manually set the DNS as I switch on and off VPN, but I don’t have to with Finch, Podman, or Docker Desktop.

kstenerud• 1 month ago

This is awesome! I just added this as a backend for yoloAI on Mac, and wow... super fast startup times now!

jlhawn• 1 month ago

Michael Crosby wrote this! He's a long-time maintainer of Docker, Containerd, and more! He was Docker's first to receive the 'Distinguished Engineer' Title. This means a lot coming from him.

Melatonic3• 1 month ago

Sounds a lot more like micro VM's and not normal containerization

brianmartin039• 1 month ago

I've been using Lima for this exact workflow. Apple's implementation looks cleaner though, especially the automatic user mapping. Curious how the performance compares.

lanycrost• 1 month ago

I will wait when docker or podman will adopt this :D

musicale3• 1 month ago

I can't help but think it was a mistake for "Open" containers to be Linux-only. Why can't we have POSIX containers, for example?

macOS Container Machines

Related Stories