7 ms·

Video about it here: https://developer.apple.com/videos/play/wwdc2025/346/ https://developer.apple.com/videos/play/wwdc2025/346/ Looks like each container gets

Video about it here: https://developer.apple.com/videos/play/wwdc2025/346/ https://developer.apple.com/videos/play/wwdc2025/346/ Looks like each container gets its own lightweight Linux VM. Can take it for a spin by downloading the container tool from here: https://github.com/apple/container/releases https://github.com/apple/container/releases (needs macOS 26)

paxys 1y ago
Also works on macOS 15, but they mentioned that some networking features will be limited.
OJFord 1y ago
The submission is about https://github.com/apple/containerization https://github.com/apple/containerization, not https://github.com/apple/container https://github.com/apple/container. The former is for apps to ship with container sidecars (and cooler news IMO); the latter is 'I am a developer and I want to `docker run ...`'. (Oh, and container has a submission here: https://news.ycombinator.com/item?id=44229239 https://news.ycombinator.com/item?id=44229239)
- badc0ffee 1y ago
  The former is the framework enabling Linux containers on lightweight VMs and the latter is a tool using that framework.
zmmmmm 1y ago
interesting choice - doesn't that then mean that container to container integration is going to be harder and a lot of overhead per-container? I would have thought a shared VM made more sense. I wonder what attracted them to this.
- pxc 1y ago
  It seems great from a security perspective, and a little bit nice from a networking perspective.
  - mickdarling 1y ago
    I can see the decision to do it this way being related to their private secure cloud infrastructure for AI tools.
  - avidphantasm 1y ago
    The "one IP per container" approach (instead of shared IPs) is similar to how kubernetes pods work.
- JoBrad 1y ago
  I like the security aspect. Maybe DNS works, and you can use that for communication between containers?
zoobab 1y ago
"Looks like each container gets its own lightweight Linux VM." Not a container "as such" then. How hard is it to emulate linux system calls?
- teruakohatu 1y ago
  > How hard is it to emulate linux system calls? It’s doable but a lot more effort. Microsoft did it with WSL1 and abandoned it with WSL2.
  - tsimionescu 1y ago
    Note that they didn't "do it" for WSL1, they started doing it, realized it is far too much work to cover eveything, and abandoned the approach in favor of VMs. It's not like WSL1 was a fully functioning Linux emulator on top of Windows, it was still very far from it, even though it could do many common tasks.
    - benwad 1y ago
      I've always wondered why only Linux can do 'true' containers without VMs. Is there a good blog post or something I can read about the various technical hurdles?
      - notpushkin 1y ago
        Windows can do “true” containers, too. These containers won’t run Linux images, though.
        dijit 1y ago
        Can it? As far as I understood windows containers required Hyper-V and the images themselves seem to contain an NT kernel. Not that it helps them run on any other Windows OS other than the version they were built on, it seems.
        1y ago
selkin 1y ago
It seems to work on macOS 15 as well, with some limitations[0]. [0] https://github.com/apple/container/blob/main/docs/technical-overview.md#macos-15-limitations https://github.com/apple/container/blob/main/docs/technical-...
WhyNotHugo 1y ago
> Looks like each container gets its own lightweight Linux VM. That sounds pretty heavyweight. A project with 12 containers will run 12 kernels instead of 1? Curious to see metrics on this approach.
- arijun 1y ago
  Is that not the premise of docker?
  - detaro 1y ago
    no.
  - rtkwe 1y ago
    No it's the opposite, the entire premise of Docker over VMs is that you run one instance of all the OS stuff that's shared so it takes less resources than a VM and the portable images are smaller because they don't contain the OS image.
    - dwaite 1y ago
      The premise is containerization, not necessarily particular resource usage by the host running the containers. For hosted services, you want to choose - is it worth running a single kernel with a lot of containers for the cost savings from shared resources, or isolate them by making them different VMs. There are certainly products for containers which lean towards the latter, at least by default. For development it matters a lot less, as long as the sum resources of containers you are planning to run don't overload the system.
      - rtkwe 1y ago
        The VM option is relatively new and the original idea was to provide that isolation without the weight of a VM. Also I'm not sure that docker didn't coin the word containerization, I've alway associated it with specifically the kind of packaging docker provides and don't remember it being mentioned around VMs.
solarexplorer 1y ago
I would assume that "lightweight" in this case means that they share a single Linux kernel. Or that there is an emulation layer that maps the Linux Kernel API to macOS. In any case, I don't think that they are running a Linux kernel per container.
- deleted 1y ago
  [deleted]
- ylk 1y ago
  You don’t have to assume, the docs in the repo tell you that it does run a Linux kernel in each VM. It’s one container per VM.
  - solarexplorer 1y ago
    Good call, thanks for clarifying!
- commandersaki 1y ago
  "Lightweight" in the sense that the VM contains one static executable that runs the container, and not a full fledged Ubuntu VM (e.g. Colima).
honkycat 1y ago
> Looks like each container gets its own lightweight Linux VM. We're through the looking glass here, people
- musicale 1y ago
  "Containers" now apparently means "boot a docker image as an ephemeral VM." Which isn't such a bad idea really.
philips 1y ago
Shoutout to Michael Crosby, the person in this video, who was instrumental in getting Open Containers (https://opencontainers.org https://opencontainers.org) to v1.0. He was a steady and calm force through a very rocky process.
- discohead 1y ago
  "A new report from Protocol today details that Apple has gone on a cloud computing hiring spree over the last few months... Michael Crosby, one of a handful of ex-Docker engineers to join Apple this year. Michael is who we can thank for containers as they exist today. He was the powerhouse engineer behind all of it, said a former colleague who asked to remain anonymous." https://9to5mac.com/2020/05/11/apple-cloud-computing/ https://9to5mac.com/2020/05/11/apple-cloud-computing/
  - musicale 1y ago
    We can thank the linux kernel developers for implementing namespaces and overlayfs. And we can thank predecessor systems like BSD jails, Solaris zones, as well as Virtuozzo/openVZ and lxc as previous container systems on linux. Docker's main improvements over lxc, as I understand it, were adding a layered, immutable image format (vs. repurposing existing VM image formats) and a "free" public image repository. But the userspace implementation isn't exactly rocket science, which is why we periodically see HN posts of tiny systems that can run docker images.

paxys 1y ago

Also works on macOS 15, but they mentioned that some networking features will be limited.

OJFord 1y ago

The submission is about https://github.com/apple/containerization https://github.com/apple/containerization, not https://github.com/apple/container https://github.com/apple/container. The former is for apps to ship with container sidecars (and cooler news IMO); the latter is 'I am a developer and I want to `docker run ...`'. (Oh, and container has a submission here: https://news.ycombinator.com/item?id=44229239 https://news.ycombinator.com/item?id=44229239)

badc0ffee 1y ago
The former is the framework enabling Linux containers on lightweight VMs and the latter is a tool using that framework.

zmmmmm 1y ago

interesting choice - doesn't that then mean that container to container integration is going to be harder and a lot of overhead per-container? I would have thought a shared VM made more sense. I wonder what attracted them to this.

pxc 1y ago
It seems great from a security perspective, and a little bit nice from a networking perspective.
- mickdarling 1y ago
  I can see the decision to do it this way being related to their private secure cloud infrastructure for AI tools.
- avidphantasm 1y ago
  The "one IP per container" approach (instead of shared IPs) is similar to how kubernetes pods work.
JoBrad 1y ago
I like the security aspect. Maybe DNS works, and you can use that for communication between containers?

zoobab 1y ago

"Looks like each container gets its own lightweight Linux VM." Not a container "as such" then. How hard is it to emulate linux system calls?

teruakohatu 1y ago
> How hard is it to emulate linux system calls? It’s doable but a lot more effort. Microsoft did it with WSL1 and abandoned it with WSL2.
- tsimionescu 1y ago
  Note that they didn't "do it" for WSL1, they started doing it, realized it is far too much work to cover eveything, and abandoned the approach in favor of VMs. It's not like WSL1 was a fully functioning Linux emulator on top of Windows, it was still very far from it, even though it could do many common tasks.
  - benwad 1y ago
    I've always wondered why only Linux can do 'true' containers without VMs. Is there a good blog post or something I can read about the various technical hurdles?
    - notpushkin 1y ago
      Windows can do “true” containers, too. These containers won’t run Linux images, though.
      - dijit 1y ago
        Can it? As far as I understood windows containers required Hyper-V and the images themselves seem to contain an NT kernel. Not that it helps them run on any other Windows OS other than the version they were built on, it seems.
        1y ago

selkin 1y ago

It seems to work on macOS 15 as well, with some limitations[0]. [0] https://github.com/apple/container/blob/main/docs/technical-overview.md#macos-15-limitations https://github.com/apple/container/blob/main/docs/technical-...

WhyNotHugo 1y ago

> Looks like each container gets its own lightweight Linux VM. That sounds pretty heavyweight. A project with 12 containers will run 12 kernels instead of 1? Curious to see metrics on this approach.

arijun 1y ago
Is that not the premise of docker?
- detaro 1y ago
  no.
- rtkwe 1y ago
  No it's the opposite, the entire premise of Docker over VMs is that you run one instance of all the OS stuff that's shared so it takes less resources than a VM and the portable images are smaller because they don't contain the OS image.
  - dwaite 1y ago
    The premise is containerization, not necessarily particular resource usage by the host running the containers. For hosted services, you want to choose - is it worth running a single kernel with a lot of containers for the cost savings from shared resources, or isolate them by making them different VMs. There are certainly products for containers which lean towards the latter, at least by default. For development it matters a lot less, as long as the sum resources of containers you are planning to run don't overload the system.
    - rtkwe 1y ago
      The VM option is relatively new and the original idea was to provide that isolation without the weight of a VM. Also I'm not sure that docker didn't coin the word containerization, I've alway associated it with specifically the kind of packaging docker provides and don't remember it being mentioned around VMs.

solarexplorer 1y ago

I would assume that "lightweight" in this case means that they share a single Linux kernel. Or that there is an emulation layer that maps the Linux Kernel API to macOS. In any case, I don't think that they are running a Linux kernel per container.

deleted 1y ago
[deleted]
ylk 1y ago
You don’t have to assume, the docs in the repo tell you that it does run a Linux kernel in each VM. It’s one container per VM.
- solarexplorer 1y ago
  Good call, thanks for clarifying!
commandersaki 1y ago
"Lightweight" in the sense that the VM contains one static executable that runs the container, and not a full fledged Ubuntu VM (e.g. Colima).

honkycat 1y ago

> Looks like each container gets its own lightweight Linux VM. We're through the looking glass here, people

musicale 1y ago
"Containers" now apparently means "boot a docker image as an ephemeral VM." Which isn't such a bad idea really.

philips 1y ago

Shoutout to Michael Crosby, the person in this video, who was instrumental in getting Open Containers (https://opencontainers.org https://opencontainers.org) to v1.0. He was a steady and calm force through a very rocky process.

discohead 1y ago
"A new report from Protocol today details that Apple has gone on a cloud computing hiring spree over the last few months... Michael Crosby, one of a handful of ex-Docker engineers to join Apple this year. Michael is who we can thank for containers as they exist today. He was the powerhouse engineer behind all of it, said a former colleague who asked to remain anonymous." https://9to5mac.com/2020/05/11/apple-cloud-computing/ https://9to5mac.com/2020/05/11/apple-cloud-computing/
- musicale 1y ago
  We can thank the linux kernel developers for implementing namespaces and overlayfs. And we can thank predecessor systems like BSD jails, Solaris zones, as well as Virtuozzo/openVZ and lxc as previous container systems on linux. Docker's main improvements over lxc, as I understand it, were adding a layered, immutable image format (vs. repurposing existing VM image formats) and a "free" public image repository. But the userspace implementation isn't exactly rocket science, which is why we periodically see HN posts of tiny systems that can run docker images.