8 ms·

macOS Container Machines

• sourcegrift 4mo ago
  [flagged]
  • hollerith 4mo ago
    Sadly, Linux is much much less secure.
    • pixelatedindex 4mo ago
      This claim is so absurd that I need some sources.
      • JumpCrisscross 4mo ago
        Linux is easier to misconfigure. Macs resists being misconfigured insecurely. At their tightest, I'd say neither is fundamentally more insecure than the other. (The exception would be M5-based Macs, which come with MIE. Though that isn't a macOS vs Linux thing per se.)
        • armadyl 4mo ago
          This is incorrect macOS is fundamentally more secure than desktop Linux operating systems and it isn't particularly close. No amount of Linux hardening will get a system even close to an M-chip Mac. Software insecurities aside, desktop Linux OS systems have almost none of the hardware-backed security benefits that Macs do.
          • TimTheTinker 4mo ago
            At some point, lack of security becomes a feature. A fully secure, locked-down, T2 attested macOS is able to be controlled not just by Apple, but by increasingly evil governments, with no recourse available to users.
            • armadyl 4mo ago
              Conversely, a Linux system with no verified boot can be easily tampered with without the user detecting it by people lower than the government such as casual hackers. So in a world where your government is going crazy, you're opting for an operating system that can be penetrated with relative ease (e.g. with persistent root malware) both by a non-government hacker on top of a state backed one.
              • JumpCrisscross 4mo ago
                I'd also guess it's much harder to securely source components for a Linux build in the way Apple is able to.
                • armadyl 4mo ago
                  It's not really about supply chain security it's about the hardware itself. PC manufacturers in general just can't keep up since they don't have full control/integration over the hardware stack like Apple does. Also CPU, secure element etc security is limited but Qualcomm is catching up pretty quickly I believe if they aren't there already. We won't talk about Intel and AMD. But that's beyond my knowledge so I can't say anything too specific that's just what I have from general knowledge I'm sure someone will jump in with additional info if needed. I don't think Apple is particularly any more secure against the US government than Intel is with supply chain vulnerabilities but I have nothing to back that up with aside from vibes.
      • armadyl 4mo ago
        The person you replied to is right, the "security" of Linux might as well be nonexistent compared to macOS and especially iOS/Android. Even the developers of Secureblue (https://secureblue.dev/ https://secureblue.dev/) state that despite their hardening and mitigations Linux still lags far behind macOS (and possibly Windows) security-wise. The only Linux derivative that has proper security is Android, and even better GrapheneOS. https://privsec.dev/posts/linux/linux-insecurities/ https://privsec.dev/posts/linux/linux-insecurities/ https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html I also commented here on Linux phones, the same can apply to Linux as a desktop OS: https://news.ycombinator.com/item?id=46997397 https://news.ycombinator.com/item?id=46997397 Also on top of that Linux/Windows laptops also lack the hardware-backed security that Macs and to an extent some Chromebooks have.
      • dvhh 4mo ago
        Security by obscurity worked quite well
      • hollerith 4mo ago
        OK. Here is a kernel developer explaining it recently on this site: https://news.ycombinator.com/item?id=48448345 https://news.ycombinator.com/item?id=48448345 // When people escalate privileges on MacOS it's news, when they do it on Linux it's Tuesday (you might think the recent spate of privesc vulns on Linux was unusual but that is totally normal). I say this as someone who works on Linux security every day (I am a kernel developer) and uses Linux on every computer I have, both at work and at home, BTW. I am not a Linux hater or Apple fanboy by any means. https://news.ycombinator.com/item?id=48444187 https://news.ycombinator.com/item?id=48444187 // I am just talking about the pure tech fact that GNU/Linux desktops do not have any meaningful intra-host security boundaries. https://news.ycombinator.com/item?id=48059250 https://news.ycombinator.com/item?id=48059250 // To convince me Linux is full of kernel LPE bugs, can you share some of the bugs? [answered by the kernel dev] I also have some cites of comments on Linux by the founder of GrapheneOS I could dig up.
  • al_borland 4mo ago
    macOS only needs to support the hardware it ships on, so of course Linux would have wider hardware support, but that doesn’t really matter in context. The bigger question is what hardware to people actually want? I see most people drool over Apple hardware while not finding any suitable equivalent for the PC that they can install Linux on. Framework is trying to close that gap with their new release, but we’ll have to see how it is once people get their hands on it. I think it also comes at a price premium. There is always the Thinkpad route, but Lenovo burned just about every bridge with me a decade ago with things like Superfish. Where is the premium Linux laptop OEM that people can trust? Last I heard System76 was just rebranding Clevo hardware. What are people using? Dell? HP?
• riffic 4mo ago
  darwin containers when?
  • riffic 4mo ago
    had to come back because there actually seems to be a project to build this: https://github.com/darwin-containers https://github.com/darwin-containers However it requires disabling SIP, so that's unfortunately a non-starter for anything serious today.
• m463 4mo ago
  looks like apple wrote a native docker in swift you can now run linux containers on your mac ... but it could be better. what about (totally contrived): FROM apple/macos:10.11.6 RUN xcodebuild -project myapp.xcodeproj -scheme MyScheme -configuration Release
  • deleted 4mo ago
    [deleted]
  • webXL 4mo ago
    Nice, but expect to page through a few pages of ToS during the build
    • m463 4mo ago
      lol ENV XCODE_FRONTEND=unattended ENV XCODE_LICENSES=accept,firstborn,applepay,appleid=sjobs@me.com
  • trollbridge 4mo ago
    Close - but it would be more like this: services: macos: image: dockurr/macos container_name: macos environment: VERSION: "15" (And indecently slow.)
  • jadar 4mo ago
    i wish!
  • windowliker 4mo ago
    It would be wonderful if this ran on older versions of macOS, but according to the README they only support 26.
    • m463 4mo ago
      you do not understand... Not run on, run IN :) I'm saying the older version of macos could build/run INSIDE the container just like on a ubuntu 24.04 system you can do: FROM ubuntu:16.04 or docker run ubuntu:16.04 and though I haven't tried it, I believe docker can do arm in x86 using an emulator (like rosetta)
• jaimehrubiks 4mo ago
  Will this be able to replace docker desktop an equivalents, removing the expensive Linux VM that runs alongside them?
  • thejazzman 4mo ago
    It mostly removes the big shared background VM and replaces it with smaller, more isolated Apple-native VMs. I did an experiment migrating my Podman workload to Apple's container @ https://gist.github.com/jmonster/39e14585e107dbf990a90966c0f84427 https://gist.github.com/jmonster/39e14585e107dbf990a90966c0f... TL;DR reduces ram/storage usage; minimizes it's existence
    • deathanatos 4mo ago
      How does that work, realistically? > Memory defaults to half of host memory That's the most expensive part of the whole transaction, b/c AFAIK, RAM is then dedicated to the VM. It can be swapped out, I suppose, but that's not great.
      • MBCook 4mo ago
        CGamesPlay said above its balloon memory so it won’t use all that memory by default, but it can’t release balloon memory yet.
    • nozzlegear 4mo ago
      Nice, thanks for this. My plan is to swap over to Apple's containers for local dev, and keep using podman quadlets in production.
  • trollbridge 4mo ago
    That sure would be nice. I seem to rm -rf ~/.colima every few days.
  • usernametaken29 4mo ago
    My first thought as well, docker desktop overhead is pretty bad, would be awesome to see this land natively in DD. By my estimate this could happen, seeing as Docker has historically tried to improve performance but quickly had to accept platform limitations… would only be natural to settle DD over to containers
• namegulf 4mo ago
  Would be nice if they also support Intel based macs, what prevents?
  • danhon 4mo ago
    Allocation of a finite amount of engineering resources.
    • joshuat 4mo ago
      And a legitimate business interest to further incentivize the adoption of Apple Silicon devices. Same with Rosetta deprecation after macOS 27.
      • JumpCrisscross 4mo ago
        > a legitimate business interest to further incentivize the adoption of Apple Silicon devices Apple has never been about supporting legacy platforms with new features. And with over a quarter of revenue and two fifths of Apple's gross profits coming from services, one could argue the incentives run either way.
      • ForOldHack 4mo ago
        Rosetta 2. Rosetta was for Intel to emulate 68k, now if you could get Rosetta 2 to run under Rosetta, then you could run 68k, on an ARM, and if you could get the apple ][ emulator...
        • weikju 4mo ago
          Rosetta 1 was for emulating PPC not 68k
          • ForOldHack 4mo ago
            [dead]
      • crote 4mo ago
• blahgeek 4mo ago
  OrbStack works really well for me. I wonder how it’s compared to this performance wise
  • kdrag0n 4mo ago
    (OrbStack dev here.) Instead of Virtualization.framework, we have a custom Rust virtualization stack with custom devices and protocols for things like filesystem sharing. It's a highly optimized vertically integrated stack specifically for running our Linux machines and containers. Our biggest perf/resource gain is dynamic memory, which reduces memory usage a lot by releasing unused memory back to macOS. Nothing else supports this, including Containerization. I gave Container Machines a try and it seems to be much closer to OCI containers with a default bind mount than OrbStack machines. It has fewer integrations and doesn't run systemd or any other normal init system, so it's hard to run services.
    • egernst 4mo ago
      Thanks for the info kdrag0n! Big fan of OrbStack; good call out on dynamic memory. If the guest image has /sbin/init, we use that. We'd recommend using a base image for the guest that includes systemd. ie: https://github.com/apple/container/blob/main/docs/container-machine.md#bring-your-own-container-machine-image https://github.com/apple/container/blob/main/docs/container-...
    • kxxx 4mo ago
      Apple says that `systemctl` is supported... hmm am I missing something? "Real Linux services for testing. Run a database or whatever your stack needs as a system service — systemctl start postgresql works on images with systemd installed."
      • kdrag0n 4mo ago
        Good catch, I tried the example alpine commands and there was no init system. Makes sense if it's based on OCI images
• timsneath 4mo ago
  To clarify a few comments here: this is not only OCI containers: container machines add support for persistence and filesystem mounting, making container machines a great lightweight Linux environment for developers using macOS. More details here: https://developer.apple.com/videos/play/wwdc2026/389 https://developer.apple.com/videos/play/wwdc2026/389
  • Onavo 4mo ago
    Ah, the Darwin/BSD Subsystem for Linux.
    • CGamesPlay 4mo ago
      Not quite, it’s still a VM. And while it supports virtio balloon for growing RAM, it doesn’t yet support releasing that RAM back to the host. And there isn’t a convenient way to shrink the sparse disk images as they grow yet, either.
      • AlexB138 4mo ago
        Isn't the Windows subsystem for Linux (the reference there) also a VM?
        • gsnedders 4mo ago
          Only WSL2; WSL1 was an actual subsystem.
          • selcuka 4mo ago
            So this is Darwin/BSD Subsystem for Linux 2.
            • rvz 4mo ago
              Yes.
          • 4mo ago
• a1o 4mo ago
  With colima I can run AMD64 (x86) Linux containers in my Arm64 too. I think this is strictly for Arm64 Linux VMs, or is there some way to run x86 with this too?
  • frizlab 4mo ago
    Rosetta should be supported
    • whycombinetor 4mo ago
      Not for long!
      • commandersaki 4mo ago
        Very unlikely to lose support for Rosetta for Linux. Maybe just Rosetta 2 for mac apps.
        • whycombinetor 4mo ago
          Oh, didn't read that part of the news. That's great. Ability to run x64 docker images seminatively was one of the big reasons I jumped to the M1 platform when it came out and I was baffled that they would remove it.
  • cpach 4mo ago
    What’s the performance when you do that?
  • jdub 4mo ago
    You can run amd64 binaries inside an aarch64 Linux virtual machine. Although they're not supporting Rosetta for macOS apps from macOS 27, the Rosetta support in Virtualization Framework will remain.
    • andor 4mo ago
      Did Apple officially confirm this or is it based on the statement regarding games?
• WatchDog 4mo ago
  Do these containers share a common kernel? Or are they each ran in a separate VM? Edit: It's a VM per container. https://github.com/apple/container/blob/main/docs/technical-overview.md https://github.com/apple/container/blob/main/docs/technical-...
  • leshenka 4mo ago
    Isn't it wasteful? I know it's a "tiny" vm but still is a vm
    • pjmlp 4mo ago
      See Kata containers. https://katacontainers.io/ https://katacontainers.io/ For ultimate security, containers alone aren't enough. Windows is also having a similar feature on top of WSL, announced at BUILD. https://github.com/microsoft/mxc https://github.com/microsoft/mxc
      • Melatonic 4mo ago
        Isnt this a micro VM and not a container? Confused
        • pjmlp 4mo ago
          A micro VM than encapsulates a single container inside, two levels of protection.
• ChrisArchitect 4mo ago
  WWDC presentation video: Discover container machines https://developer.apple.com/videos/play/wwdc2026/389/ https://developer.apple.com/videos/play/wwdc2026/389/
• llimllib 4mo ago
  Is this new? I thought we had this already In my testing (iirc) filesystem performance was not good enough to be usable with node/rust dev where lots of small files get stat-ed update: what's new is the `container machine` subcommand. I went to test it out, but container failed to run at all for me: https://github.com/apple/container/issues/1681 https://github.com/apple/container/issues/1681
  • kdrag0n 4mo ago
    Curious if you've tried OrbStack? There's always more work to do (test workloads appreciated!) but we've put a lot of effort into optimizing for small files and other common developer workloads in OrbStack's customized filesystem sharing protocol (not standard virtiofs).
  • ahknight 4mo ago
    Podman is on macOS, FWIW. Uses the existing container framework to run the machine already. Root-full or not.
  • dchest 4mo ago
    Did you use their volumes for node_modules or a shared dir? I mounted the whole project directory (with node_modules) inside the container and it seems to work fine (MBA M1 8 GB RAM).
• commandersaki 4mo ago
  Would be cool if you can redirect USB devices to the VM.
  • kdrag0n 4mo ago
    We just released this in OrbStack :) https://docs.orbstack.dev/features/usb https://docs.orbstack.dev/features/usb Blog post soon
    • commandersaki 4mo ago
      Yeah I find this useful for redirecting storage/sdcard*, so you can format linux filesystems or use other tools. * need a usb sdcard reader for macbook pro cause the builtin is not usb)
      • kdrag0n 4mo ago
        We're working on block device passthrough for the builtin SD reader.
    • calebm 4mo ago
      Thank you for sharing this - I looked into OrbStack a few months ago, and this was the reason I didn't use it (as my primary purpose was to have an external wifi adapter for wifi pwnage).
    • blackqueeriroh 4mo ago
      What happened to Orbstack for like 9 months until earlier this year? Suddenly everything went silent for a bit and I was pretty concerned. Glad y’all are back!!!!
  • egernst 4mo ago
    Agreed! There's some good improvements around Accessory Access in virtualization framework this year also - checkout: https://developer.apple.com/videos/play/wwdc2026/224/?time=274 https://developer.apple.com/videos/play/wwdc2026/224/?time=2...
• Barbing 4mo ago
  I found it hard to believe I didn’t have a simple way of staying safe by installing an arbitrary application in a sandbox on macOS. (Restoring using Time Machine doesn’t count! :) ) This is a step in the right direction but requires any given developer’s buy-in first, right?
• numbsafari 4mo ago
  Wouldn’t it be nice if services like Codespaces or Coder or Gitlab would allow you to target running on their hosted/integrated platform, or let you launch that same container completely locally? Sometimes I wanna take my “remote” dev environment off-line but still benefit from the integrated UX.
  • CGamesPlay 4mo ago
    If you can express that operation in Terraform, then Coder would let you do that. First problems I can think of are connectivity from the Coder provisioner to your local machine (Tailscale? Local?), and migrating disk images if you want to actually switch a workspace between environments (local provisioner could do this, but no matter what it’ll be slow and janky).
  • RossBencina 4mo ago
    This exists. It's called devcontainers and there is a cli for managing it locally. https://github.com/devcontainers/ https://github.com/devcontainers/ https://containers.dev/ https://containers.dev/
  • jayd16 4mo ago
    Maybe I don't understand but why doesn't Gitlabs self hosted setup work?
• sachinjoseph 4mo ago
  WSL-like implementation on macOS?
• deleted 4mo ago
  [deleted]
• osigurdson 4mo ago
  I'm surprised they cared enough to do this. I'd still rather use Linux but MacBook value is incredible.
  • marssaxman 4mo ago
    I'd always rather use Linux, but sometimes your employer gives you a MacBook. I might use this tool.
• 0xbadcafebee 4mo ago
  Anyone know why you would use this instead of QEMU+Lima+Colima+Docker/containerd? The latter works on multiple OSes, has a very large ecosystem of tools, images, documentation, and lets you replace pieces as needed
  • CarlitosHighway 4mo ago
    From a layman's POV ("I just want to run my containers I need for dev work"), there's no point in switching to this for now. It's just cool that Apple cares enough about containers and might come up with an Apple-like built-in solution some day, this is the groundwork. I'd stick to Colima, or Orbstack if you trust them enough to not do a rug-pull once their users are reliant on them enough to pay any amount.
  • lxgr 4mo ago
    QEMU has worse performance than Apple's native virtualization framework on macOS, for one thing. That said, Lima supports the latter as well.
    • einsteinx2 4mo ago
      Yeah I was gonna say I use Colima with Apple’s virtualization framework (it’s not the default for some reason but it’s a single command line flag), and found it works better than QEMU (better performance and resolved some bugs I was running into with the Supabase docker stack)
• m132 4mo ago
  Every time I see Apple flaunting Linux containers I can hardly consider it as anything but admitting defeat. It could easily be Darwin, if they still had the capacity.
  • groundzeros2015 4mo ago
    Just change 30 years of internet history
    • al_borland 4mo ago
      For what it's worth, the first web server was a NeXTcube, and NeXTSTEP was the foundation of macOS.
  • ahknight 4mo ago
    [dead]
  • tw04 4mo ago
    What is the alternative? They gave up the server market a decade ago and before that they barely actually supported it. If they were to support darwin containers, what would be the point? Literally nobody would build to it, Linux won.
    • riffic 4mo ago
      > Literally nobody would build to it because nobody does ci/cd against macOS or iOS apps right?
      • tw04 4mo ago
        And what is the revenue stream tied to that ci/cd pipeline they aren’t capturing today? Apple would sell less hardware in order to…? There aren’t any app developers avoiding the Apple ecosystem because there aren’t Darwin containers. They don’t sell server hardware and by all accounts have no intention of ever reentering that space. So they’d spend a bunch of developer cycles to reduce their own revenue stream with no apparent upside beyond “goodwill” which they’ve never been overly concerned about.
• t1234s 4mo ago
  Is this similar to what cygwin was for windows? Could this be an alternative to homebrew?
• cogman10 4mo ago
  Is there any reason why macOS doesn't try a WSL1 style approach? I get why that didn't fully work out for windows, but it seems like macOS being another *nix would make a lot of what was hard for windows, easy for mac. It seems like it should be possible to run most linux applications natively on macOS with few additional new APIs. BSD actually has this already.
  • twoodfin 4mo ago
    What would be the advantages over a VM infrastructure Apple needs anyway and that has a much simpler, more stable “ABI” compared to the Linux kernel?
    • cogman10 4mo ago
      Potentially faster application execution along much lower memory requirements. In the case of docker, even a possibility of shared library loading further reducing runtime costs (For example, containers based on the same base image could load glibc into memory only once). There's also simply the possibility of using linux software directly in macos without doing OS dependent changes to the software.
      • MBCook 4mo ago
        Yeah. But in exchange it’s a lot of work to keep up with. For GUI stuff you’re now having to have some sort of Wayland layer/driver. Running VMs is really really easy and low maintenance demand on Apple. And it’s guaranteed compatibility. Wasn’t compatibility what really sunk WSL1?
        • skissane 4mo ago
          > Wasn’t compatibility what really sunk WSL1? Yes, but a big part of the problem with WSL1 was the size of the conceptual gap between POSIX and Windows NT that WSL1 had to bridge. An “MSL1” would likely have fewer problems because the gap between macOS and Linux is smaller, given they are both POSIX The other thing Apple could potentially do, is add Linux-compatible APIs to macOS. IBM wanted to support Kubernetes on their z/OS mainframe operating system, so they implemented on it a clone of Linux namespace APIs, e.g. unshare. Then we could have macOS nodes in a K8S cluster-which might actually be useful for some people, e.g. if you have a Jenkins CI farm, the Linux nodes can run on K8S, but currently macOS nodes (which you need if you are targeting iOS or macOS) can’t, they have to be bare metal or VMs. More Linux-macOS source compatibility would also benefit macOS by making it less work to port software to it from Linux
• jwlake 4mo ago
  haven't we had hypervisor.framework for like years now?
• michaelsbradley 4mo ago
  Can macOS be run as a container machine on macOS?
  • blackqueeriroh 4mo ago
    Yes
    • MBCook 4mo ago
      Yep. For a few years. And they keep enhancing it too. It’s the only legal way to do so, due to the software license on MacOS.
• rickstanley 4mo ago
  I was wondering if it's possible to have the container volume change to, say, an external drive. I currently use QMEU with qcow2 images to achieve this, works well enough.
  • opengears 4mo ago
    Also works with UTM.
• Joyfield 4mo ago
  We have WSL at home.
• mkagenius 4mo ago
  Apple containers are great for providing a sandbox to your AI coding agents I have made it a MCP so that it's easily discoverable by all the coding agents https://github.com/instavm/coderunner https://github.com/instavm/coderunner
• xiaodai 4mo ago
  so basically dockers
• noobcoder 4mo ago
  The costs are startup time and image compatibility: dockerhub images don't work as machine images because container machine expects systemd I am trying it on but its brekaing on homebrew 1.0.0. The formula puts plugins at opt/container/libexec/container-plugins/ and the apiserver looks in libexec/container/plugins/ This can be solved through a symlink or smth
  • masklinn 4mo ago
    > dockerhub images don't work as machine images because container machine expects systemd Are you sure about that? A few comments above a commenter states that they don’t run inits at all (because they ran alpine), multiple people replied that it works fine if you give it an image with an init, and they acknowledged their error.
• gigatexal 4mo ago
  I saw the video on this this is distrobox basically for Mac. It’s very cool. Seamless with your local files and the container. I’m very keen to try it.
• vachanmn123 4mo ago
  Could this allow us to use proton on mac maybe?
  • xd1936 4mo ago
    This is hilarious. Next year, the PC gamers will be saying "The best Windows gaming experience is win32 on Linux on macOS Containers".
    • Gigachad 4mo ago
      I mean at this point literally anything works better than Windows.
      • pjmlp 4mo ago
        Except game development, hence Proton.
        • asimovDev 4mo ago
          it always gets a sad chuckle out of me to hear that some native linux ports run worse than the windows version under proton. i think valve games are like that (l4d2 for example) and recently I think Hollow Knight: Silksong was like that
          • Gigachad 4mo ago
            I think at this point native linux ports are somewhat a thing of the past. The problem was that the ports were usually contracted out to a 3rd party and rarely updated or cared for that much. There was also the issue that they often relied on dynamically linked libraries provided by the distro rather than static linked libraries bundled with the game. So stuff that did work would break on distro updates. The proton model has the benefit that bugs on linux can be fixed by Valve and the Wine community. While bugs in an official linux port can only be fixed by the game publisher which rarely happened. There also seems to be virtually no downsides to running a Windows game in Proton. These days I don't even bother checking the Wine DB or proton rating because unless the game is deliberately blocking linux via anti cheat, it will just work.
• jzer0cool 4mo ago
  In the intro it mentions automatically mapping user and home dir. So host files accessible the container. Any settings to control this?
• CSDude 4mo ago
  I know its not going to be there but wish we had Windows as well.
  • Cadwhisker 4mo ago
    Install Windows 11 ARM under the macOS "UTM" App. This lets you run x86 Windows programs on Apple silicon.
• pjmlp 4mo ago
  With the BUILD and WWDC 2026 announcements, it is the Year of Linux Containers Desktop. Which for many folks is good enough for what they are doing, thus the status quo of desktop platforms will hardly change for current form factors.
• golem14 4mo ago
  I belong to a rare breed of very opportunistic hobby-developers that like to use MacOS but also like to use linux machines or BSDs (rpi etc) sometimes. I can create docker-images with docker compose, or use something like colima, which this seems to be close to (that should have some advantages over docker, although my hope of circumventing W^X page protection did not pan out). I was perplexed that the repository does not put these container machines in context. The seem to be close to colima? When should I use which option (docker, collima, container machines ?) Maybe others wonder too but are ashamed to ask. I have no shame ;) Thanks for any pointers
  • klohto 4mo ago
    https://github.com/apple/container/blob/main/docs/technical-overview.md https://github.com/apple/container/blob/main/docs/technical-... read documentation mr. rare breed
    • startakovsky1 4mo ago
      Like, this doesn’t answer when to use this vs Docker. Any reference there?
      • happyopossum 4mo ago
        This is not the apple container framework / that’s the docker alternative. This is a project to easily run full Linux machines in macOS containers.
      • cowsandmilk 4mo ago
        Use this because docker has very problematic licensing on MacOS.
      • golem14 4mo ago
        [flagged]
  • djsavvy 4mo ago
    Why try to circumvent W^X page protection? Some sort of self-modifying program without extra pointer indirections?
• zekrioca 4mo ago
  "LXC" for macOS?
• jbverschoor 4mo ago
  Just curious, Apple seems to copy orbstack.. haven’t they made an offer to acquire you guys?
• phplovesong 4mo ago
  It was unclear to me, is this a native replacement for docker? I like docker (on mac) but its quite the resource hog. I usually run like a db, redis, maybe something like rabbitmq/zeromq and have a app that uses these services (makefile/docker-compose). I would love to switch if this in fact is a lightweight replacement.
  • masklinn 4mo ago
    On the one hand yes, on the other hand there are already multiple lighter alternatives to docker on mac.
  • happyopossum 4mo ago
    A native replacement for docker came last year with Apple Containers- this extends that.
• lzwjava 4mo ago
  [flagged]
• katspaugh 4mo ago
  I've looked into replacing Lima with Apple Containers for https://runmachine.dev https://runmachine.dev. However, unlike Lima, an Apple Container is not a full VM, so you cannot SSH to it, or forward SSH-agent signatures into a machine. So it's more of a devcontainer story, which is also a great use case. Nice to see Apple creating tooling around their VZ framework. Edit: referential clarity.
  • binsquare 4mo ago
    Might consider https://github.com/smol-machines/smolvm https://github.com/smol-machines/smolvm It's a full vm
• itsneulook4 4mo ago
  that thepolfus and the Otis and the bors and the alschweid and pretty much anyone in old the the gs gangstalk or just getting people info to sit in the same room as them to try and makr them go crazy deserve to brave hart quartered
  • khazhoux 4mo ago
    try unplugging your keyboard and then plugging it back in
• rakel_rakel 4mo ago
  It's funny that the system config page (https://github.com/apple/container/blob/main/docs/container-system-config.md https://github.com/apple/container/blob/main/docs/container-...) lists pebibytes for RAM configurations... in this day and age where buying a 16GB stick for workstation would cause me to eat instant ramen for a couple of months because my dentist needs an LLM chatbot on their page to stay competitive! UX wise it looks kinda neat though!
  • borborigmus 4mo ago
    Signed in just to say LoL at the dentist comment.
• itsneulook4 4mo ago
  Yeah but sitting in the tweak circles just to gather personal data about people to make them lose their minds is no bueno. Otipolfueriborsklineypoo
• tonymet 4mo ago
  What FS mounts the Mac drives into the Linux container ?
• cromka 4mo ago
  So essentially both macOS and Windows now heavily support developing using Linux on them. They can't more openly admit that they are no match for Linux in that area. There's some clever advertising in it for Linux, if Linux was advertising.
  • rahkiin 4mo ago
    I’d argue they both admin that Linux servers are the target for a lot of applications to run on. Not to develop on.
  • plutokras 4mo ago
    Enterprises would do anything to develop on Linux except using an actual Linux distro.
  • neop1x 4mo ago
    A lot of devs needs to use linux but they still use it just as a VM (Mac) or in some kind emulation (WSL). How pathetic.
    • cromka 4mo ago
      If they need to, it's because it's their work computers. Otherwise it's a choice.
    • nozzlegear 4mo ago
      What's pathetic?
  • artistonn 4mo ago
    Linux also can't openly admit that it's no match for macOS/Windows on the desktop, which is why we have this hybrid situation - macOS/Windows desktops running Linux VMs
    • krzyk 4mo ago
      Unfortunately there are more and more users on Linux and as a result windowsization/macosization of Linux is in progress (systemd, wayland, some scary stuff Poettering is doing with boot, snap/flatpack).
• qalmakka 4mo ago
  This is all fine and dandy, but where are the native Darwin Jails Apple? Still scared that people will filling whole rooms of Mac Minis if you allow them to have multiple macOS containers and not only up to two fat VMs per machine?
  • adastra22 4mo ago
    sandbox profiles?
    • qalmakka 4mo ago
      macOS sandboxing is deliberately limited just enough to prevent anyone from truly implement Darwin-on-Darwin containers. People have been discussing about this for a while, see https://github.com/apple/container/discussions/611 https://github.com/apple/container/discussions/611 In general I understand the rationale behind Apple's decision. They sell hardware, and there's real demand for macOS on servers to run build jobs and other Mac-only tools. Giving you the ability to run multiple containers on a single Mac would end up turning a 10 Mac Mini order into a 2 Mac Minis order for most people. Rest assured, even if it would be technically possible they'd find a way to cap it somehow via the EULA or whatever
      • coldtea 4mo ago
        I doubt this insignificant statistically speaking market (compared to the overall units they move) is what prevents them.
        • inejge 4mo ago
          Domino theory as applied to business, plus one should never underestimate the lengths to which a company will go to wring the last ounce of profit from a market.
      • larodi 4mo ago
        and how is this, having containers run hardware one owns, a bad or even shameful idea, given people do it and want to do it with their hardware all the time?
• harrouet 4mo ago
  Why did they have to invent their own solution instead of just shipping docker or an equivalent clone ?
  • nottorp 4mo ago
    Isn't docker on mac os still a large preallocated linux VM that runs the containers inside itself? With this maybe you can separate them.
• konaraddi 4mo ago
  Sounds like toolbox or distrobox for Mac!
• ShinyLeftPad 4mo ago
  Can Podman support these eventually?
  • kosikond 4mo ago
    There _is_ Podman Desktop extension for Apple Containers, however its socktainer version is ancient.
• beemboy 4mo ago
  Is this going to be good for AOSP builds on Macs?
• k_bx 4mo ago
  Most of my team's development happens on beefy desktop machine in incus containers per dev+project (so you run yourname-projname-dev). It has its own tailscale inside so you can open it like regular https website or give to another dev to check out – no need to deploy your branch somewhere, just run it. New dev onboard takes 10 minutes from zero to dev env with VSCode remote development. I would really love if apple could give inexpensive way to run amd64 containers for situations when dev wants to use their own hardware. We've used LIMA for now, was too much of a hussle. But if there's a more native experience – would give it another try.
• tannhaeuser 4mo ago
  Just to clarify, this requires Mac OS 26 Tahoe for "container" doesn't it? So those of us holding out on Sequoia who can't stand the broken glass UI or what's called and the other undesired features need to stick to Docker desktop.
  • jorisw 4mo ago
    [dead]
  • coldtea 4mo ago
    >those of us holding out on Sequoia who can't stand the broken glass UI or what's called Maybe hold 1 release back, but other than that, I don't think "holding out" on macOS releases has ever been a winning strategy. In the end, macOS model presupposes users moving to the latest release sooner rather than later.
  • niek_pas 4mo ago
    It seems macOS Golden Gate (the upcoming version) fixes quite a few of the problems with Tahoe, so you might consider skipping Tahoe entirely.
  • egorfine 4mo ago
    Yeah I use Tahoe and I can't stand the liquid glass. It looks like Golden Gate fixes this design a lot.
  • masklinn 4mo ago
    > Just to clarify, this requires Mac OS 26 Tahoe for "container" doesn't it? Yes’n’t: https://github.com/apple/container/blob/main/docs/technical-overview.md#macos-15-limitations https://github.com/apple/container/blob/main/docs/technical-... > container relies on the new features and enhancements present in macOS 26. You can run container on macOS 15, but you will need to be aware of some user experience and functional limitations. There is no plan to address issues found with macOS 15 that cannot be reproduced on macOS 26. The issues are around networking.
  • jrochkind1 4mo ago
    I turned off what "glass" UI I could with config, and it's not too different than Sequoia, got used to it pretty quick. Obviously the things not supported on an old OS will keep increasing, until eventually it is EOL'd.
• LaFolle 4mo ago
  Python binary wheels now have to be built for aarch64 for them to work inside the container, unless they are built using the corresponding build system while installing. It is not common for python binary libs to publish arm64 binary wheels, as most often they target amd64.
  • KeplerBoy 4mo ago
    Isn't that just expected for modern macOS devices? They have been on arm64 for 6 years now.
    • coldtea 4mo ago
      This however is for Linux containers on macOS, and for those the deployment target are not usually/necessarily arm. (Plus, you could always even have amd64 linux containers on macOS AS, with good performance, via Rosetta2).
• sdevonoes 4mo ago
  Im running Multipass on M1 for full linux VMs. Are container machines better?
  • m1keil 4mo ago
    Isn't multiphase is Ubuntu only?
    • sdevonoes 4mo ago
      It used to be. Any image is allowed now.
• pmontra 4mo ago
  How is this different from Virtualbox or similar products with a shared folder with the host machine? I expected that existing virtualization tech for Macs already did that. Maybe the improvement is having nothing to configure. By the way, is it headless or can it run a full Linux desktop? Use case: buy a Mac, uninistall whatever can be uninstalled, run the Linux VM as primary desktop forgetting MacOS and without going through Asahi and the incomplete hardware support.
  • iririririr 4mo ago
    it differs by lacking all the cool options that makes vmware and virtualbox good products, but apple users will praise it as a benefit "bind mounts? I'm better without it"
    • coldtea 4mo ago
      Funny how confidently people can mock while knowing nothing about the specific tech discussed and the different targets. I'd google: VirtualBox vs containers.
      • pmontra 4mo ago
        It's called a container machine but it's a virtual machine. I quote from https://github.com/apple/container/blob/main/docs/technical-overview.md https://github.com/apple/container/blob/main/docs/technical-... > container runs containers differently. Using the open source Containerization package, it runs a lightweight VM for each container that you create. This approach has the following properties: > * Security: Each container has the isolation properties of a full VM, using a minimal set of core utilities and dynamic libraries to reduce resource utilization and attack surface. > * Privacy: When sharing host data using container, you mount only necessary data into each VM. With a shared VM, you need to mount all data that you may ever want to use into the VM, so that it can be mounted selectively into containers. > * Performance: Containers created using container require less memory than full VMs, with boot times that are comparable to containers running in a shared VM. So: you build it as a container image and MacOS starts a VM to run it. Edit: quite unusually for a container it runs systemd. They give an example "systemctl start postgresql".
• shelled 4mo ago
  I hope this brought us one step closer to being able to run our distros of choice very freely and easily on a Mac.
• aspeckt_112 4mo ago
  This is pretty cool - being able to bring your own container machine image goes a long way to helping it's adoption. I started using Colima a couple of years ago because I got bored of how bad Docker Desktop was and just started using the CLI / the "Services" tool window in whatever Jetbrains IDE I was using at the time anyway. I can't see myself moving away from it any time - having multiple profiles is an absolute winner of a feature for me there, but maybe the next time I set up a Mac from scratch I'll have a play with this.
• Havoc 4mo ago
  Always nice to have more options especially without third party tools
• rcarmo 4mo ago
  This blew up spectacularly when combined with Time Machine, I wonder if that’s fixed.
  • happyopossum 4mo ago
    Considering that this project was published less than 24 hours ago I’m guessing you assume it’s a different project.
• emulio 4mo ago
  This appears to be an LXC-style alternative for macOS; however, unlike native LXC on Linux, this tool relies on VMs. While Docker and Podman also utilize a VM on macOS, they offer the advantage of the Docker Compose format. In my view, the ability to use YAML for declarative configuration is the most critical feature for any container tool. I have nothing against CLI tools in general, but I prefer avoiding repetitive manual commands that could be easily automated via Docker Compose or Kubernetes manifests.
  • notpushkin 4mo ago
    Apple does have an OCI variant of this: https://github.com/apple/container https://github.com/apple/container Doesn’t seem to have Compose support though, but it’s probably not impossible to build upon. And of course, it also uses VMs, though unlike Docker, it’s one (micro-?) VM per container: https://github.com/apple/container/blob/main/docs/technical-overview.md#how-does-container-run-my-container https://github.com/apple/container/blob/main/docs/technical-...
• kenanfyi 4mo ago
  I don‘t understand why these tools always advertise about mounting the $HOME inside the container. Isn‘t it better to have a complete isolation? Isn‘t that the point of using such a thing?
  • LoganDark 4mo ago
    No, the point of using such a thing is to be able to run Linux workloads. For example, I recently used Containerization to generate trace logs from the tup test suite so that I could bring it up to relative parity on macOS. If it had complete isolation, I would have difficulty getting the modified source code into the container and difficulty getting the trace logs back out of the container. Sure, you can paper over this with bind mounts or whatever the fuck but that's annoying
    • kenanfyi 4mo ago
      Understand. And yeah that‘s annoying. I use containers only for development and to keep my main system secure from supply chain attacks. I have almost no build tooling in my Mac anymore. No npm, no cargo, no uv. Nothing. They all live inside the container which is completely isolated. I guess my use case is not that important for the main user of these tools.
      • LoganDark 4mo ago
        I wouldn't say your use case is not important. That is a completely reasonable way to work. I just wouldn't say mounting home directories is an anti-feature. There just should be a way to turn it off.
        • kenanfyi 4mo ago
          Well, maybe I should have used relativity unimportant. And yes there should be a way to turn them off. In OrbStack it was not possible to do that until lately.
  • sigmoid10 4mo ago
• avsm 4mo ago
  I looked at this last year when it came out in Tahoe: https://anil.recoil.org/notes/apple-containerisation https://anil.recoil.org/notes/apple-containerisation and this looks like more of the same. They've now added a WSL-style virtual machine layer, but there's no x86 container story (Apple's killing Rosetta) so I imagine some qemu shimming will be required. There's still no equivalent to VPNKit or GVisor for networking so you'll be bridging I think. See: https://cacm.acm.org/research/a-decade-of-docker-containers/ https://cacm.acm.org/research/a-decade-of-docker-containers/ for how Docker for Mac does this I can't spot any support for dynamic memory ballooning to prevent the hypervisor from gobbling up too much memory. We've had this in Xen since forever! https://xenproject.org/blog/ballooning-rebooting-and-the-feature-youve-never-heard-of/ https://xenproject.org/blog/ballooning-rebooting-and-the-fea... And, most obviously: NO SUPPORT FOR MACOS. This is the single feature that only Apple can do, and they're choosing not to implement it deliberately, and it's so stupid given the pains we all have to go through to implement CI for macOS. In the land of OCaml, we were forced to implement a custom ZFS snapshotter to get reasonably cost effective macOS CI for our package repository: https://tarides.com/blog/2023-08-02-obuilder-on-macos/ https://tarides.com/blog/2023-08-02-obuilder-on-macos/. This was fun to build, but it sucks to have to maintain it. Also, I'm really curious what the GPU passthrough story here is for LLMs, since the Apple Silicon -> Linux kernel support is gated on Asahi's support, but that's been lagging beyond M2 due to the efforts of reverse engineering. Do better for your developers, Apple. This is a half-baked sweep across third-party software without addressing the core needs around your own operating system.
• throw1234567891 4mo ago
  And no GPU passthrough? So colima with libkit remains the only method on Apple Silicon?
• Lapsa 4mo ago
  [dead]
• Igor_Wiwi 4mo ago
  Interesting from a Docker perspective, but I’m more interested in it as a sandbox for AI agents and untrusted code execution. I wrote about that angle here: https://igorstechnoclub.com/sandbox-exec/ https://igorstechnoclub.com/sandbox-exec/ Feels like the spiritual successor to sandbox-exec, but with VM-level isolation.
  • avel 4mo ago
    Yes, that article states that as well under limitations: "Deprecation status: While functional, Apple discourages its direct use in favor of App Sandbox for developers."
• deleted 4mo ago
  [deleted]
• almaight 4mo ago
  It's been over a year since it came out, based on kata-container
• naikrovek 4mo ago
  ah, a rare step closer to plan9. (you remote into a system and part of your environment comes with you; that's very Plan9-like.)
• yurimo 4mo ago
  I'm pretty sure this is not the use case at all but man do I miss bootcamp. Even for games if we could just run linux without a need for crossover, gaming on mac machines would be a dream.
• krzyk 4mo ago
  Oh, I hoped it would be macos contained in those containers. Container for Linux are in millions, while I don't know if there are any with macos inside.
• GHanku 4mo ago
  [dead]
• ExoticPearTree 4mo ago
  Will this come to MacOS 27? LE: nevermind, it is already on MacOS. Did not read everything.
  • asxndu 4mo ago
    Available from 15
• cdnsteve 4mo ago
  Is it just me or is the experience to get this up and running not feeling very Apple like? Is there no one liner to install or did I miss something?
• asxndu 4mo ago
  Could this be an analogue of WSL on windows but for MacOS?
• alwinaugustin 4mo ago
  Why it is important ? We have Docker for containers, right ?
• yeswecatan 4mo ago
  How would I replace docker compose containing multiple services that communicate with each other with this? Seems cool for an individual service.
• bicepjai 4mo ago
  So are there any benchmarks that compare all containers / docker / Lima / Colima / virtual box / VMware / orbstack and others ?
• solenoid0937 4mo ago
  They shouldn't bury the details about how the containerization actually works.
• zer0zzz 4mo ago
  I just want thunderbolt pci passthrough for these things.
  • kdrag0n 4mo ago
    Interesting, what devices would you want to pass through?
    • zer0zzz 3mo ago
      Gpus of course
• exabrial 4mo ago
  Handy for sure! In production though, I've moved completely to systemd isolation of apps, rather than Docker-like containers; essentially blackboxes and present a supply chain threat. There's also a DRY principle here. Verification of a host presents a much smaller surface area.
  • bityard 4mo ago
    > moved completely to systemd isolation On MacOS?
    • exabrial 4mo ago
      Negative: > In Production
• running101 4mo ago
  Seems like wsl (windows subsystem for linux)
• thedougd 4mo ago
  I still can’t use Containers because of a broken DNS implementation. I suppose I could manually set the DNS as I switch on and off VPN, but I don’t have to with Finch, Podman, or Docker Desktop.
• kstenerud 4mo ago
  This is awesome! I just added this as a backend for yoloAI on Mac, and wow... super fast startup times now!
• jlhawn 4mo ago
  Michael Crosby wrote this! He's a long-time maintainer of Docker, Containerd, and more! He was Docker's first to receive the 'Distinguished Engineer' Title. This means a lot coming from him.
• Melatonic 4mo ago
  Sounds a lot more like micro VM's and not normal containerization
• brianmartin039 4mo ago
  I've been using Lima for this exact workflow. Apple's implementation looks cleaner though, especially the automatic user mapping. Curious how the performance compares.
• zoetaylor00 4mo ago
  [dead]
• lanycrost 4mo ago
  I will wait when docker or podman will adopt this :D
• musicale 3mo ago
  I can't help but think it was a mistake for "Open" containers to be Linux-only. Why can't we have POSIX containers, for example?