WWDC25, the event where Apple unveiled new versions of its operating systems, kicked off a few hours ago. The keynote briefly touched on iOS, iPadOS, tvOS, macOS, watchOS, and visionOS, which now share the number 26. The limited duration of these presentations doesn't allow for much in-depth discussion of system features, and some things are only revealed through other means. Among them is Containerization , which isn't Apple's Distrobox or WSL, but it does resemble both concepts.
Virtualization and containerization have revolutionized application development, allowing teams to create fully isolated and replicable environments to efficiently deploy software and manage resources. Apple, recognizing the importance of these technologies in both development and production, has taken a step forward by launching its own Containerization framework optimized for its Apple Silicon devices and processors.
What is Containerization according to Apple?
Apple's Containerization framework is an open-source software package developed in Swift that allows applications to manage Linux containers directly on macOS running Apple Silicon devices (the company's well-known ARM chips). Unlike traditional systems where multiple containers share a single host operating system kernel or a large virtual machine, Apple chooses to run each container in its own lightweight virtual machine.
This approach achieves a unique balance: it maintains the efficiency and portability inherent in containers, while adding the robustness and isolation of virtual machines. Each container runs in its own virtual environment, without sharing a kernel with the others or the host system, greatly hindering potential escalation or leakage attacks between containers.
Motivation and Background: Containers on macOS
Until Apple's solution appeared, developers using Macs who needed Linux environments relied on alternatives like Docker, Podman, Orbstack, or Lima . However, these tools had significant limitations in performance, resource consumption, and especially security due to the use of monolithic VMs hosting multiple containers and intensive kernel sharing.
In sensitive environments, isolation issues and the potential for process leakage led many companies and organizations to dismiss these systems for production. Apple, by launching its own framework, addresses these gaps and aims to position itself as a leader in the secure and efficient execution of Linux containers on Mac.
Technical characteristics of the Containerization framework
- Total insulation per container: Each container runs inside an independent, ultra-lightweight virtual machine, ensuring kernel-level isolation and hindering escapes or intrusions that could affect other environments or the host system.
- Optimization for Apple Silicon: The framework is written in Swift and relies on Virtualization.framework, taking advantage of the hardware acceleration of Apple's ARM CPUs, resulting in container startups in fractions of a second and very low resource usage.
- Advanced image and network management: The system enables image management under the OCI standard, interaction with remote registries, and the assignment of dedicated IP addresses to each container, eliminating the complexity of port mapping and facilitating service discovery and balancing.
- Custom kernel configuration: Developers can select specific kernel configurations per container, tailoring each environment to the exact requirements of their applications and validating compatibility between versions.
- Minimization of the base system: Each VM runs a minimal base system containing only vminitd, a statically compiled init system without any dynamic libraries or common utilities, reducing the attack surface.
- Rosetta 2 support: It allows running x86_64 images on ARM computers without perceptible penalty, making it easier to transition and maintain mixed or legacy environments.
Advantages of the architecture proposed by Apple
- Enhanced security: By not sharing kernels or dependencies, each container is completely isolated, aligning with zero-trust security principles. The extreme minimalism of the init system and the lack of exploitable tools drastically reduce the risk of privilege escalation or data leakage.
- Efficiency in the use of resources: Ultra-lightweight virtual machines only consume resources when they're active. There's no need to reserve RAM or CPU for a container pool that might be idle, optimizing overall system usage.
- Simplified and flexible network: Dedicated IP allocation eliminates the historical headaches of port mapping and internal network management in containers, facilitating the interconnection and horizontal scaling of microservices.
- Compatibility and portability: Support for standard OCI images and seamless integration with registries allows the same CI/CD pipelines and container assets to work directly on Mac without any changes or customizations.
Apple Framework Components
- Containerization Swift Package: The base library that provides APIs for managing images, registries, file systems, processes, and integration with the native init system and custom kernels.
- vminitd: A minimalist init system, written in Swift and compiled with the Static Linux SDK, that runs as the first process in each VM. It requires no dynamic libraries or system tools and exposes a gRPC API over vsock to control process lifecycles and environment configuration.
- Optimized kernels: Minimized Linux kernels, tuned for fast boot times and minimal power consumption, although it is possible to select or compile custom configurations for advanced use cases.
- User Tools: cctl It is the main CLI tool, which allows you to manage images, launch containers and test the framework API in a simple way, similar to the usual Docker commands.
How it works in practice: from code to deployment
The framework offers APIs and CLI tools for the following processes:
- OCI image management and manipulation.
- Secure interaction with remote registries.
- Creating and formatting ext4 file systems.
- Advanced network management via Netlink sockets and individual IP assignment.
- Execution and monitoring of processes within containers thanks to the proprietary init system.
- Management of runtime environments per VM, with APIs for choosing kernel, versioning, and container-specific configurations.
- Integration with Rosetta 2 for use of x86_64 images on Apple Silicon systems and cross-compatibility verification.
Each container starts up instantly ( sub-second ), surpassing in many cases the startup experience of Docker or Podman, and resource management is completely dynamic.
Requirements and compatibility
To use the Apple framework you need:
- Have a Mac with Apple Silicon (M1, M2 series onwards).
- macOS 15 or higher, although to take advantage of all the capabilities and avoid limitations, recommend macOS 26 Beta 1.
- Xcode 26 Beta and updated Swift build tools.
Some features, such as container-to-container communication within the same network segment, are only fully enabled on macOS 26 and later.
Developer Details and Workflow
The typical flow for a developer with this framework includes:
- Install the recommended dependencies: Swiftly, Swift, Static Linux SDK, and correct versions of grpc-swift and swift-protobuf.
- Compile the package from sources using the provided scripts and utilities.
- Using cctl to test and manipulate images, launch containers, manage root file systems, and automate deployment or testing tasks.
- Customize the kernel if any specific feature not included in the default configuration is required, following the repository documentation.
- Integration with standard CI/CD pipelines and registries for collaborative development flows and deployment across mixed teams.
The official documentation provides step-by-step guidance on initial setup, common troubleshooting, and automation of common workflows.
Comparison with other solutions: Docker, Podman and the Apple model
Docker and other solutions allow you to run containers on Mac, but they do so through a single Linux VM where all the containers reside, which means:
- Higher base resource consumption (VM is always active).
- Fragmentation and complexity when sharing files between the host, VM, and containers.
- Larger attack surface and isolation issues, as a failure can impact all resident containers.
- Difficulty assigning unique IPs and communication between containers and host services.
Apple's model, by creating VMs per container, eliminates these bottlenecks. While it may initially seem less efficient, ultra-lightweight VMs and selective resource utilization make it a superior model in terms of security and flexibility, especially in environments where isolation and compliance are a priority.
Compatibility and migration of existing workflows
One of the common concerns when migrating to new technologies is the compatibility of assets and workflows. Apple's framework maintains full compatibility with standard OCI images, meaning existing images will work, and registries and pipelines can remain unchanged. Tools like cctl use commands similar to those in Docker, so the learning curve is gentle.
Contributions and community
The project is open source and welcomes external contributions, facilitating participation thanks to a modular Swift architecture and clear contribution guidelines. The package maintainers encourage code contributions, suggested improvements, and issue reporting to accelerate development and adoption.
The versioning model guarantees binary stability between minor releases, providing confidence to those who want to adopt the framework early in its lifecycle.
Ideal use cases and applications
Apple's Containerization framework is particularly interesting for:
- Developers who need to test and deploy Linux applications on Mac natively and securely.
- Companies and organizations where security and isolation are mandatory (financial sector, health, AI, etc.).
- Organizations that have invested in OCI pipelines and want to leverage existing pipelines without compatibility risks.
- Mixed teams that are migrating from x86 to ARM architectures and need a smooth transition.
- Projects that require different kernels or custom configurations for different containers.
Flexibility, inherent security, and low operating costs make the framework a very attractive option for modernizing workflows and improving data and system protection.
Limitations and status of the project
The framework is currently at version 0.1.0 , meaning it's in its initial phase, although fully functional for experimentation and controlled deployments. Some advanced features, such as networking between containers in macOS 15, are not fully available except in macOS 26 and later.
Apple warns that API stability is only guaranteed between minor releases, so early adopters should review release notes and specify dependencies correctly to avoid issues in future updates.
Containerization in iOS mobile environments
Containerization is also reflected in the management and security of iOS devices, where administrators can use Mobile Device Management (MDM) systems to restrict communication between applications, access to certain services, the installation of configurations and certificates, as well as limit the installation of unauthorized apps and insecure connections. These policies, while different from traditional software containerization, aim to protect corporate information and prevent data leaks between apps and services within the Apple ecosystem.
The future of containerization according to Apple
Apple's move, with the opening of the framework and the promotion of its own tools, could mark a turning point in how secure applications are developed and deployed in the Mac ecosystem. The advantages in security, efficiency, and compatibility with open standards will put pressure on traditional players and encourage the emergence of new solutions and improvements in the sector.
Apple's Containerization is not just an alternative, but an evolution of the traditional model, designed to meet today's security and mobility needs, paving the way for more secure, efficient, and easily manageable development and production environments on Mac hardware.