Apple Container 1.0: Independent VM Architecture Delivers Sub‑second Startup and 30% Lower Memory

Problem with existing macOS container solutions

Docker Desktop runs all containers inside a single large LinuxKit VM. The VM stays resident, consumes several gigabytes of memory when idle, generates fan noise, and requires a paid license for commercial use. File‑system sharing is slow and container crashes can affect all workloads.

Third‑party tools such as OrbStack or Colima improve VM performance but rely on QEMU and cannot fully integrate with macOS virtualization, vmnet, Keychain, or Xcode debugging. Full‑featured VM products (VMware, Parallels) are heavyweight and unsuitable for frequent short‑lived container tasks.

Apple Container 1.0 Overview

Apple released Apple Container 1.0.0 (open‑source on GitHub) for Apple Silicon Macs running macOS 26. It implements a “single‑container independent lightweight VM” model and provides a persistent Linux workspace called Container Machine , analogous to Windows WSL. The tool is free, fully OCI‑compatible, and has no commercial usage restrictions.

Core Technology Stack

Implementation language: Swift , directly invoking macOS Virtualization and vmnet frameworks.

Supported hardware: Apple Silicon M1/M2/M3 (no Intel support).

System requirement: macOS 26 or later.

Image handling: 100 % OCI‑compliant; images from Docker Hub, Alibaba Cloud, GHCR can be pulled, built, and pushed without conversion.

Underlying library: open‑source Swift package Containerization (Apache‑2.0), providing container, image, and process management.

Architecture Comparison

Docker Desktop : one shared VM hosts all containers; isolation is limited to process namespaces; the VM remains resident, so idle memory is not released.

Apple Container : each container runs in its own micro VM with a dedicated kernel and network stack; isolation is at the hardware VM level; VM resources are reclaimed immediately when the container stops, yielding near‑zero idle usage.

Performance Claims (official measurements)

Container startup time: sub‑second ("亚秒级").

Idle memory consumption: ~30 % lower than Docker Desktop (Docker Desktop typically holds >2 GB idle).

Idle CPU usage: <0.1 %.

Container Machine (persistent Linux environment)

A Container Machine is a named Linux VM that retains its filesystem, installed packages, and configuration across stops and starts.

Create and set default:

container machine create --name dev --set-default ubuntu:22.04

List machines: container machine list Enter interactive shell (auto‑shares $HOME): container machine run Run a single command without entering: container machine run uname -a Stop/start: container machine stop dev and container machine start dev Delete: container machine delete dev SSH forwarding (reuses host SSH keys):

container machine run --ssh

Installation Steps

Download the signed .pkg from the GitHub releases page: https://github.com/apple/container/releases

Double‑click the package, enter the administrator password, and install to /usr/local/bin.

Start the background service: container system start On first launch the tool automatically downloads the Linux kernel image.

Docker‑compatible Command Set

# Show help</code><code>container --help</code><code># Run a temporary Alpine container (equivalent to <em>docker run --rm</em>)</code><code>container run -it --rm alpine:latest sh</code><code># Build an image (Dockerfile works unchanged)</code><code>container build --tag my-web:1.0 -f Dockerfile .</code><code># Push image to OCI registry</code><code>container image push registry.example.com/my-web:1.0</code><code># List running containers (ls = list, rm = delete)</code><code>container ls</code><code># Cross‑architecture build (arm64 + amd64)</code><code>container build --arch arm64 --arch amd64 --tag multi-arch-app .</code><code># Copy files between host and container (new in 1.0)</code><code>container cp local-file.txt my-container:/target/path

Practical Features

Local DNS suffix .test resolves to containers.

Port forwarding syntax -p matches Docker and supports IPv4/IPv6.

Configuration expressed in TOML files (replaces legacy flags).

JSON/YAML structured output for CI integration.

Known Pitfalls & Work‑arounds

Only Apple Silicon is supported; Intel Macs cannot run the tool.

Requires macOS 26; older versions fail to start the service.

No native Docker Compose; multi‑service orchestration must be scripted.

Memory release may be delayed when many containers start rapidly; use --memory to limit each VM.

Deleting a Container Machine does not automatically clean OCI image cache; run container image rm manually.

First execution of x86 images incurs Rosetta 2 translation overhead.

User‑identity synchronization mitigates permission errors inside the VM.

Network debugging is available via container machine inspect.

Selection Guidance

Apple Container is suited for developers who:

Own an M‑series Mac and run macOS 26.

Perform frequent Linux builds, need a lightweight, isolated environment, and prefer a free, officially maintained tool.

Require strong VM‑level isolation for parallel projects.

Retain Docker Desktop when:

Using Intel Macs or macOS versions older than 26.

Heavy reliance on Docker Compose, Swarm, Kubernetes GUIs, or third‑party Docker plugins.

Cross‑platform consistency across Windows, Linux, and macOS is required.

A hybrid workflow is possible: use Apple Container for everyday lightweight containers and persistent Linux workspaces, and keep Docker for complex multi‑service micro‑service projects; images are interchangeable.

https://github.com/apple/container