WWDC 2025
At WWDC 2025, Apple introduced a new Containerization framework that brings native Linux container support to macOS. It’s designed for developers who want a clean, fast, and secure way to run containers without relying on Docker or other third-party tools.
This framework is written in Swift and uses Apple’s Virtualization.framework, which is optimized for Apple silicon chips. It gives each Linux container its own lightweight virtual machine, instead of running all containers inside a single large VM. This design improves security, resource management, and privacy for developers working on macOS.
What is Apple Containerization?
Containerization is an open-source Swift package. It lets applications run Linux containers on macOS without needing third-party tools like Docker.
The framework supports OCI-compliant images, so you can use images from standard registries or push images you create to those registries. Each container runs in its own lightweight VM, which helps keep containers isolated and startup times fast.
#Core Architecture and Design
Virtual Machine-Per-Container
- Security: Each container gets its own VM, which reduces the risk of one container affecting another. The minimal filesystem inside each VM contains no extra utilities or libraries, which further reduces the attack surface.
- Resource Allocation: Each container receives its own IP address. You do not need to configure port forwarding. CPU and memory are allocated per container, and resources are not used when containers are stopped.
- Privacy: File and directory sharing is set up per container. Only the container that requests access can see shared content.
The vminitd Init System
The first process inside each VM is vminitd, a lightweight init system written in Swift. It does the following:
- Assigns IP addresses to network interfaces
- Launches and supervises processes
- Manages APIs for communication between the host and the container using gRPC over vsock
vminitd is minimal by design. It does not include core utilities, dynamic libraries, or a standard C library, which keeps the system simple and secure.
#Technical Implementation Details
Swift-Based Architecture
The framework is written in Swift. It uses Swift’s Static Linux SDK to build static Linux binaries on macOS. For static linking, it uses musl. This approach helps keep the binaries small and secure.
Virtualization Framework Integration
Containerization uses Virtualization.framework, which is built for Apple silicon. This integration allows:
- Native performance on ARM64
- Efficient memory use
- Hardware-accelerated virtualization
- Smooth integration with macOS security features
Optimized Linux Kernel
The framework uses a custom Linux kernel that is configured for fast boot times and lightweight operation. Key points:
- Minimal kernel features for speed
- VIRTIO drivers built into the kernel
- EXT4 filesystem support for fast access
- Sub-second startup times
Rosetta 2 Integration
If you need to run x86_64 containers, Containerization uses Rosetta 2. This allows Intel-based Linux containers to run on Apple silicon without extra steps.
#Sample Usage and Implementation
Basic CLI Operations
Apple provides a command-line tool called container. Here are some common commands:
## Start the container system
container system start
## Pull an image
container image pull alpine:latest
## Run a container interactively
container run -t -i alpine:latest sh
## Run a container in detached mode
container run - name my-web-server - detach - rm web-test
## Execute a command in a running container
container exec my-web-server ls /content
## List running containers
container list - all
## Stop and clean up
container stop my-web-server
container system stop
Building Custom Images
You can build custom images using standard Dockerfile syntax:
FROM docker.io/python:alpine
WORKDIR /content
RUN apk add curl
RUN echo 'HelloHello, world!' > index.html
CMD ["python3", "-m", "http.server", "80", " - bind", "0.0.0.0"]
## Build the image
container build - tag web-test - file Dockerfile .
## Run the built image
container run - name my-web-server - detach - rm web-test
Swift API Integration
You can use the Containerization APIs in Swift projects:
import Containerization
let containerManager = ContainerManager()
try await containerManager.pullImage("alpine:latest")
let container = try await containerManager.createContainer(
image: "alpine:latest",
configuration: ContainerConfiguration()
)
try await container.start()
let result = try await container.execute(["echo", "Hello from Swift!"])
#System Requirements and Limitations
- Mac with Apple silicon (M1, M2, or later)
- macOS 15 minimum (macOS 26 beta recommended for full features)
- Xcode 26 beta for building from source
Note: On macOS 15, containers on the same network cannot communicate with each other. This is fixed in newer versions.
Apple’s Containerization framework gives iOS and macOS developers a clear, secure, and native way to work with Linux containers. The design is simple: each container gets its own VM, which improves isolation and security. The framework is open-source, uses Swift, and integrates well with Apple’s tools. The command-line tool and APIs are easy to use, making it a practical choice for developers who want to run Linux containers on a Mac.
#References :
- Containerization Repository
- API Documentation
- Open Container Initiative
- Apple Developer Documentation
Apple Containerization: Native Linux Container Support for iOS Developers was originally published in Atlys Engineering on Medium, where people are continuing the conversation by highlighting and responding to this story.