Apple Just Built WSL for the Mac (Container Machines)

하이라이트

• Apple introduced Container Machines as a lightweight, persistent Linux environment optimized for Apple Silicon on macOS 26 and above.

• Container Machines build upon Apple's container project, which utilizes the virtualization framework to assign a full virtual machine to every individual container.

• Default memory allocation for a Container Machine is 50% of the host Mac's total RAM, which remains held by the VM until the machine is restarted.

• The environment automatically mounts the macOS home directory as read-write, enabling seamless file access between the host and the Linux guest.

• Benchmarking indicates Apple Containers achieve higher single-threaded CPU event performance than Docker Desktop, though they currently show slower startup times compared to OrbStack and Docker Desktop.

• Security limitations include a lack of ability to mount specific subfolders, meaning the entire home directory is accessible to the Linux environment by default.

타임라인

1. 00:00 - 00:29

   Introduction to Container Machines

   Container Machines offer a persistent Linux environment on macOS. These machines integrate with Apple's existing container project, which was designed to run OCI-compatible images on Apple Silicon.

   • Apple released Container Machines as a Linux environment for macOS.
   • The project is built upon Apple's container tool, a Docker alternative optimized for Apple Silicon.
2. 00:29 - 04:30

   Setup and Workflow

   The setup process mimics Docker workflows, using OCI images built with Apple's tools. Upon creation, the VM provides an interactive terminal with direct access to host files. Development workflows benefit from the ability to run Linux-specific tools, though some features like hot reloading may require connecting an editor via SSH to function properly.

   • Setting up a machine requires an OCI-compatible image containing a system initialization program.
   • Users can define CPU and memory allocation, with the default setting using half of the total system memory.
   • The environment supports automatic mounting of the macOS home directory, simplifying file access for development tasks.
   • Running multiple machines side-by-side enables testing across different Linux distributions.
3. 04:30 - 06:27

   Technical Architecture and Performance

   Unlike Docker Desktop, which shares one large Linux VM across all containers, Apple's approach assigns a specific virtual machine to each container via their virtualization framework. This isolation improves security and memory efficiency. Comparative tests reveal that while Apple Containers hold an edge in throughput, startup times are currently slower than established alternatives like OrbStack.

   • Every container runs within its own lightweight virtual machine to improve isolation.
   • Architecture prioritizes security and selective data mounting over the shared VM approach used by Docker Desktop.
   • Performance benchmarks show Apple Containers leading in memory throughput and single-threaded CPU events.
4. 06:27 - 07:54

   Limitations and Considerations

   While functional, Container Machines have drawbacks in resource flexibility and security configuration. The inability to release unused memory back to the macOS host and the default broad filesystem access require careful management. Users seeking more refined resource control often prefer alternatives like OrbStack, which supports dynamic memory.

   • Memory allocated to the VM is not dynamically returned to the host OS until the machine is restarted.
   • Current limitations include the absence of GPU and USB pass-through support.
   • Read-write access to the entire home directory presents a security trade-off for users.
   • OrbStack remains a more polished alternative due to dynamic memory management and additional features.