Apple Container: Open-source tool for Linux containers on the Mac

Developers on Apple silicon Macs have run Linux containers through software built around a single shared virtual machine for years. Apple’s open-source Container project gives each Linux workload its own lightweight virtual machine.

Container is written in Swift and tuned for Apple silicon. It creates and runs Linux containers as lightweight virtual machines, and it works with OCI-compatible images, so a developer can pull from and push to any standard registry. Images built with it run in any other OCI-compatible application. Under the hood, it draws on the Containerization Swift package for low-level container, image, and process management.

The headline addition in 1.0.0 is container machine, a feature for long-lived Linux environments with tight integration into the host Mac. Earlier releases centered on containers spun up for a task and torn down after. The new command supports persistent environments that a developer keeps across sessions.

Configuration moved to a TOML file. Version 1.0.0 replaces the older system settings, which were backed by user properties, with a config.toml file, and it removes the container system property get and set subcommands. This is a breaking change to the command line, so scripts that called those subcommands need updating.

Several other changes landed in the same release. A new container cp command moves files between the host and a running container, answering a request that had stayed open since the early days of the project. The team fixed accounting errors in system df, the command that reports disk usage. On the networking side, a change ties each IP address lease to its XPC connection, which resolves a bug where addresses leaked over time. The release also adds a --stop-signal option to container run and tidies the help output for subcommands. Output for the ls and inspect commands across containers, images, networks, and volumes now follows a consistent structure in JSON, YAML, and TOML.

The release drops compatibility with the version 0 XPC application interface. A later version will add versioning to the API itself, so clients and the server can check compatibility with each other. Both the configuration change and the API removal are breaking changes, which sets a firmer baseline for the work that follows.

Running container calls for a Mac with Apple silicon and macOS 26. The project depends on virtualization and networking features introduced in that release, and issues that cannot be reproduced on macOS 26 typically go unaddressed. Installation uses a signed package from the GitHub releases page, after which a developer starts the background service with container system start. An update script installed with the tool handles moves to newer or older builds.

Interest in the project has grown since its debut. The repository has collected more than 46,500 stars, and the community has forked nearly 1,500 times.

Apple Container is available for free on GitHub.

Must read:

• 25 open-source cybersecurity tools that don’t care about your budget
• GitHub CISO on security strategy and collaborating with the open-source community

Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!