containerization

What is an easy way to achieve this on a Mac? tl;dr: if I run claude/harness inside "code" at "~/<some path>/work/code", it would be great if the harness can't even see "code" is inside "work" (and even I can't make it know that by some quick "Yes(y)") I want something like: claude/opencode/pi/etc has no existence or capacity outside a file access boundary, say a given folder that (e.g.) lies here "~/<some path>/code". Even if I want, I can't run claude outside it, because it isn't installed outside it. Even if Claude wants it can't read/write/execute/install anything outside it. Basically I want the harness(es) and my code folder(s) sandboxed [0] inside just one folder and below it in folder hierarchy at least for file access limitations. Will this pose the challenge of using the system wide cli tools like ls, cd, git et cetera? If it ge

Reminds me of sandboxy - https://github.com/apple/containerization/tree/main/examples... Also if your thing doesn't work with `pi` out of the box, then low effort

everyone loving these linux sandboxes, even Apple wrote one https://github.com/apple/containerization/tree/main/examples...

Swift goes further down the stack than you might at first imagine -- there's a lot of Swift written at Apple even in places where you might expect C. The container CLI tool wraps the underlying Containerization framework, which in turn vends packages for things like EXT4 file system support -- all written in Swift. Here's one example as a jumping off point. https://github.com/apple/containerization/blob/main/Sources/...

They barely just released Containerization Framework[0] and the new container[1] tool, and they are already scheduling a kneecapping of this two years down the line. Realistically, people are still going to be deploying on x64 platforms for a long time, and given that Apple's whole shtick was to serve "professionals", it's really a shame that they're dropping the ball on developers like this. Their new containerization stuff was the best workflow improvement for me in quite a while. [0] https://github.com/apple/containerization [1] https://github.com/apple/container

It's a hoop to jump through, but I'd recommend checking out Apple's container/containerization services which help accomplish just that. https://github.com/apple/containerization/

The most notable change is probably the new native container runtime: https://github.com/apple/containerization Metal 4 is interesting: https://developer.apple.com/metal/whats-new/ New enterprise-y stuff: https://support.apple.com/en-us/124963 FireWire support is gone, and this is the last macOS release for Intel.

> Maybe the new "containers" stuff in macOS 26 is going to be a good replacement for that? It is not. The Containerization framework [1] is, in its own words, "a Swift package for running Linux containers on macOS" - it's more or less an Apple-branded Docker runtime. It's not applicable to macOS software. [1]: https://github.com/apple/containerization

If you search the code, they support Rosetta, which means an ARM Linux kernel running x86 container userspace with Rosetta translation. Linux kernel can be told to use a helper to translate code using non-native architecture. Actually, they explain it in detail here: https://github.com/apple/containerization/issues/70#issuecom... It's unclear whether this will keep being supported in macOS 28+, though: https://github.com/apple/container/issues/76, https://www.reddit.com/r/macgaming/comments/1l7maqp/comment/...

Hard same. I wonder if this does anything different to the existing projects that would mean one could use the WSL2 approach where containerd is running in the Linux micro-VM. A key component is the RPC framework - seems to be how orbstack's `macctl` command does it. I see mention of GRPC, sandboxes and containers in the binfmt_misc handling code, which is promising: https://github.com/apple/containerization/blob/d1a8fae1aff6f...

The submission is about https://github.com/apple/containerization, not https://github.com/apple/container. The former is for apps to ship with container sidecars (and cooler news IMO); the latter is 'I am a developer and I want to `docker run ...`'. (Oh, and container has a submission here: https://news.ycombinator.com/item?id=44229239)

They include the kernel config here[0] > Containers achieve sub-second start times using an optimized Linux kernel configuration[0] and a minimal root filesystem with a lightweight init system. [0]: https://github.com/apple/containerization/blob/main/kernel/c...

The video on Containerization.framework, and the Container tool, is live [0]. It looks like each container will run in its own VM, that will boot into a custom, lightweight init called vminitd that is written in Swift. No information on what Linux kernel they're using, or whether these VMs are going to be ARM only or also Intel, but I haven't really dug in yet [1]. [0] https://developer.apple.com/videos/play/wwdc2025/346 [1] https://github.com/apple/containerization

:-) It isn't systemd: > Containers achieve sub-second start times using an optimized Linux kernel config, minroot filesystem, and a lightweight init system, vminitd https://github.com/apple/containerization/blob/main/vminitd

The framework that container uses is built in Swift and also open sourced today, along with the CLI tool itself: https://github.com/apple/containerization