Apple Just Built WSL for the Mac (Container Machines)

ELI5/TLDR

Apple quietly shipped a way to run a real Linux computer inside your Mac, with one command. It’s their answer to a tool Windows has had for years. You can develop in your normal Mac files and then flip into Linux to test the exact thing you’ll deploy. It’s fast and clean, but a couple of rough edges mean it isn’t quite ready to dethrone the popular paid option, Orbstack.

The Full Story

What got announced

Buried under the Apple Intelligence noise at WWDC, Apple released Container Machines — a lightweight, persistent Linux environment that runs on your Mac. The video’s framing is that this is Apple’s version of WSL (Windows Subsystem for Linux), the long-standing Windows feature that lets developers run Linux without dual-booting or a clunky virtual machine.

“These give you a lightweight persistent Linux environment on your Mac in a really easy to use way.”

Two words there matter. Lightweight means it boots in seconds and doesn’t hog the machine. Persistent means it stays set up between sessions — you build your dev environment once and it’s waiting for you.

A quick word on the layer underneath

Container Machines sit on top of Apple’s container project from last year, a Docker alternative written in Swift. To understand why it’s interesting, you need one distinction.

A container is a way to package an app with everything it needs to run, isolated from the rest of the system. Docker is the famous tool for this. The standard image format is called OCI — think of it as a universal shipping box that any container tool can open.

Here’s Apple’s twist. Docker Desktop on a Mac runs one big Linux virtual machine and crams all your containers into it, sharing it. Apple instead gives every container its own tiny virtual machine.

“Every container got its own lightweight virtual machine through their virtualization framework rather than a bunch of containers sharing one big Linux VM.”

A virtual machine is a whole fake computer running inside your real one. Normally that’s heavy. Apple’s trick is making each one small and fast enough that you can afford one per container. The payoff is isolation (a break-in to one container can’t reach the others), privacy (each VM only sees the data you hand it, instead of everything being dumped into one shared box), and surprisingly, lower memory use than a full VM.

Using it

The flow is barely more than Docker. You write a Dockerfile, build it with Apple’s container tool (Mac OS 26 and up), then run container machine create, point it at the image, name it, mark it default. Seconds later it’s live — the demo machine got 7 CPUs and 18 GB of RAM, defaulting to half the Mac’s memory. Then container machine run drops you into a Linux shell.

The convenience feature is automatic sharing. Your Mac username and your entire home directory get mounted into Linux as read-write. So you edit a file with your normal Mac tools, then hop into Linux and run it immediately — no copying, no transferring.

“I don’t have to transfer files or anything thanks to the fact that it shares the same file system.”

Because each machine runs real systemd (Linux’s service manager), you can stand up a proper service stack — Postgres running as a real background service next to your app — and have it behave like the actual Linux server you’ll deploy to. You can also run several machines side by side: Alpine, Ubuntu, Debian, one per target.

Where it falls short

The benchmarks (from Repo Flow) are respectable — Apple containers lead on memory throughput and roughly match or beat Docker Desktop, though Orbstack still wins on file-system speed and tiny-container startup. The real catches are practical:

Memory is never given back. A machine grabs its share and holds it until you restart. Orbstack’s dynamic memory release is the standout feature Apple lacks here.
No GPU or USB pass-through yet (open issues exist).
GUI Linux apps are fiddly — not a seamless experience.
The convenient home-directory mount is a security trade-off. It’s read-write by default, so anything you run inside Linux can touch your SSH keys and cloud credentials. You can only make it read-only or off — not scope it to one folder.

The presenter’s verdict: he’ll stay on Orbstack as the more polished tool, but for anyone avoiding Orbstack’s paid commercial license, Apple containers beat Docker Desktop.

Key Takeaways

Container Machines are persistent, lightweight Linux VMs on macOS, spun up via Apple’s container CLI; requires Mac OS 26+.
They’re built on Apple’s container project (2024), a Swift-written Docker alternative that runs any standard OCI image (so Docker Hub images work).
Apple’s architectural difference vs Docker Desktop: one micro-VM per container instead of many containers sharing one big Linux VM. Benefits: stronger isolation, selective data mounting (privacy), less memory than a full VM.
An OCI image becomes bootable as a VM by including a system initialization program (init/systemd).
A machine defaults to half the Mac’s RAM; CPU and memory are configurable.
Home directory auto-mounts read-write into Linux — seamless file sharing, but it exposes SSH keys and credentials to anything running in the VM. Only options are read-only or disabled; no per-folder scoping.
The Linux machine also has its own separate volume for Linux-specific dotfiles, kept distinct from the mounted Mac home dir.
Real systemd support means you can test a genuine service stack (e.g. Postgres as a background service) that mirrors a deployment server.
Known gaps: memory is held until restart (no dynamic release), no GPU/USB pass-through, awkward GUI apps.
Hot-reloading and debugger breakpoints fail when editing from the macOS editor; fix is to have the editor connect into the machine over SSH.
Benchmark texture: Apple leads on memory throughput; Orbstack wins file-system and small-file performance and sub-quarter-second startup; Apple is level-or-better than Docker Desktop overall.

Claude’s Take

This is a clean, honest product walkthrough — exactly what you want from a “here’s the new thing” video. No hype inflation, the demo actually runs, and the catches section is the most valuable part because it tells you the unglamorous truth: memory hoarding, a security mount you can’t scope, and GPU/USB still missing.

The framing as “WSL for the Mac” is fair shorthand but slightly generous to Apple, since the per-VM-per-container design is genuinely its own idea, not a copy of Microsoft’s. The benchmark segment is the weakest bit — the presenter admits the charts are hard to read and waves at a link, so treat the numbers as directional, not gospel. The conclusion is the right one and refreshingly unsponsored-feeling: Orbstack stays the daily driver, but if you’re allergic to paying for it, Apple now beats Docker Desktop for free. That’s a real shift in the Mac dev-tooling landscape.

Score 7. Useful, accurate, well-paced, no fluff. Docked a few points because it’s a narrow tooling update with little depth beyond the demo, and the read-write home-mount security risk deserved more than a passing mention given how casually most people will leave it on.