# How Apple Container Integrates with macOS Frameworks to Run Linux Containers

> Discover how Apple Container uses macOS frameworks like Virtualization and GCD to run Linux containers as lightweight VMs on Apple silicon and Intel Macs.

- Repository: [Apple/container](https://github.com/apple/container)
- Tags: internals
- Published: 2026-06-28

---

**Apple Container leverages first-party macOS frameworks—including Virtualization, Network, Grand Central Dispatch (Dispatch), Foundation, Security, and SystemPackage—to run Linux containers as lightweight virtual machines on Apple silicon and Intel Macs.**

Apple Container is a Swift-based command-line tool developed by Apple that enables users to run Linux containers natively on macOS. Unlike traditional container runtimes that rely on external virtualization layers, Apple Container integrates deeply with the operating system’s native frameworks to create and manage lightweight virtual machines. This architecture allows the tool to spin up VMs, manage network interfaces, and handle security entitlements using Apple's own system APIs rather than third-party dependencies.

## Core macOS Frameworks Used by Apple Container

The `apple/container` repository imports several system frameworks to handle VM lifecycle, networking, concurrency, and security. These integrations are visible throughout the source files, from low-level system calls to high-level VM configuration.

### Virtualization Framework for VM Management

The **Virtualization** framework serves as the backbone for creating macOS-based virtual machines. The codebase utilizes `VZVirtualMachine` and `VZVirtualMachineConfiguration` to configure, instantiate, and launch the lightweight VMs that host Linux containers. This integration is central to the runtime service implementation, where the VM is started and managed.

In [`Sources/Services/RuntimeLinux/Server/RuntimeService.swift`](https://github.com/apple/container/blob/main/Sources/Services/RuntimeLinux/Server/RuntimeService.swift), the code interacts with these APIs to establish the execution environment:

```swift
import Virtualization
let config = VZVirtualMachineConfiguration()
// … configure VM …
let vm = VZVirtualMachine(configuration: config)
try vm.start()

```

### Network Framework for Socket-Level Networking

The **Network** framework provides modern socket-level APIs used by the container-networking layer to implement port forwarding, DNS services, and virtual network interfaces. The [`NetworkClient.swift`](https://github.com/apple/container/blob/main/NetworkClient.swift) file imports this framework to manage TCP listeners and client connections without relying on lower-level BSD sockets.

This is implemented in [`Sources/Services/Network/Client/NetworkClient.swift`](https://github.com/apple/container/blob/main/Sources/Services/Network/Client/NetworkClient.swift):

```swift
import Network
let listener = try NWListener(using: .tcp, on: port)

```

### Dispatch for Concurrent Operations

**Grand Central Dispatch (Dispatch)** supplies the low-level concurrency primitives for asynchronous work. The [`ContainerLogs.swift`](https://github.com/apple/container/blob/main/ContainerLogs.swift) file uses `DispatchQueue` to handle background processing of container logs, ensuring that log streaming operations do not block the main thread or command-line interface.

As seen in [`Sources/ContainerCommands/Container/ContainerLogs.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Container/ContainerLogs.swift):

```swift
import Dispatch
let queue = DispatchQueue.global(qos: .utility)
queue.async {
    containerLogs.follow()
}

```

### Foundation, SystemPackage, and Security

**Foundation** provides the core data types, JSON handling via `JSONDecoder`, file-system utilities, and URL manipulation used across virtually every source file. For example, [`Sources/TerminalProgress/ProgressBar.swift`](https://github.com/apple/container/blob/main/Sources/TerminalProgress/ProgressBar.swift) imports `Foundation` for terminal UI utilities, while [`Sources/Services/RuntimeLinux/Client/LinuxRuntimeData.swift`](https://github.com/apple/container/blob/main/Sources/Services/RuntimeLinux/Client/LinuxRuntimeData.swift) uses it for data serialization.

**SystemPackage** (Swift System) wraps POSIX-style system calls such as `open`, `stat`, and `mmap`. This is used throughout the low-level runtime code for direct file and process manipulation, as evidenced in [`LinuxRuntimeData.swift`](https://github.com/apple/container/blob/main/LinuxRuntimeData.swift).

Finally, the **Security** framework handles entitlement signing and other security-related tasks required for running privileged VM workloads. This is configured in the `signing/container-runtime-linux.entitlements` file.

The Foundation integration appears in files like [`ProgressBar.swift`](https://github.com/apple/container/blob/main/ProgressBar.swift):

```swift
import Foundation
let data = try Data(contentsOf: fileURL)
let config = try JSONDecoder().decode(RuntimeConfiguration.self, from: data)

```

## Key Source Files Demonstrating Framework Integration

The following files in the `apple/container` repository demonstrate direct integration with these macOS frameworks:

- **[`ProgressBar.swift`](https://github.com/apple/container/blob/main/ProgressBar.swift)** ([`Sources/TerminalProgress/ProgressBar.swift`](https://github.com/apple/container/blob/main/Sources/TerminalProgress/ProgressBar.swift)): Imports `Foundation` for core data types and terminal progress rendering.
- **[`ContainerLogs.swift`](https://github.com/apple/container/blob/main/ContainerLogs.swift)** ([`Sources/ContainerCommands/Container/ContainerLogs.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Container/ContainerLogs.swift)): Imports `Dispatch` for asynchronous log streaming on background queues.
- **[`NetworkClient.swift`](https://github.com/apple/container/blob/main/NetworkClient.swift)** ([`Sources/Services/Network/Client/NetworkClient.swift`](https://github.com/apple/container/blob/main/Sources/Services/Network/Client/NetworkClient.swift)): Imports `Network` and `Foundation` to implement TCP listeners and port forwarding.
- **[`LinuxRuntimeData.swift`](https://github.com/apple/container/blob/main/LinuxRuntimeData.swift)** ([`Sources/Services/RuntimeLinux/Client/LinuxRuntimeData.swift`](https://github.com/apple/container/blob/main/Sources/Services/RuntimeLinux/Client/LinuxRuntimeData.swift)): Imports `Foundation` and `SystemPackage` for runtime data management and POSIX system calls.
- **[`RuntimeService.swift`](https://github.com/apple/container/blob/main/RuntimeService.swift)** ([`Sources/Services/RuntimeLinux/Server/RuntimeService.swift`](https://github.com/apple/container/blob/main/Sources/Services/RuntimeLinux/Server/RuntimeService.swift)): Uses `Foundation` and interfaces with the **Virtualization** framework to manage VM lifecycle.
- **`container-runtime-linux.entitlements`** (`signing/container-runtime-linux.entitlements`): Defines security entitlements required by the **Security** framework for privileged VM operations.

## Summary

Apple Container achieves native Linux container support on macOS through deep integration with first-party system frameworks:

- **Virtualization** framework provides the `VZVirtualMachine` API to create and manage lightweight Linux VMs.
- **Network** framework and **Dispatch** (GCD) handle socket-level networking, port forwarding, and asynchronous concurrency for container operations.
- **Foundation** and **SystemPackage** supply essential data handling, JSON parsing, file I/O, and POSIX system call wrappers.
- **Security** framework integration ensures proper entitlement signing for privileged VM workloads.

## Frequently Asked Questions

### Which macOS frameworks does Apple Container use to run Linux containers?

Apple Container primarily uses the **Virtualization** framework to create and manage VMs, the **Network** framework for socket-level connectivity, **Dispatch** for concurrency, and **Foundation** for data operations. It also leverages the **Security** framework for entitlements and **SystemPackage** for low-level system calls.

### How does Apple Container handle networking without relying on Docker Desktop?

According to the source code in [`Sources/Services/Network/Client/NetworkClient.swift`](https://github.com/apple/container/blob/main/Sources/Services/Network/Client/NetworkClient.swift), Apple Container uses the native **Network** framework (`NWListener`) to implement TCP listeners, port forwarding, and DNS services directly. This eliminates the need for third-party networking layers or VPN-style tunneling solutions.

### What file handles the asynchronous logging of container output?

The [`ContainerLogs.swift`](https://github.com/apple/container/blob/main/ContainerLogs.swift) file located at [`Sources/ContainerCommands/Container/ContainerLogs.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Container/ContainerLogs.swift) imports **Dispatch** to utilize `DispatchQueue.global(qos: .utility)` for background log processing, ensuring that log streaming does not block the main thread.

### Is Apple Container's use of the Virtualization framework visible in the source code?

Yes, the integration is evident in files like [`Sources/Services/RuntimeLinux/Server/RuntimeService.swift`](https://github.com/apple/container/blob/main/Sources/Services/RuntimeLinux/Server/RuntimeService.swift), which configures `VZVirtualMachine` and `VZVirtualMachineConfiguration` objects to manage the VM lifecycle, and throughout the runtime services where VMs are started and stopped.