WWDC25: Meet Containerization | Apple

Apple Developer

Summary:

Containerization is an open-source Swift framework designed to create and run Linux containers natively on macOS, emphasizing security, privacy, and performance. It enables developers to package applications with their dependencies, ensuring consistent execution across environments and providing strong isolation from the host and other workloads. The framework handles image management, pulling configurations and filesystem contents from registries, and leveraging a Swift package to format these as EXT4 block devices. A key innovation is running each container within its own lightweight virtual machine, offering dedicated IP addresses, sub-second startup times, and granular resource allocation. For a secure and minimal container environment, a Swift-built vminitd init system is cross-compiled as a static Linux executable using Swift’s Static Linux SDK and musl, significantly reducing the attack surface. The container command-line tool demonstrates these capabilities, allowing users to effortlessly pull images and run isolated Linux shells on their Mac.

Introduction [00:00]

• This session introduces Containerization, a new open-source Swift framework for building containerized applications with a native feel on macOS.
• The framework's design and implementation of Linux containers prioritize security, privacy, and performance.
• The discussion covers:
  • What a container is and its common use cases.
  • APIs provided by the Containerization framework.
  • A command-line tool for building, running, and managing containers.

Goals for Linux Containers on macOS [03:03]

• Security: The aim is to provide each container with the same high level of isolation typically seen in large virtual machines.
  • This involves reducing the need for core utilities and dynamic libraries within the virtual machines, thereby reducing the attack surface and maintenance costs.
• Privacy: Access to directories and files should be limited on a per-container basis, ensuring only the requesting container has access to specific contents.
• Performance: Provide a performant experience while efficiently respecting and utilizing the user's system resources.

  

What is a container? [00:48]

• Linux containers have become a standard for how server-side applications are built, tested, and deployed, especially for scaling workloads across various environments.
• Container Use Cases:
  • Provide isolation from the host machine.
  • Provide isolation from other workloads, preventing interference.
  • Enable replication of deployment environments on local machines, facilitating local development and testing as if in production.
• How Containers Work:
  • Developers package their application along with all its dependencies (binaries, dynamic libraries, assets) into a single, deployable unit called a container.

    

  • This packaging allows containers to have different versions of dependencies compared to the host or other containers.
  • Runtime Isolation: Containers offer additional isolation at runtime:
    • Network: Typically have an isolated network stack from the host.
    • Process: Processes within one container cannot view or inspect processes on the host or other containers.
    • Runtime Environment: Resources like CPU, memory, and disk can be independently sized and scaled based on the workload’s needs.
• Running Linux Containers on macOS (Before Containerization) [02:30]
  • The historical solution for running Linux containers on macOS involved spawning a large, persistent Linux virtual machine to host all running containers.
  • Resources were allocated to this single large VM and then divided among the containers.
  • Sharing directories and files from macOS to a container required a two-step process: first sharing with the virtual machine, then to the specific container.

    

Containerization deep dive: Image management [03:50]

• Containerization is an open-source Swift framework offering APIs for image management, container execution, and a powerful init system built in Swift.
• Image Definition:
  • Most containers are created from an image, which is a distribution artifact.
  • An image contains filesystem contents and a default configuration, acting as a template for new containers.
• Image APIs:
  • Containerization provides APIs to fetch an image's filesystem contents and configuration from a Registry (a service for storing and distributing images).
  • This involves pulling the data to the local machine and writing it to the local filesystem.
• Container Creation from an Image [04:51]:
  • Once an image is local, its configuration serves as a starting point for a new container, specifying the default process, working directory, and user.

    

  • The image's filesystem contents include all necessary files and directories for the application.
  • For performant access, the filesystem is exposed as a block device (a large file formatted with a filesystem).
  • EXT4 Filesystem: Linux containers consume this block device when it's formatted with a Linux-understandable filesystem like EXT4.
  • Containerization includes a Swift package that allows direct formatting, directory structure creation, and population of an EXT4 filesystem from Swift.

Containerization deep dive: Virtualization [05:53]

• After a container is created from an image, a Linux virtual machine must be started to run it.
• Lightweight Virtual Machines:
  • Containerization achieves its security goals by running each container inside its own lightweight virtual machine.
  • This approach provides the same level of isolation as traditional large virtual machines but with sub-second start times.
  • Dedicated IP Addresses: Each container's dedicated IP address provides performant network access and eliminates the need for individual port mapping to access container services.
  • Privacy and Resources: When sharing directories, only the specific container requesting access receives the contents. Resources (CPU, memory) are only allocated when containers are running, respecting user resources.

    

Containerization deep dive: Container environment [06:53]

• Once a virtual machine is started for a container, the next steps occur within that VM.
• vminitd - The Init System:
  • An initial process is spawned whose binary is provided by a minimal filesystem that is part of Containerization.
  • This filesystem contains a binary called vminitd.
  • vminitd is an init system built entirely in Swift, running as the first process (PID 1) inside the virtual machine.
  • Responsibilities of vminitd:
    • Assigning IP addresses to network interfaces.
    • Mounting filesystems, including the image's contents exposed as a block device.
    • Launching and supervising all processes within the virtual machine.
    • Providing an API that allows processes to be spawned and managed from the host.

      

• Lightweight Virtual Machine Design [08:00]:
  • Historically, large virtual machines booted as a full system, including libc implementations, dynamic libraries, and core utilities (e.g., cd, cp, ls).

    

  • For enhanced security, the filesystem provided by Containerization for its lightweight VMs contains no core utilities, no dynamic libraries, and no libc implementation. This significantly reduces the attack surface.

    

  • To run vminitd in this constrained environment without linking to external libraries, it is compiled as a static executable.
  • This is achieved using Swift’s Static Linux SDK, which allows cross-compilation of static Linux binaries directly from a Mac.
  • The musl libc implementation is used due to its excellent support for static linking, enabling vminitd to execute in this isolated environment.

Command line tooling [09:19]

• A command-line tool, container, provides a simple and robust way to manage and run containers.
• Architecture: The container tool consists of a CLI (Command Line Interface) and XPC services, all built using the underlying Containerization APIs.
• Services Provided:
  • Storage management.
  • Image management.
  • Network services (allocating IP addresses to containers, handling DNS requests).
  • Management and runtime of containers.

    

• Demo of the container tool:
  • Pulling an Image: The command container image pull alpine:latest is used to pull the alpine:latest image.

    

    • This process fetches image contents and configuration locally, then creates the necessary block file.

      

  • Running a Container: The command container run -t -i alpine:latest sh is used to run an interactive shell within a container.
    • The tool creates a container from the image's filesystem and configuration.
    • It then uses Containerization APIs to start a lightweight virtual machine for the container.
    • The shell becomes interactive within a few hundred milliseconds, showcasing sub-second start times.
  • Inspecting the Environment:
    • Running uname -a inside the container confirms that it is a Linux environment.
    • Running ps aux demonstrates the isolation: only the shell and ps processes are visible, not other processes from the host or other containers.

      

Wrap-up [11:45]

• Containerization offers a secure, private, and performant experience for working with Linux containers on macOS.
• Developers are invited to join the project on GitHub to explore the Containerization framework and contribute to its development.
• Further steps for engagement include:
  • Exploring the Containerization framework on GitHub, including source code for lightweight virtual machines and cross-platform Swift packages for vminitd.
  • Trying out the container command-line tool for running containers.
  • Engaging with the community on GitHub by viewing source code, submitting issues, and creating pull requests.