wtf is vz-container?

vz-container lets you run Linux containers on a Mac with the same simple commands you might already know from Docker, like run, ps, and stop. Instead of running containers directly on macOS (which doesn't natively support Linux containers), it spins up a tiny, fast-starting virtual machine for each container. This gives you a secure, isolated Linux environment right on your Apple Silicon Mac. When you tell it to run a container, it boots a real Linux kernel inside a lightweight virtual machine using Apple's built-in virtualization tools. A small background program inside that VM receives your instructions, sets up the environment, and starts your application. The host Mac and the VM talk directly to each other over a secure, private channel, completely bypassing the traditional network stack. You can pull standard container images, map ports, mount folders from your Mac, and even open a shell inside a running container. This project is aimed at developers working on Apple Silicon Macs who want to run Linux workloads without leaving macOS. For example, if you are building a web app and need to test an NGINX server or a Redis database locally, you can start them instantly with familiar commands. It is also useful for teams that want stronger security, because every container runs inside its own virtual machine, a compromised container stays trapped within that isolated boundary. What makes this project notable is how it is built. It is written entirely in Go without relying on C-language bindings, which makes it easier to compile and distribute as a single standalone program. It also avoids needing external disk-formatting tools by building its own disk images from scratch. The project is still early and somewhat experimental, particularly around advanced networking modes, but its core features for running and managing containers are functional.