Hacker News

Sandbox and separate user instead of VM but sandvault is good for this and does auto install (full disclosure: have made some PRs to it).

https://github.com/webcoyote/sandvault

> Free idea: I would like to be able to "jail" an agent inside a VM and send instructions to the harness from outside the VM to agent(s) installed inside. Ideally there is no Codex/Claude/etc. installed on the host.

You can do exactly that with coderunner

https://GitHub.com/instavm/coderunner

> My current power move in the age of AI: do nothing.

This was also my strategy before AI. At some point in my late 20s or early 30s I all but completely stopped doing any development in my free time, because I was entirely over any fun I derived from coding per se (in truth, I'd never been that into it, I'd just been really bad at guessing what would or would not be worth spending time on) and, as they say, the "juice wasn't worth the squeeze" for almost anything that popped into my head that might be a nice program or script to have (like that xkcd chart about the payoff time for developing programs that save X minutes per week or whatever) or else it was something that wasn't necessary but might just be interesting or fun to have, but nowhere near worth the many hours it'd take to make it happen. If someone made what I wanted and released it, awesome! If not, oh well.

The big change with LLMs is now I can shit out little scripts and such in a few minutes and for pennies, maybe a couple dollars. I'm dragging old extremely-niche ideas out of mothballs because what would have been several weekends of work (most of these ideas would require lots of poking around unfamiliar APIs and documentation, not just immediately writing the thing I want) can now be done in a half-hour or less—or, at least, I can find out if something's going to be unworkable or too fiddly to screw with after all and should be completely and permanently abandoned, in minutes rather than hours.

I threw something like this together w a simple browser front end, mostly because I like running mid to large open models but can’t trust them to not go insane. Will share at some point soon

> Free idea: ...

I have been thinking about this too. Is it not as simple as installing Claude in the VM and connecting via an SSH terminal, or if you want a GUI use VSCode with the Remote SSH extension, which will give you the file browser UI etc. Presumably you can extensions in the VSCode Claude/whatever chat extensions in the VM too.

Would you say these are all of equivalent, top notch, quality? I can't say I know that for certain.

Used to be you could use website polish and a few other surface level things to gauge the amount of effort that went into these types of things. Now that is easily finished LLMs. In a similar way, one of the biggest impacts of kick-starter now that the smoke has cleared is the aggressive evolution and refinement of the 3 minute pitch video.

Whether that actually translates into well thought through implementations and road-maps, and real momentum, I can't say.

Not on iOS unless you also pay annual membership to put it on the AppStore OR rebuild & reinstall the personal-account build every 30 or so days.

The AI-Maxing copy on the website kind of gave it away. Doesn't mean is not a great app though!

Great suggestion. Coming up.

A tutorial with a slightly more realistic example would help a lot here. nginx:latest shows the plumbing works, but it doesn’t really show where Apple Containers feels different from Docker Desktop or OrbStack.

Something like a tiny app with a volume, port mapping, and a simple rebuild loop would make the value much easier to see.

Oh hi there - I just noticed you have a comparison to Orchard - that's me. Look slick we're all building the same thing ><

It appears macOS native containers runs a separate Linux VM per container.

OrbStack's claim to fame is that all containers run in a single Linux VM, with lots of optimizations on both sides of the VM boundary (including use of a sparse image file for disk storage, which saves a lot of space on the macOS side).

If you run more than 4-5 containers on macOS, the performance and resource usage savings of OrbStack really starts to add up quickly.

I’m guessing the OrbStack team will probably support MacOS native containers soon enough, with all their management goodness on top.

This is focused on builds, so running either buildkitd or dockerd in an Apple containerization container. No port forwarding or host volume stuff (really its focused on running buildkit on mac) BUT complete integration with docker CLI and buildx.

https://github.com/cpuguy83/crucible

Yeah. I don't quite understand this. Can I use this instead of docker desktop, to run docker containers on my mac 'natively' ? Or this is completely separate from docker ?

Good catch, that was a bug; the value fields were trailing-aligned which makes SwiftUI insert like RTL. Fixed in 0.1.9.

Yeah it’s an unfortunate SwiftUI thing

Added this in the latest release.

Great suggestion! I'll add this!

Doable and done; added in 0.1.9. Settings -> General lets you pick Terminal/iTerm2/Ghostty/WezTerm/kitty/Alacritty/Warp (whatever's installed).

It claims to be backed by (and require) apple/containers(1) which "consumes and produces OCI-compatible container images" so if all that is true .... yes!

1) https://github.com/apple/container

Why would someone downvote this perfectly relevant question?

Pathetic.

and https://github.com/andrew-waters/orchard but without vibe coding

Hmm… how does one even pick between multiple vibe coded options?

I like to vet my options before committing to new software but who knows if the authors are gonna support these in a month? I don’t want to waste Fable tokens to fix bugs myself when they crop up.

A lot of Mac apps compress like this. Not so long ago, it was pretty common to download a 3-400mb dmg file that decompresses to a 1.5gb app package, for example.

With nothing running, the platform's background services idle at roughly 25 MB. Docker desktop starts a single VM to host all containers and will reserve memory to do so. Davit itself is about 25mb and then each container will use the memory up to what you allocate for it.

Shipped in 0.1.8; Images -> Build Image (context dir, tag, build args). It drives Apple's buildkit shim directly over vsock, no docker needed. brew upgrade davit or the in-app updater will get it.

Working on this..

Can you not use Avahi in the guest and get zeroconf?

Oh! Do you mean the issue is adding extra name resolution to a VM?

Have you tried this avahi alias trick?

https://gist.github.com/tomslominski/9d507acd4036952d65b2364...

Works like a charm, bit odd that you have a persistent avahi client process broadcasting per alias, but it's lightweight.

It does, doesn't it?

I can’t speak about orbstack, but I’ve worked with docker desktop and podman desktop for years on macOS. Those programs start up a virtual machine that consistently eats ram regardless of whether or not you are running containers in it. Apple container looks lighter weight. In the age of ridiculous ram costs, you gotta save resources.

OrbStack has its own virtualization layer designed to simulate Docker. Containerization has different primitives even though it supports the same OCI images

complaining about 17mb in 2026 has to be virtue signaling of some sort...

yes I know we went to the moon with a few kb but are we going to hang on to that for ever?