Apple has published documentation for the "container machine" abstraction at the heart of its open-source macOS container tool — the thin Linux VM that sits under every container you run.
The container project, open-sourced by Apple for macOS, uses what it calls a container machine as its execution layer: a lightweight virtual machine powered by Apple's Virtualization framework. Unlike the shared-kernel model Docker uses natively on Linux — where containers share a host kernel and are separated only by namespaces and cgroups — each macOS container gets its own VM. The documentation covers how these machines are created, configured, and torn down as part of the container lifecycle.
The architecture is a direct answer to a basic constraint: macOS has no Linux kernel to share, so any Linux container runtime on Apple hardware has to bring its own. Apple's choice to give each container a dedicated VM rather than pooling them into one shared Linux host raises the per-container resource cost but raises the isolation floor too. On Apple Silicon, where the Virtualization framework starts VMs quickly and with comparatively low overhead, that tradeoff is less punishing than it would have been on Intel Macs.
Docker Desktop has shipped a single shared Linux VM for years; Podman Desktop takes the same route. One VM per container is a cleaner design and a natural pitch to security-conscious teams — though developers running dozens of containers simultaneously may find the memory math adds up fast.