DL-330

Apple container (github.com/apple/container, Apache-2.0) is THE macOS embedded runtime (Matt, RIG-3246): a NEW AppleContainerCLI implementation of the frozen ContainerRuntime interface behind SelectBackend (a distinct non-podman CLI, NOT a PodmanCLI.WithProgram swap), with the per-session agent↔host gateway socket riding guest↔host vsock mirroring the microVM’s guestd forwarder (go/internal/guestd/gateway_proxy.go:29-33), the compass-runner staying host-side (darwin-native) driving apple-container over vsock (NOT a runner-in-VM — “that’s what we do for microVMs anyway too”), and postgres + the OTel collector moving onto apple-container too so macOS carries NO podman (“all would be on apple container, no podman”). podman-machine SUNSETS on macOS (interim substrate until the T-5 flip, not a permanent second arm) and Intel + macOS ≤ 15 are OUT OF SCOPE (“Apple has basically ended all support for Intel Macs”). The committed self-hosted Apple-silicon/macOS-26 host (mac mini on Woodpecker) runs the T-1 spike + T-3 live contract suite; hosted arm64 macOS runners cannot (nested-virt unsupported). CONDITIONAL only on the T-1 spike proving the ONE hardware unknown — whether Virtualization.framework’s vsock is reachable through the container CLI so the guestd-style forwarder ports onto it (plus uid round-trip + streaming-exec fidelity) — spike-now / build-later; a red vsock leg returns the transport question (not the direction) to Matt. EXTENDS the RIG-3070 runner trust-model split (DL-325; apple/container is the macOS-native per-agent VM boundary the split defers). RIG-3238

Status: Active (Matt, 2026-09-05)

Record: ../../platform/apple-container-macos-runner/design.md#approach