Ah, I see what you’re saying. Basically, Darwin doesn’t support cgroups, so Docker runs Linux in a VM to get that.
I don't think it supports userland namespaces either, which is another important part of container isolation.
It has partial namespaces support for the iOS simulator.
surprisingly, Windows containers on Windows are not run in a VM. Well, not necessarily; they can be.
It is definitely odd that Macs have no native container support, though, especially when you learn that Windows does.
Well, Windows (in a form) is the hypervisor for the Azure infrastructure. Azure Web Sites when run as Windows/IIS are Windows containers. Makes sense.
Honestly I don't know what XNU/Darwin is good for. It doesn't do anything especially well compared to *BSD, Linux, and NT.
Its async i/o APIs are best in class (i.e., compatible with BSD, and not Linux’s epoll tire fire).
Not disagreeing though.
Linux has io_uring. NT outclasses XNU by a long shot with IOCP, Registered I/O, and IO Ring (io_uring copy).
That is an important point, I didn't really think of it since I've never had a reason to use Windows containers.
The same way Windows users run them. In a linux VM.
You don't get real on-hardware containerization.