One Shared VM Makes Mac Containers Boring Again
Possible Mac-native substrate for joelclaw agent sandboxes: Docker-compatible today, k3s/local HTTPS/machines tomorrow, without swapping the whole rig yet.
Dory is a macOS container runner trying to be the boring middle path between Docker Desktop, OrbStack, and Apple’s containerization stack. The interesting move isn’t the dashboard. It’s the one persistent shared Linux VM behind a Docker Engine API socket at ~/.dory/dory.sock, plus a registered Docker context. Existing docker and Docker Compose scripts can point at it without learning a new runtime.
The Dory README claims the shared VM backend uses ~4.7× less idle memory than per-container VMs in its benchmark methodology. That’s the clever wedge: keep Mac-native SwiftUI UX and local *.dory.local domains plus HTTPS, but don’t pay a new VM tax for every container. It also bundles k3s, Kubernetes, and Linux machines with snapshots, which puts it closer to a local infra appliance than a cute menu-bar wrapper.
For joelclaw, this is an eval candidate, not a replacement. The useful question is whether Dory can become a low-idle substrate for local agent sandboxes while staying compatible with boring Docker workflows. The risks are visible too: the standalone shared backend wants macOS 26 on Apple silicon, the project is young, and GPL-3.0 matters if anything gets embedded instead of merely operated.
Key Ideas
- Dory exposes a Docker Engine API socket at
~/.dory/dory.sockand registers a Docker context, so existingdockerand Docker Compose commands are the compatibility surface. - The
sharedbackend runs one persistent Linux VM for all containers; theapplebackend follows Apple containerization’s per-container micro-VM model; thedockerbackend proxies Colima, OrbStack, Docker Desktop, Rancher Desktop, or Podman. - The local-dev bundle includes k3s, Kubernetes, automatic
*.dory.localdomains and local HTTPS, plus Linux machines with snapshots. - The agent angle is future-facing: Dory’s roadmap names sandboxed environments for AI agents, which maps to local workload isolation without forcing a cloud runtime first.
- Treat GPL-3.0 and the compatibility matrix as gates before putting Dory in a public or product path.