We Rebuilt the Linux MicroVM Stack on Apple Silicon

A suggestion to the author -- don't outsource your writing to AI, or, if you do, go over it with a fine-tooth comb and remove every trace of Claudisms from it.

I read the subtitle: "What it takes to boot the same microVMs on Apple's hypervisor, and the one capability Apple will not let you have." and immediately navigated away.

What an awful blog renderer that, in Firefox, works when scrolling with the trackpad, but doesn't work when using keyboard arrow keys or pageUp/down: I get blank pages when scrolling with the keyboard beyond the initial viewport.

VZ.framework is very limited, Hypervisor.framework is the better analogue to KVM

By experience, getting Firecracker to run well on M-series macs is quite the undertaking. I'm not at all surprised Encore decided to take this path considering their customer base!

At Lovable we decided to spend ~1 engineering month getting our sandbox infrastructure to be 100% runnable on Mac and on Linux with predictable builds using Bazel etc.

But we actively decided to take a different route than Encore and run nested virtualization, which on macOS means vfkit -> QEMU -> Kind + Firecracker vm(s). It's been invaluable to get the same development and testing tools on both platforms tbh.

> most engineers at Encore develop on a Mac

They are solving the wrong problem.

Rebuilding MicroVMs natively on Apple Silicon usually cuts virtualization overhead massively, but Hypervisor.framework DX and virtio device parity are the real bottlenecks.

Hey everyone - author of the article here! Happy to take questions.

Very hard to read

nice

Four years on a shared remote machine before building the local backend is a good lesson in when to invest in dev tooling versus living with the workaround.

I think Encore is great and do really cool things, but this post is AI;DR from the first sentence.

I just encountered the `com.apple.private.virtualization` entitlement limitation just last night, wanting to use VZVirtualMachine private AccessorEndpoint api. There's lot of useful stuff hidden in Apple's Private API space.

Great write up! I enjoy seeing others working in the same problem space.

This seems great tech but the obvious obvious LLM slop writing is just so incredibly off-putting. We read LLM slop everyday ourselves, but now we have to read it everywhere else too. Is this stuff so hard to just write oneself ??

[dead]

[flagged]

"You can even get /dev/kvm inside a Linux VM on an M3 or later running macOS 15, which runs Firecracker unmodified."

I'm very confused why any SWE is on a M1 or M2 Mac. I've always gotten a new machine at $CORP every 2 years...