OrbStack vs Apple Containers Benchmark

As container runtimes on macOS evolve, developers are constantly seeking the right balance between performance, resource efficiency, and native integration. Recently, we’ve put OrbStack and Apple Containers to the test using a robust criterion benchmark suite in Rust.

(Note: You can view the full benchmark project, documentation, and raw data at https://fermeridamagni.localhost/container-benchmarks/)

Here is a deep dive into how they compare across various metrics.

1. Startup Time

One of the most noticeable metrics for local development is how fast a container can boot, execute a command, and terminate. Apple Containers launch a dedicated micro-VM per container—a great feature for isolation but with a slight overhead compared to OrbStack, which shares a highly optimized Linux VM.

Startup Time (Milliseconds)

OrbStack consistently starts containers in roughly half the time compared to Apple Containers, making it incredibly snappy for rapid test-and-run cycles.

2. CPU Performance

Running sysbench cpu run inside the containers shows that both solutions achieve near-native performance. This is primarily because both heavily rely on Apple’s Virtualization framework to tap directly into Apple Silicon’s processing power.

CPU Events Per Second (sysbench)

The CPU performance is effectively a tie. Both runtimes allow your containers to utilize the underlying hardware with minimal virtualization penalty.

3. Memory Overhead

Memory consumption is where the architectural differences become obvious. Apple Containers consume a baseline of RAM for each dedicated VM instance. OrbStack, leveraging its shared VM model, runs additional containers with significantly lower base memory overhead.

Base Memory Overhead (MB per container)

For heavy multitasking or running many microservices locally, OrbStack’s shared-VM approach will save substantial amounts of RAM.

4. Image Size on Disk

Both runtimes are OCI-compliant and pull the same images. The underlying storage mechanism on macOS can impact how much space they ultimately take on your SSD.

Image Size on Disk (MB)

Both runtimes are highly efficient. Apple Containers matches OrbStack’s footprint nicely, as both utilize APFS native features like clones and sparse files optimally.

5. Security & Isolation

When choosing a local container runtime, performance is only half the equation. The underlying architecture and how it isolates containers from the host macOS system is critical, especially when running untrusted or unverified code.

Architectural Differences

OrbStack: The Shared-Kernel Micro-VM Like many traditional developer-focused container tools on macOS, OrbStack utilizes a highly-optimized Linux micro-VM.

• Shared Kernel: All containers run inside a single, shared Linux kernel. This reduces resource overhead and allows for blazing-fast performance.
• Deep Integration: By default, OrbStack heavily integrates with the host macOS system (e.g., seamless file sharing via VirtioFS, bridged networking, etc.) to prioritize developer experience and productivity.

Apple Containers: One-VM-Per-Container Introduced with native Virtualization framework enhancements, Apple’s approach fundamentally changes the container model on macOS.

• Hardware-Backed Isolation: Instead of sharing a single kernel, Apple Containers assigns a dedicated, lightweight virtual machine to each individual container.
• Hypervisor-Level Security: This “one-VM-per-container” architecture leverages the macOS Hypervisor framework, creating a robust, hardware-backed isolation boundary around every workload.

Isolation Strength & Risks

In a shared-kernel architecture like OrbStack, a vulnerability in the Linux kernel or a container escape exploit can potentially compromise the entire shared VM, affecting all other running containers. Because of this, OrbStack explicitly notes that its default setup is not a substitute for a full VM when dealing with actively malicious code.

By contrast, Apple Containers’ hypervisor-level isolation completely prevents traditional namespace-based container escapes. Even if an attacker compromises a container, they are trapped within that specific micro-VM, unable to access the host macOS or other adjacent containers.

Final Verdict

Both OrbStack and Apple Containers are fantastic tools built on modern macOS frameworks.

• Choose OrbStack if you value rapid startup times, run numerous containers simultaneously, and want to keep your memory overhead to a bare minimum.
• Choose Apple Containers if strict isolation between containers is a priority, and you prefer utilizing Apple’s native micro-VM abstractions directly.

Ultimately, Apple’s virtualization framework proves to be exceptionally powerful regardless of which runtime orchestrates it. For most developer workflows, however, OrbStack currently takes the crown for its pure efficiency and speed.