> The thing macOS really painfully lacks is not ergonomic ways to run Linux VMs, but actual, native containers-- macOS containers

Linux container processes run on the host kernel with extra sandboxing. The container image is an easily sharable and runnable bundle.

macOS .app bundles are kind of like container images.

You can sign them to ensure they are not modified, and put them into the “registry” (App Store).

The Swift ABI ensures it will likely run against future macOS versions, like the Linux system APIs.

There is a sandbox system to restrict file and network access. Any started processes inherit the sandbox, like containers.

One thing missing is fine grained network rules though - I think the sandbox can just define “allow outbound/inbound”.

Obviously “.app”s are not exactly like container images , but they do cover many of the same features.