PlatformIsolationOrbStack isolated machines

OrbStack isolated machines

Evaluates OrbStack isolated machines against jackin❯ kernel-isolation, automation, and macOS ARM requirements.

Research state: Current

Verification cutoff: 2026-06-10. This dossier incorporates OrbStack 2.2 capabilities recorded in the Apple Container 1.0 landscape.

Research question

Can an OrbStack isolated machine provide a stronger jackin❯ backend while preserving private Docker workflows, automation, mounts, networking, and interactive lifecycle behavior?

Headline findings

  • OrbStack machines share OrbStack's Linux kernel. “Isolated” removes automatic host-filesystem integration and adds namespace separation; it does not create a hypervisor boundary per workload.
  • The current jackin❯ audience already runs Docker inside OrbStack's outer Linux VM. Adding an isolated machine creates another namespace layer inside the same kernel, so it does not close the kernel-escape gap.
  • OrbStack 2.2 provides per-machine CPU, memory, and disk limits, --isolate-network, opt-in --forward-ssh-agent, and working Docker in isolated machines.
  • File transfer, persistent storage, port forwarding, read-only mount enforcement, interactive attach, and cleanup still require empirical validation.
  • OrbStack isolated machines remain useful for reducing accidental host-file exposure. They should not be described as microVMs or selected when the requirement is a separate workload kernel.

Method and evidence

The review used OrbStack architecture, machine, file-sharing, networking, settings, release-note, and issue-tracker evidence. Architecture and security explains the boundary. CLI and compatibility records the verified and unknown automation surfaces.

No complete jackin❯ backend prototype or interactive attach test was performed.

Limitations and open questions

  • Can read-only selective mounts be enforced through a stable CLI contract?
  • What are the exact stable CLI forms for per-machine CPU, memory, and disk limits?
  • Does file transfer work reliably for isolated machines?
  • Does orb -m provide correct PTY allocation, resize propagation, signals, detach, and exit status?
  • Can private Docker storage and image distribution be made deterministic without weakening isolation?

How to read

PagePurpose
Architecture and securityShared-kernel model, threat-boundary implications, and the reason for deferral.
CLI and compatibilityVerified CLI surface, mounts, image transfer, Docker, networking, and attach constraints.

smolvm alternatives and decision

Compares smolvm with hardened Docker, Docker Sandboxes, Apple Container, and OrbStack against the required isolation boundary.

OrbStack isolated-machine architecture and security

Explains OrbStack's shared-kernel boundary and why isolated machines do not provide per-workload kernel isolation.

On this page

Research questionHeadline findingsMethod and evidenceLimitations and open questionsHow to readRelated work