As the Podman machine function becomes more used—particularly on Macs—there have been many questions about how this all works. Some of what is tossed around on the internet is pure speculation, so this article aims to eliminate any speculation.

Many people do not realize that containers are really Linux. As such, Linux containers cannot run natively on macOS. Therefore, the containers must run in a Linux virtual machine (VM), and a Podman client interacts with that VM. This is in line with all solutions for running containers on macOS.

The technology behind a Podman machine is:

• QEMU plus HVF acceleration: Runs a virtualized Linux distribution using native macOS virtualization
• Fedora CoreOS (FCOS): The virtualized Linux distribution
• Ignition: Configures the FCOS VM (similar to cloud-init)
• gvisor-tap-vsock: A proxy application that sets up port mapping on the host according to instructions from a custom Container Network Interface (CNI) plugin on the VM
• SSH: The Podman client securely communicates with the Linux VM using secure shell (SSH) keys

Digging deeper

Understanding how all these components work together requires a more granular inspection. The first step is to make sure you have a Podman client on your host system. For example, you can do this on a Mac using Homebrew with brew install podman. Once you’ve installed the client, issue podman machine init to create a Linux VM for your containers.

I describe the init process in the illustration below. After you run the init command (A), Podman checks for the latest version of FCOS, and if that version is not already local, it downloads it (B). Once the image is downloaded, the image is uncompressed, resized, and two relevant files are written: The machine description and the ignition file (C).

The machine description is a text file that describes the attributes of the VM that it will create. It is in JSON format and written to the host’s filesystem. The ignition file, which ultimately is used to customize the FCOS operating system, is also written into the host’s filesystem. Note that no VM is started or even created yet; just its description.

The next step is to issue the podman machine start