Rift v0.2.0 — Apple Silicon source preview

Rift v0.2.0 — Apple Silicon source preview

This release brings Rift's newer container, image-build, and resource controls to its Homebrew source-build install. Rift runs linux/arm64 OCI images in disposable Linux VMs on Apple Silicon Macs without Docker or a permanent daemon.

Install

brew install OthmaneBlial/rift/rift

If Rift is already installed, run brew upgrade OthmaneBlial/rift/rift. Homebrew uses Zig during the build; the installed Rift binary does not require Zig or Docker.

Changes since v0.1.2

• Build local OCI images from a supported Dockerfile subset: multiple FROM stages, COPY, RUN, ENV, USER, WORKDIR, ENTRYPOINT, CMD, and STOPSIGNAL.
• Stream detached exec output and opt-in stdin, attach a resizable TTY with exec -it, emit binary-safe JSON Lines logs, and honor an image's stop signal.
• Configure VM CPU and memory, disable VM networking, and set optional cgroup CPU, memory, and process limits. Choose reduced or empty capabilities and adjust individual capabilities explicitly.
• Restore global PAX metadata, supported extended attributes, FIFOs, and character or block device nodes outside the guest-managed /dev. Reject replaced volume sources and bound ownership-index work.
• Reduce local boot-file storage through APFS sharing and shorten graceful VM shutdown. On one M2 Mac, three cached Alpine launches had a 1.13-second median. The idle Rift worker and VM service had a 154.7 MiB median process footprint. Methods and limits are in benchmarks.

Verification and limits

The local Apple Silicon suite covers Zig formatting and tests, a ReleaseSafe build, real Alpine and Nginx VMs, OCI pulls, build stages, networking, volumes, lifecycle, resource controls, and a private-registry fixture. The full workflow is verified on Apple M2 with macOS 26.6; macOS 12 and other Macs are not verified.

This remains a source preview. Rift supports one forwarded TCP port and up to 16 explicit volumes per run. Dockerfile support is partial. No Developer ID-signed or notarized binary is attached, and the VM boundary has not had an independent security assessment.

Rift v0.1.2

Rift v0.1.2 — Apple Silicon source preview

Rift v0.1.2 preserves OCI file ownership from tar headers and local or global PAX uid/gid fields. It applies non-root owners inside the disposable guest overlay, including ownership of the root directory, files, directories, symlinks, and hardlinks. A bounded manifest and no-follow path traversal keep image ownership changes inside the guest root. OverlayFS metadata-only copy-up avoids copying image file contents just to change owners. Image xattrs remain unsupported.

Install with Homebrew

brew install OthmaneBlial/rift/rift

The formula builds Rift from the tagged source and installs Zig as a build dependency. The installed Rift executable does not need Zig.

Verify locally

The local Apple Silicon suite covers formatting, unit tests, a ReleaseSafe build, VM and networking checks, container lifecycle, registry authentication, volumes, and an OCI ownership fixture. A Docker Hub redis:alpine run verified its 999:1000 /data ownership and a write as the redis user, without Docker installed.

Limits

This preview has no Developer ID-signed or notarized binary. The full runtime workflow has not yet been tested on macOS 12. Interactive exec, remaining global PAX fields, extended attributes, FIFOs, special files, broader OCI process controls, and compatibility with additional registries remain open.

Rift v0.1.1 — Apple Silicon source preview

Rift v0.1.1 — Apple Silicon source preview

Rift v0.1.1 is a source preview for Apple Silicon Macs. It adds anonymous Amazon ECR Public support, handles image device entries under the runtime-managed /dev, and targets macOS 12.0 instead of the build host's OS version.

Install with Homebrew

brew install OthmaneBlial/rift/rift

The Homebrew formula builds Rift from source. Homebrew installs Zig as a build dependency. The installed Rift executable does not need Zig at runtime.

Verify locally

The full ./scripts/check-local.sh suite passed on Apple Silicon with macOS 26.6 and Zig 0.16.0. Anonymous ARM64 pull and execution passed for Docker Hub and Amazon ECR Public. Private Basic-to-Bearer authentication passed against a local registry fixture.

Limits

This preview has no Developer ID-signed or notarized binary. The full runtime workflow has not yet been tested on macOS 12. Image ownership, extended attributes, FIFOs, interactive exec, broader OCI process controls, and compatibility with additional registries remain open.

Rift v0.1.0 — Apple Silicon source preview

Rift v0.1.0 — Apple Silicon source preview

Rift is an experimental Zig runtime that pulls OCI images and runs Linux commands inside disposable VMs managed by Apple's Virtualization.framework. This preview targets macOS on Apple Silicon.

Try it from source

brew install zig
git clone https://github.com/OthmaneBlial/Rift.git
cd Rift
zig build -Doptimize=ReleaseSafe
zig build test

The binary is written to zig-out/bin/rift. The first run fetches the pinned Alpine guest ISO, verifies its SHA-256, and installs the guest boot files.

rift run --rm alpine echo hello
rift run -d -p 8080:80 nginx
rift ps
rift logs <container-id>
rift stop <container-id>
rift rm <container-id>

Rift also supports verified image pulls, environment and working-directory overrides, image users and groups, explicit file and directory volumes, one localhost TCP mapping, kill, rmi, disk reporting, and confirmed cache cleanup.

Limits

Rift is early-stage and is not a Docker replacement yet. OCI ownership, PAX metadata, extended attributes, special files, broader process isolation, and structured logs remain unfinished. Port forwarding supports one TCP port per run. File-volume sources must share a filesystem with Rift's runtime storage. Private-registry provider compatibility is not yet validated beyond the local fixture.

This release has no macOS binary asset. Rift does not yet have a Developer ID signed and notarized public download; macOS Gatekeeper rejects the locally ad-hoc-signed archive. Building from source is the supported installation path.

All checks run locally; GitHub Actions remains disabled by project direction. See the README, architecture, and benchmark method for the current state and evidence.