Apple container runtime support as an agent sandbox

[scmrus]

Hi,

I wanted to ask your opinion about using Apple's container framework (https://github.com/apple/container) as an alternative sandbox runtime for ralphex on macOS 26.

container runs OCI images in lightweight Apple VMs and exposes a Docker-like CLI (container run, -v, --rm, etc.), so in many cases it can stand in for docker run without much rework. For agent workflows this is attractive because each run gets its own VM-level isolation while still feeling like a normal container invocation.

I'm wondering whether ralphex could support container as a drop-in adapter alongside Docker, or whether that is effectively already possible today. Do you have a sense of how much effort would be involved — is it mostly a matter of swapping the docker binary, or are there assumptions in ralphex (image building, networking, exec, mounts) that would need a dedicated adapter?

Here's the kind of invocation I have in mind, just to illustrate:

container run \
    -v "$PWD:/workspace/" \
    -v "$HOME/.claude-creds.json:/home/node/.claude/.credentials.json" \
    --rm -it $DOCKER_IMAGE \
    sh -c "claude --model haiku -p $PROMPT < /dev/null"