I built a ~8 MB native Docker app for Apple Silicon Macs — here's how it works

Description and use

DockZ is a lightweight (~8 MB) Docker GUI for Apple Silicon that runs an Alpine VM via Virtualization.framework, communicates over vsock, and uses Secure Enclave‑protected TLS keys, maintaining full Docker CLI compatibility.

Problem

Docker Desktop requires paid licenses for commercial use and is heavy (~1.5 GB) on Apple Silicon Macs.

Outcome

DockZ delivers a lightweight, license‑free Docker GUI for Apple Silicon, using a minimal Alpine VM, vsock communication, automatic port forwarding, and Secure Enclave‑protected TLS keys, while maintaining full CLI compatibility.

Workflow

• 1. Create a macOS Alpine VM using Virtualization.framework.
• 2. Run upstream dockerd inside the VM.
• 3. Register a Docker context named "dockz" so docker CLI, Compose and BuildKit work unchanged.
• 4. Communicate with dockerd over virtio‑vsock (HTTP/1.1) instead of a TCP port.
• 5. Watch Docker events API to automatically forward published container ports to the Mac.
• 6. For remote engines, use docker system dial‑stdio over SSH or a custom TLS relay that uses a Secure Enclave key for client auth.
• 7. Monitor the VM health: ping /_ping every 15 s, restart on failures, limit restarts to 3 per 10 min, and keep recent logs.
• 8. Handle Docker’s "-1" size sentinel by normalizing to "unknown" before arithmetic.

Evidence

Docker Desktop needs a paid subscription for commercial use at larger companies.

Source

Docker Desktop felt heavy on my Mac — a ~1.5 GB app and a lot of background activity just to run a few containers.

Source

The app itself stays small: no bundled Electron runtime, and the guest image is minimal Alpine.

Source

The private key is created inside the Mac's Secure Enclave (CryptoKit's SecureEnclave.P256.Signing.PrivateKey), protected with Touch ID / user presence.

Source