I built a ~8 MB native Docker app for Apple Silicon Macs — here's how it works

说明与用途

DockZ 是一个轻量级（约 8 MB）的 Docker GUI，适用于 Apple Silicon，使用 Alpine VM、vsock 通信，并利用 Secure Enclave 保护 TLS 密钥，保持完整的 Docker CLI 兼容性。

问题

Docker Desktop requires paid licenses for commercial use and is heavy (~1.5 GB) on Apple Silicon Macs.

结果

DockZ delivers a lightweight, license‑free Docker GUI for Apple Silicon, using a minimal Alpine VM, vsock communication, automatic port forwarding, and Secure Enclave‑protected TLS keys, while maintaining full CLI compatibility.

工作流

• 1. Create a macOS Alpine VM using Virtualization.framework.
• 2. Run upstream dockerd inside the VM.
• 3. Register a Docker context named "dockz" so docker CLI, Compose and BuildKit work unchanged.
• 4. Communicate with dockerd over virtio‑vsock (HTTP/1.1) instead of a TCP port.
• 5. Watch Docker events API to automatically forward published container ports to the Mac.
• 6. For remote engines, use docker system dial‑stdio over SSH or a custom TLS relay that uses a Secure Enclave key for client auth.
• 7. Monitor the VM health: ping /_ping every 15 s, restart on failures, limit restarts to 3 per 10 min, and keep recent logs.
• 8. Handle Docker’s "-1" size sentinel by normalizing to "unknown" before arithmetic.

证据

Docker Desktop needs a paid subscription for commercial use at larger companies.

来源

Docker Desktop felt heavy on my Mac — a ~1.5 GB app and a lot of background activity just to run a few containers.

来源

The app itself stays small: no bundled Electron runtime, and the guest image is minimal Alpine.

来源

The private key is created inside the Mac's Secure Enclave (CryptoKit's SecureEnclave.P256.Signing.PrivateKey), protected with Touch ID / user presence.

来源