Docker has run in a microVM since 2016

I keep hearing the idea that microVMs would be the new thing finally coming to compete with containers, as if the two were opposed and you had to pick a side. A post on dave.recoil.org , written by someone from the ecosystem that built Docker Desktop, sets the record straight and it lands exactly where I place the subject.

The thesis fits in one sentence: Docker Desktop has run containers inside a minimal VM since 2016, built on the MirageOS building blocks. The markers are verifiable, the acquisition of Unikernel Systems in January 2016, Docker for Mac announced in March and generally available that July, a userspace VMM (hyperkit originally, Docker VMM today), a userspace network stack with vpnkit and a kernel plus a rootfs shaped through LinuxKit. In other words, the container a developer launches on a Mac or on Windows never touched the host kernel, it lives in a microVM and it has done so for close to ten years.

This is exactly the false debate I push back on elsewhere. A container and a VM are not two rival religions, they are two levels of isolation you stack according to the surface you accept to expose, which I detail on the container/jail boundary in Docker versus jails and on the pure microVM side in Firecracker isolation . Rootless, sometimes presented as a late fix, actually falls out of the design, since the Linux kernel running inside the VM is not trusted by the host and the interface between the two stays small and auditable.

Nor is this a view from nowhere, it is what my typical infra looked like until 2024. Bare-metal hypervisor clusters, Proxmox or ESXi depending on the context, running VMs with clearly separated roles, some purely Docker, rootless or not depending on what they hosted, others running k0s, others still running Podman , orchestrated by Quadlet and systemd. The container never replaced the VM there, it lived inside it.

And the loop closes on current events, Docker Sandboxes reuses the same foundation to give each coding-agent session its own microVM. So the microVM was not the future of containers, it was already their foundation on the machines of millions of developers, we simply did not put the word on it.

Source: Docker has always used microVMs , dave.recoil.org.

[edit: 2026] The Ansible implementation of all this: the docker , podman and quadlet roles.