Notes from building it.
Field notes and product thinking from the team building Virtainer — written for the people who run it.
After Apple, Docker agrees that AI agents belong in their own machine Latest Apple gave every Linux container its own virtual machine. Docker has now done the same for AI agent sessions. Both put that boundary on the machine you type on, which leaves the workloads that have to keep running somewhere else entirely. 7 min Run DeepSeek Harness as an AppVM, step by step DeepSeek Harness is a brand-new open source AI agent, moving fast and still in developer preview. Give it a machine of its own instead of your laptop, then reach it from any browser, including a phone or a tablet. 13 min Writing a Dockerfile for an AppVM: nine principles An AppVM boots an ordinary OCI image as its own machine, so your Dockerfile skills carry over directly. Nine principles for writing one that behaves, each following from a single idea: the image is a machine's root filesystem and its only service. 10 min Two KVM escapes, one precondition: the machine is still the boundary Januscape and Zapscape are both guest-to-host escapes in KVM's shadow MMU, disclosed months apart in 2026. Both need the same thing from the attacker: a guest running virtual machines of its own. A container escape needs no such setup, and an AppVM never runs nested VMs. That gap is the argument. 5 min Apple container and Virtainer AppVM: the same idea Apple's container and Virtainer's AppVM reached the same idea on their own: boot a container image as its own virtual machine. Apple built it for the Mac. Virtainer built it for x86_64 servers, where it also runs classic Linux VMs on the same host. 4 min AppVM: The middle ground has two doors The microVM is a real middle ground between VMs and containers. Most tools reach it from the container side and bring the ecosystem along. Virtainer comes from the machine side, and here is what that actually buys you. 4 min Virtainer is now public Virtainer Free is now available as a free public beta: turn any Linux cloud image or Docker image into a hardware-isolated virtual machine on a single host you run yourself. 1 min