Docker has always used microVMs (well, since 2016)

There's a lot of buzz about "microVMs", where a workload runs with a stripped down Linux kernel, on a minimalist VMM such as firecracker (released in 2018) on top of a hypervisor like KVM or Xen. MicroVMs are often contrasted to, and considered more secure than, traditional Linux Docker containers. What if I told you that Docker Desktop has always used microVMs?

Always has been meme: wait, Docker uses microVMs? Always has been (since 2016)

Back in 2015

Docker Toolbox logo When I joined Docker in 2015 the state of the art was Docker Toolbox. It used VirtualBox, which is a great product with lots of features. VirtualBox has its own GUI and its own update process; way more than we needed for Docker.

A library VMM

We wanted Docker to feel like a native app on Mac and Windows, rather than a bundle of components. Using our Mirage Unikernel libraries we started building a "library VMM": a VMM which could be embedded inside the Docker application, and which would be single purpose, minimal, secure and fast. The first version was called hyperkit and the most recent one is Docker VMM.¹

The VM kernel and root filesystem were minimal too, based on the LinuxKit project. The current version is an even more slimmed down variant but conceptually the same, similar to containerd/nerdbox.

Docker for Mac in 2016

For Docker for Mac (later renamed Docker Desktop) this allowed:

Running rootless on all platforms. Without requiring "rootless inside Linux": the whole Linux kernel is untrusted, so even a Linux CVE doesn't matter.
Minimal devices. We could carefully limit the host / VM interface, making it easy to understand and audit.
VPNs and network policy. It was easy to interoperate with VPNs, and to impose networking policy such as Registry Access Management.

And now

The Docker microVM tech is the foundation of Docker Sandboxes today (why microVMs). It continues to get faster, lower overhead and more secure over time.

Footnote