A suggestion to the author -- don't outsource your writing to AI, or, if you do, go over it with a fine-tooth comb and remove every trace of Claudisms from it.
I read the subtitle: "What it takes to boot the same microVMs on Apple's hypervisor, and the one capability Apple will not let you have." and immediately navigated away.
Agreed, and then the actual text of the post gets worse. It’s actually unreadable; I literally could not follow what the article was about (without putting in the effort to unravel the Claudisms, a little like unraveling Shakespeare or Finnegan’s Wake) and gave up.
It seems we are all (on HN) thoroughly convinced that the models have all gotten worse at writing as the version numbers have gone up and they are supposedly more powerful models. Sol 5.6 is nowhere near as bad as Opus 5 or even the 4 series but not great.
But looking back there was a time we were enamored with how they wrote. Perhaps it’s related to the newfound prohibitions on “write in this writer’s style”? I wonder if training the models to not be able to do that anymore has steered them towards not being able to write, at all, in any existing human good writing style and they are navigating the small pathway through all existing good human writing to whatever you want to call what they are doing now?
It was the newness and surprise that the quality was as good as it was, just like images from Stable Diffusion, etc. Now that we are used to it, we notice the uncanny valley speak.
I'm willing to bet it's because model providers have gone all-in on programming and reasoning ability when training new models. It's where the money is, if nothing else, and the writing quality will have suffered as a knock on effect.
This kind of AI-generated articles are always weird on details. Hyper-focusing on weird details while missing one higher level ones.
E.g., they use Firecracker, they build and deploy backend applications, but they needed to run the stack on macOS. Why? If you're using Firecracker to run backend applications, isn't Linux the obvious choice?
What an awful blog renderer that, in Firefox, works when scrolling with the trackpad, but doesn't work when using keyboard arrow keys or pageUp/down: I get blank pages when scrolling with the keyboard beyond the initial viewport.
Oh yes. I discovered that there are two scrollbars. By clicking somewhere in the blog text, you activate the inner one and then scrolling with the keyboard works.
I saw this blog post title and wanted to read it, as I thought this is something we really wanted when I worked back at Encore - and lo and behold what website I ended up on!
Great work lads, seeing those old shell scripts brought back memories, but this is awesome to see you've solved the problem now to make your own lives easier!
Any plans to open source crackling? I was looking into cross platform microVM's after reading about sbx recently.
By experience, getting Firecracker to run well on M-series macs is quite the undertaking. I'm not at all surprised Encore decided to take this path considering their customer base!
At Lovable we decided to spend ~1 engineering month getting our sandbox infrastructure to be 100% runnable on Mac and on Linux with predictable builds using Bazel etc.
But we actively decided to take a different route than Encore and run nested virtualization, which on macOS means vfkit -> QEMU -> Kind + Firecracker vm(s). It's been invaluable to get the same development and testing tools on both platforms tbh.
Plus show me an off the shelf solution to MDM that exists in the Linux space?
(Not too mention an easy to buy consumer devices which supports suspend/resume correctly in 2026, not even Windows can do that any more)
Apple is crap and evil about many things, but at least here they know their paying audience...
One case where Apple can be very useful is if you're traveling a lot for work.
Wherever you are you can probably find a local store that sells and services Macbooks. So if your machine is damaged during a trip you can get it fixed, or buy a replacement on the spot, and at least get through the work you are there to do.
For small-ish companies that can be a very useful feature.
Buying on the spot - sure. Anything that requires repair has to be usually booked in advance with some waiting time. Relatively short, usually days, but still not really possible to go into the store and get your laptop fixed right away in most cases.
Except it's still a slightly different challenge each time to "get it working", each different PC. A Mac is a Mac is a Mac, more or less.
I have a nice Framework laptop on my desk running Kubuntu alongside my Macs. Every now and then I check in, make sure I could switch to it if I needed to, test all my important tasks, plug it in so the stupid mainboard battery does not go flat.
And then I go back to my Mac, because I prefer it and even Tahoe isn't painful enough to switch. KDE is fine and I'll use it if circumstances dictate I have to.
I think critics misunderstand the extent to which Mac-using devs are "locked into Apple's ecosystem". Unless you're writing iOS apps, you aren't. You perhaps even exist in a more heterogeneous world (Mac and Linux, Mac and Windows, all three) than a Linux-using web dev does.
Essentially everything I run is not at all "locked in". I would miss the ease of keychain, handoff and Apple Notes (which I like despite its flaws). And then I'd deal with it. I'd probably carry on using an iPhone (I am very ambivalent about the iPad)
FWIW my "Apple ecosystem" is why I have been able to teach myself open weights/open source AI at a pragmatic level, because my secondhand off-the-shelf kit does an acceptable job of it without me yet having to specify a PC I don't have enough use for as a non-gamer. A lot of people have solved a lot of general problems that I don't have to tinker with too early.
This isn't a fanboy thing (I would consider myself a qualified critic). Both KDE and GNOME have some nice things. It's just a question of energies.
IIRC it was Adrian Cockcroft who said he used Sun at work, and a Mac at home, because performance tuning was his day job and he didn't want to do it at home; I think this resonates.
It has been my own choice for 28 years, largely: Mac plus linux.
Virtualization.framework isn't particularly limited, for what it is... given they're using Firecracker on Linux, it makes sense to use a similarly high level API on macOS.
(One could add a Hypervisor.framework backend to Firecracker, though I'd be surprised if AWS accepted it.)
Rebuilding MicroVMs natively on Apple Silicon usually cuts virtualization overhead massively, but Hypervisor.framework DX and virtio device parity are the real bottlenecks.
You mentioned libkrun in the post, but I am not clear on why you chose not to use it for Mac even if you want to stick with Firecracker on Linux. Why not use libkrun?
This is unbelievably cool. How did you use AI for this? Absolutely not suggesting there's anything wrong with it - quite the contrary. I find AI is most useful for these lower level driver type projects such as yours that one knows are possible but that would be very onerous for a human to implement. For example the guy who re-wrote a driver from scratch for his HP Printer the other day.
Do you think you could have done this without AI? I've been migrating people off of AWS recently and it was absolutely made possible (or at least expedient) by AI.
Four years on a shared remote machine before building the local backend is a good lesson in when to invest in dev tooling versus living with the workaround.
Because prices? Have you seen how much Apple products cost these days?
Also, M1/M2 are perfectly fine and capable hardware. It's hard to justify the upgrade outside some artificial constraints Apple would bring in with a macOS update.
I'm very surprised you feel it's a given that every SWE at every company has the perk of getting a new machine as quickly as every 2 years, I doubt it's justified by the productivity increases of just 2 years of hardware improvements.
it's pretty common to be running a 4 year old computer in most companies I've worked.
I think they plan for 3 years but in reality it becomes closer to 4 (because they don't plan the refresh during the actual hardware refresh cycle, so you'll end up with a computer that was released in September the year before in like August the year after).
I've never worked anywhere that replaced my computer after 2 years.
You’d be surprised. I got an absolute boat anchor of a 2019 MacBook when I started a job in early 2022. I requested a new one in late 2023 because company policy is to refresh laptops every 4 years - whoever was on the other end of my support ticket interpreted the policy as four years from issuance and denied me.
Not everyone is at $CORP. I upgraded from M1 to M4 and probably won't upgrade until the gap is worth it (M7?). Besides the memory increase I barely notice the improved cpu/gpu speed.
Things were painful in the Intel era but I’m on M1 Mac and I’d have a really hard time justifying a request for an upgrade. I absolutely detested my old Intel MacBook (touchbar era) and couldn’t wait to get rid of it.
I run bloated slow electron apps and chrome all day, generally with profligate usage patterns, and things hardly ever slow down even with corporate antimalware. Sometimes I forget about having left Windows VMs running in the background.
Anyway, why would my company spend $2500+ every two years to turn instant into instant?
This seems great tech but the obvious obvious LLM slop writing is just so incredibly off-putting. We read LLM slop everyday ourselves, but now we have to read it everywhere else too. Is this stuff so hard to just write oneself ??
I just encountered the `com.apple.private.virtualization` entitlement limitation just last night, wanting to use VZVirtualMachine private AccessorEndpoint api. There's lot of useful stuff hidden in Apple's Private API space.
Great write up! I enjoy seeing others working in the same problem space.
A suggestion to the author -- don't outsource your writing to AI, or, if you do, go over it with a fine-tooth comb and remove every trace of Claudisms from it.
I read the subtitle: "What it takes to boot the same microVMs on Apple's hypervisor, and the one capability Apple will not let you have." and immediately navigated away.
Agreed, and then the actual text of the post gets worse. It’s actually unreadable; I literally could not follow what the article was about (without putting in the effort to unravel the Claudisms, a little like unraveling Shakespeare or Finnegan’s Wake) and gave up.
It seems we are all (on HN) thoroughly convinced that the models have all gotten worse at writing as the version numbers have gone up and they are supposedly more powerful models. Sol 5.6 is nowhere near as bad as Opus 5 or even the 4 series but not great.
But looking back there was a time we were enamored with how they wrote. Perhaps it’s related to the newfound prohibitions on “write in this writer’s style”? I wonder if training the models to not be able to do that anymore has steered them towards not being able to write, at all, in any existing human good writing style and they are navigating the small pathway through all existing good human writing to whatever you want to call what they are doing now?
> newfound prohibitions on “write in this writer’s style”
that explains a lot. but do you have a decent citation?
It was the newness and surprise that the quality was as good as it was, just like images from Stable Diffusion, etc. Now that we are used to it, we notice the uncanny valley speak.
I'm willing to bet it's because model providers have gone all-in on programming and reasoning ability when training new models. It's where the money is, if nothing else, and the writing quality will have suffered as a knock on effect.
Someone should build a capable technical writing model, would make a TON of money
This kind of AI-generated articles are always weird on details. Hyper-focusing on weird details while missing one higher level ones.
E.g., they use Firecracker, they build and deploy backend applications, but they needed to run the stack on macOS. Why? If you're using Firecracker to run backend applications, isn't Linux the obvious choice?
I wonder how necessary/useful this is, in light of the amazing smolvm microvms from https://smolmachines.com.
(Not snark, not affiliated, just happy and impressed with smolvm and genuinely curious.)
What an awful blog renderer that, in Firefox, works when scrolling with the trackpad, but doesn't work when using keyboard arrow keys or pageUp/down: I get blank pages when scrolling with the keyboard beyond the initial viewport.
I never understand why people mess with layout/scroll bar in this way. Like, now you have got more things to maintain.
Oh yes. I discovered that there are two scrollbars. By clicking somewhere in the blog text, you activate the inner one and then scrolling with the keyboard works.
Sorry about that - just pushed a fix :)
Are there any technical reasons to override native scrolling functionality in the first place?
No, it's a design thing, it hurts A11Y especially.
I thought it was just me. Super weird.
Wow, that's actually an impressive new failure mode; and it happens on Safari too.
I saw this blog post title and wanted to read it, as I thought this is something we really wanted when I worked back at Encore - and lo and behold what website I ended up on!
Great work lads, seeing those old shell scripts brought back memories, but this is awesome to see you've solved the problem now to make your own lives easier!
Any plans to open source crackling? I was looking into cross platform microVM's after reading about sbx recently.
see also "smolvm" - the awesome microvms from https://smolmachines.com
This article was made for LLMs reading, not for human reading.
By experience, getting Firecracker to run well on M-series macs is quite the undertaking. I'm not at all surprised Encore decided to take this path considering their customer base!
At Lovable we decided to spend ~1 engineering month getting our sandbox infrastructure to be 100% runnable on Mac and on Linux with predictable builds using Bazel etc.
But we actively decided to take a different route than Encore and run nested virtualization, which on macOS means vfkit -> QEMU -> Kind + Firecracker vm(s). It's been invaluable to get the same development and testing tools on both platforms tbh.
I’d like to learn more about doing this myself - do you recommend any good guides or posts?
I should do a write-up! Maybe you'll see it posted here soon. We could basically find nothing online...
Note M1 and M2 macs don’t have hardware support for nested virt.
> most engineers at Encore develop on a Mac
They are solving the wrong problem.
Hacker News is so utterly detached from reality at times, and comments like these really drive that home.
Thought I was tripping, someone made the same point today in another thread: https://news.ycombinator.com/item?id=49381236
Most tech people are utterly detached from reality so that definitely tracks
No, they're realists.
Plus show me an off the shelf solution to MDM that exists in the Linux space? (Not too mention an easy to buy consumer devices which supports suspend/resume correctly in 2026, not even Windows can do that any more)
Apple is crap and evil about many things, but at least here they know their paying audience...
One case where Apple can be very useful is if you're traveling a lot for work.
Wherever you are you can probably find a local store that sells and services Macbooks. So if your machine is damaged during a trip you can get it fixed, or buy a replacement on the spot, and at least get through the work you are there to do.
For small-ish companies that can be a very useful feature.
Buying on the spot - sure. Anything that requires repair has to be usually booked in advance with some waiting time. Relatively short, usually days, but still not really possible to go into the store and get your laptop fixed right away in most cases.
With the memory shortage, many places you can’t buy most models on the spot. Wait times are almost two months for some machines right now.
https://tidbits.com/2026/08/10/mac-delivery-times-stretch-to...
If you have a business relationship with Apple, it's same-day service.
You don't even have to be a large corp for that, my org was 60 people with like 20 Macbooks and we had it.
FWIW if you live in a major metro area, Dell also does this, it's not terribly uncommon for business class machines.
The wait can be pretty short, I once got the charging port on my iPhone replaced same day at an Apple Store in Vegas
Why wouldn't you do that with any other platform?
Buy any laptop, stick Linux on it, get working.
Buy a cheap shitty Chromebook, ssh to your dev platform, give it to some school child who doesn't have a laptop when you get your real one back.
You don't need to be locked into Apple's ecosystem for that.
> Buy any laptop, stick Linux on it, get working.
Except it's still a slightly different challenge each time to "get it working", each different PC. A Mac is a Mac is a Mac, more or less.
I have a nice Framework laptop on my desk running Kubuntu alongside my Macs. Every now and then I check in, make sure I could switch to it if I needed to, test all my important tasks, plug it in so the stupid mainboard battery does not go flat.
And then I go back to my Mac, because I prefer it and even Tahoe isn't painful enough to switch. KDE is fine and I'll use it if circumstances dictate I have to.
I think critics misunderstand the extent to which Mac-using devs are "locked into Apple's ecosystem". Unless you're writing iOS apps, you aren't. You perhaps even exist in a more heterogeneous world (Mac and Linux, Mac and Windows, all three) than a Linux-using web dev does.
Essentially everything I run is not at all "locked in". I would miss the ease of keychain, handoff and Apple Notes (which I like despite its flaws). And then I'd deal with it. I'd probably carry on using an iPhone (I am very ambivalent about the iPad)
FWIW my "Apple ecosystem" is why I have been able to teach myself open weights/open source AI at a pragmatic level, because my secondhand off-the-shelf kit does an acceptable job of it without me yet having to specify a PC I don't have enough use for as a non-gamer. A lot of people have solved a lot of general problems that I don't have to tinker with too early.
This isn't a fanboy thing (I would consider myself a qualified critic). Both KDE and GNOME have some nice things. It's just a question of energies.
IIRC it was Adrian Cockcroft who said he used Sun at work, and a Mac at home, because performance tuning was his day job and he didn't want to do it at home; I think this resonates.
It has been my own choice for 28 years, largely: Mac plus linux.
> Except it's still a slightly different challenge each time to "get it working", each different PC
Maybe thirty years ago. Not today.
Just go and pick up a second-hand Thinkpad for pennies. Everything will work on it.
FleetDM comes to mind
Lots of Lenavo laptops do just fine, but Apple hardware is still supreme for what it is worth.
> MDM Linux
Jumpcloud, I've used it across Windows / Mac / Linux end user desktops and laptop fleets.
https://jumpcloud.com/lp/cross-os-device-management-fava-bea...
VZ.framework is very limited, Hypervisor.framework is the better analogue to KVM
Virtualization.framework isn't particularly limited, for what it is... given they're using Firecracker on Linux, it makes sense to use a similarly high level API on macOS.
(One could add a Hypervisor.framework backend to Firecracker, though I'd be surprised if AWS accepted it.)
AI written...
AI Slop; Did Not Read
Very hard to read
Agreed. Pacing is off, too dense. It feels like AI wrote it, then they did another round of AI to change the tone and light edits.
Rebuilding MicroVMs natively on Apple Silicon usually cuts virtualization overhead massively, but Hypervisor.framework DX and virtio device parity are the real bottlenecks.
Hey everyone - author of the article here! Happy to take questions.
You mentioned libkrun in the post, but I am not clear on why you chose not to use it for Mac even if you want to stick with Firecracker on Linux. Why not use libkrun?
This is unbelievably cool. How did you use AI for this? Absolutely not suggesting there's anything wrong with it - quite the contrary. I find AI is most useful for these lower level driver type projects such as yours that one knows are possible but that would be very onerous for a human to implement. For example the guy who re-wrote a driver from scratch for his HP Printer the other day.
Do you think you could have done this without AI? I've been migrating people off of AWS recently and it was absolutely made possible (or at least expedient) by AI.
The project is immensely cool, but please please do not use AI for writing. Very hard to read.
The author of the article is Claude.
It is way more accurate to say you authorized this rather than authored it.
Honestly asking, do you think this post is easy/enjoyable for people to read? Do you intend for people to just paste it into an LLM chat to digest it?
this all closed source?
Four years on a shared remote machine before building the local backend is a good lesson in when to invest in dev tooling versus living with the workaround.
I think Encore is great and do really cool things, but this post is AI;DR from the first sentence.
LOL, I hadn't heard "AI;DR" before. Definitely adding to my acronym toolbox :)
"You can even get /dev/kvm inside a Linux VM on an M3 or later running macOS 15, which runs Firecracker unmodified."
I'm very confused why any SWE is on a M1 or M2 Mac. I've always gotten a new machine at $CORP every 2 years...
Because prices? Have you seen how much Apple products cost these days?
Also, M1/M2 are perfectly fine and capable hardware. It's hard to justify the upgrade outside some artificial constraints Apple would bring in with a macOS update.
I'm very surprised you feel it's a given that every SWE at every company has the perk of getting a new machine as quickly as every 2 years, I doubt it's justified by the productivity increases of just 2 years of hardware improvements.
I am on an M1 macbook pro. My company will upgrade me anytime I want.
I haven’t asked because my current laptop is more than ok.
it's pretty common to be running a 4 year old computer in most companies I've worked.
I think they plan for 3 years but in reality it becomes closer to 4 (because they don't plan the refresh during the actual hardware refresh cycle, so you'll end up with a computer that was released in September the year before in like August the year after).
I've never worked anywhere that replaced my computer after 2 years.
You’d be surprised. I got an absolute boat anchor of a 2019 MacBook when I started a job in early 2022. I requested a new one in late 2023 because company policy is to refresh laptops every 4 years - whoever was on the other end of my support ticket interpreted the policy as four years from issuance and denied me.
Not everyone is at $CORP. I upgraded from M1 to M4 and probably won't upgrade until the gap is worth it (M7?). Besides the memory increase I barely notice the improved cpu/gpu speed.
Sounds extremely wasteful to me. What's a new machine going to offer than a 2 year old machine doesn't?
Things were painful in the Intel era but I’m on M1 Mac and I’d have a really hard time justifying a request for an upgrade. I absolutely detested my old Intel MacBook (touchbar era) and couldn’t wait to get rid of it.
I run bloated slow electron apps and chrome all day, generally with profligate usage patterns, and things hardly ever slow down even with corporate antimalware. Sometimes I forget about having left Windows VMs running in the background.
Anyway, why would my company spend $2500+ every two years to turn instant into instant?
This seems great tech but the obvious obvious LLM slop writing is just so incredibly off-putting. We read LLM slop everyday ourselves, but now we have to read it everywhere else too. Is this stuff so hard to just write oneself ??
I just encountered the `com.apple.private.virtualization` entitlement limitation just last night, wanting to use VZVirtualMachine private AccessorEndpoint api. There's lot of useful stuff hidden in Apple's Private API space.
Great write up! I enjoy seeing others working in the same problem space.
Great article!
nice