Add container (apple/container) as a supported macOS-native container runtime for always-on

[donpruebadev]

> Problem

The always-on/ self-hosting setup currently documents Docker 24+ as the only container runtime prerequisite. On macOS, this effectively means Docker Desktop — which comes with several pain points for developers and users:

• Requires a commercial license for organizations with 250+ employees or $10M+ revenue
• Runs all containers inside a single shared Linux VM, creating a noisy-neighbor problem
• Significant resource overhead (RAM/CPU) even for lightweight workloads like the engine
• All host filesystems must be pre-mounted into the shared VM

> Proposal

Add apple/container (github.com/apple/container (https://github.com/apple/container)) — Apple's native macOS container runtime — as a documented, tested alternative to Docker for running the Houston engine via always-on/.
Why it fits
container is fully OCI-compatible and supports docker compose (backed by BuildKit). This means:
The exact same docker-compose.yml works unmodified:
container compose up -d
Concrete changes

1. always-on/README.md — Add container as a listed runtime in the "Self-hosting" prerequisites table alongside Docker 24+
2. always-on/README.md — Add a 3-line macOS quick-start section showing brew install container && container compose up -d
3. CONTRIBUTING.md — Mention container in the developer setup section for macOS contributors who need to test the always-on stack locally without Docker Desktop
   No code changes needed — the existing Dockerfile and docker-compose.yml are already compatible.
   Why container over Docker Desktop on macOS

	Docker Desktop	apple/container
Isolation	Shared Linux VM for all containers	Per-container lightweight VM (Virtualization.framework)
Licensing	Commercial license required for mid/large orgs	Apache 2.0 — free forever, no org size limits
Resource footprint	Single VM sized for peak usage	Per-container resources — only what each needs
Startup time	~30s+ (shared VM boot)	Comparable or faster (per-container micro-VMs)
Security model	Kernel exploit = all containers compromised	Kernel exploit = one container compromised
Host data exposure	All mounted directories visible to all containers	Only explicitly mounted -v paths are exposed
Maturity	Decades	v1.0.0 (June 2026), 33K+ GitHub stars, maintained by Apple
Native macOS integration	HyperKit (legacy) / Apple Virtualization (recent)	Built entirely on Virtualization.framework + vmnet from day one

Bottom line: for macOS users running Houston in always-on mode — or macOS contributors testing the stack locally — container provides stronger isolation, zero licensing friction, and a lighter footprint with the same docker compose workflow they already know.

houston/always-on/README.md

Line 1 in b2d6dd0

# Houston Always On