- Published on
Docker has always used microVMs (well since 2016)
- Authors
- Name
- DeepHorus
Docker has revealed that Docker Desktop has relied on microVM technology since 2016, challenging the widespread assumption that microVMs are a novel alternative to traditional Linux containers. MicroVMs, which run workloads on a stripped-down Linux kernel through a minimalist virtual machine monitor such as Firecracker, announced at AWS re:Invent 2018, are often presented as more secure than standard Docker containers. According to Docker, the company quietly pioneered this approach years before the term became fashionable in cloud-native circles.
The story begins in 2015, when Docker's state of the art was Docker Toolbox, a solution built on VirtualBox. While VirtualBox is a capable product, Docker engineers felt it carried a GUI and update process far heavier than the platform needed. The team wanted Docker to feel like a native application on Mac and Windows rather than a bundle of bundled components, prompting a rethink of the underlying architecture.
Using Mirage Unikernel libraries, Docker engineers began constructing a library VMM that could be embedded directly inside the Docker application. This virtual machine monitor was designed to be single-purpose, minimal, secure and fast. The first iteration was named hyperkit, and its most recent successor is called Docker VMM, marking roughly a decade of continuous development.
The VM kernel and root filesystem were kept equally lean, drawing on the LinuxKit project. The current version has been slimmed down further for greater efficiency, though it remains conceptually the same, comparable to containerd or nerdbox in philosophy. The design goal was always to strip away everything that was not strictly necessary for running containers.
Although the team aimed to link everything into a static, unikernel-like process, technical constraints made it practical to keep one host process per VM. This microVM foundation now underpins both Docker Desktop and the newer Docker Sandboxes product. Docker Sandboxes lets users run coding agents and harnesses securely, with strict isolation and governance enforced at the virtualization layer.
Docker is encouraging developers to see the technology firsthand by installing Docker Sandboxes, referred to as sbx, and running commands such as sbx run claude. The company also pointed readers to A Decade of Docker Containers, published in Communications of the ACM, for a deeper technical history. The disclosure positions Docker as an early adopter of technology that rivals now market as cutting-edge, and suggests the container industry's security conversation has been evolving quietly for years.
