convert-to-apple-container

To switch from Docker to Apple Container for macOS-native isolation, apply the runtime changes via the Skill engine, which replaces the existing runtime while preserving external interfaces. It enforces directory-based mounts and drops privileges during deployment.

Apple Container isolation provides macOS-native runtime security by integrating the Apple Container API. It shadows host secrets directly inside the container entrypoint and drops privileges to improve security without altering existing workflows.

Yes, the Apple Container runtime works with existing interfaces by minimizing changes to the container runner and Skill engine workflow. It applies directory-based mounts to ensure compatibility during macOS deployments and development setups.

Dropping privileges when running Apple Container in a macOS environment improves security by reducing root-level access. The runtime shadows host secrets inside the container entrypoint and applies privilege dropping while maintaining native isolation.

The Apple Container runtime enforces directory-based mounts to align with macOS-native isolation requirements. Users must ensure their host paths and secrets conform to this directory-based structure, as other mount types are not supported by this configuration.