Research macOS runner isolation options for concurrent workloads

[Copilot]

Researched lightweight isolation technologies for running multiple concurrent GitHub Actions runners on a single macOS machine without each consuming full VM resources.

Key Findings

No perfect solution exists. Trade-offs between isolation strength, memory overhead, and concurrency:

• Tart VMs: Strongest isolation, macOS-native support, but Apple licensing limits to 2 concurrent macOS VMs per host @ 8-12GB each
• Docker: Current implementation works for Linux workflows only, 2-3GB base VM + 2GB per container
• Process sandboxing: 10-15+ concurrent runners @ 1-1.5GB each, weak isolation (shared kernel), suitable only for trusted code
• Apple Containerization: Future option (macOS 26+), lightweight Linux VMs with VM-level isolation per container

Documentation Added

Created docs/macos-runner-isolation-options.md covering:

• Comparative analysis of 6 isolation technologies (Docker, Tart, Apple Containerization, Sandbox API, user accounts, chroot)
• Memory planning and capacity calculations per approach
• Phased implementation recommendations
• Use case mapping (iOS/macOS builds → Tart, Linux CI → Docker, high-concurrency trusted → sandboxed native)

Recommended Strategy

Support multiple isolation types based on workload requirements:

1. Maintain Docker for Linux workflows
2. Add Tart support for macOS-native builds (document 2-VM limit)
3. Add sandboxed native runner option for high-concurrency trusted workloads
4. Monitor Apple Containerization for future adoption

Memory example for Mac mini M2 Pro (32GB):

• Docker: 6-8 concurrent Linux runners
• Tart: 2 macOS + 4 Docker Linux runners
• Sandboxed: 10-15 concurrent runners (low isolation)

Original prompt

research options for isolation of runners on Mac os. I need something lightweight enough that a single machine can serve several concurrent runners without each one in a VM eating up system memory but also without them all blessing into each other.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.