Morbstack vs. the field.
Status: one-time comparison, written 2026-08-02 against Morbstack git HEAD ba9afc6. Not CI-enforced, not updated automatically — treat prices, versions, and vendor claims below as accurate as of the access date on each citation and nothing later. Full source: docs/comparison.md.
1. Purpose, method, and an honesty statement
This page compares Morbstack against six things developers actually reach for on macOS: Docker Desktop, OrbStack, Podman Desktop (+ podman machine), Rancher Desktop, Colima (+ Lima), and Apple's open-source container project. It exists to answer, as precisely as the evidence allows, "how does Morbstack actually differ, and where is it actually worse."
Evidence tiers, and what each is worth
- Morbstack's own numbers come from exactly four places in this repository — parity.md, roadmap.md, compat.md, and amd64.md/k8s.md — and nowhere else. No number about Morbstack below was generated for this page. Where a figure is a target rather than a measurement, it is labeled as such every time it appears.
- Local, first-hand inspection covers Docker Desktop, which was installed on the machine this document was written on (bundle timestamps dated December 2024 — an older installed copy, not necessarily the current shipping release). It was inspected read-only: bundle contents,
codesign,otool,nm, and a snapshot of already-running processes, nothing started, stopped, or reconfigured. OrbStack, Podman, Rancher Desktop, Colima, and Apple'scontainerare not installed on that machine — every claim about them below is web-sourced, not independently reproduced, and marked accordingly. - Vendor and third-party claims from the web are quoted and attributed, never presented as Morbstack-verified fact.
- Anywhere research was inconclusive, this document says "could not verify" rather than filling the gap from memory.
Morbstack is pre-alpha, unreleased, and has never been used by anyone outside this repository's own test passes. It has one maintainer, no security audit, no notarized installer, and — per its own parity audit — 6 outright failures and 3 behavioral gaps out of 29 real drop-in-compatibility checks run against a live build. Every competitor discussed here has shipped, has real users, and in most cases has been hardened by exactly the kind of adversarial and edge-case usage Morbstack has not yet received. Where this page argues Morbstack has a structural advantage (license, VM topology, native UI), that advantage is real and evidenced below — but it is an advantage of design, not of maturity, and §6 exists specifically to keep those two things from blurring together.
2. Architecture
| Product | Hypervisor | VM topology | Container runtime | Filesystem sharing | Networking | Host UI | x86 emulation |
|---|---|---|---|---|---|---|---|
| Morbstack | Virtualization.framework |
one shared VM for all containers | unmodified upstream dockerd + containerd (static 29.7.1); published ports via a Morbstack userland proxy through dockerd's stock --userland-proxy-path hook |
VirtioFS, same-absolute-path bind mounts | outbound NAT only (M0); no morbnet/DNS/host-routable IPs yet |
native SwiftUI, zero web views (planned; not part of M0) | Rosetta binfmt (working); qemu fallback (inert, no binary shipped) |
| Docker Desktop | Virtualization.framework — confirmed by local inspection; historically HyperKit on older releases |
one shared LinuxKit VM | Moby dockerd inside the VM (Docker CLI 27.4.0 on the inspected copy) |
VirtioFS (com.docker.osxfs binary present) |
own virtual network stack + vpnkit-descended NAT, host.docker.internal DNS |
Electron (com.electron.dockerdesktop bundle identifier, confirmed locally) |
Rosetta (VZLinuxRosettaDirectoryShare symbols present) with a bundled qemu-system-aarch64/qemu-img as a secondary path |
| OrbStack | undisclosed, described only as "a lightweight Linux virtual machine with a shared kernel...similar to WSL 2" — closed source, cannot verify independently (OrbStack architecture docs) | one shared VM for all containers and "machines" | runs "the Docker engine" per OrbStack's own docs; whether dockerd itself is patched is unverifiable from outside (closed source) |
"VirtioFS with custom dynamic caching and optimizations" (OrbStack docs) | custom userspace network stack with NAT and a custom DNS server (OrbStack docs) | closed-source native app (not Electron, per OrbStack's own marketing; not independently verified here) | Rosetta ("boots an ARM64 Linux kernel, but paired with an x86-64 userspace filesystem, using Rosetta 2" — OrbStack docs) |
| Podman Desktop + podman machine | Apple Virtualization Framework (applehv) is the macOS default as of Podman 5.x, replacing QEMU (Podman machine providers) |
one shared VM (the "machine") per configured machine | podman/libpod + crun/runc — not dockerd; Docker CLI/API compatibility is via podman-docker/socket emulation, not the real Docker Engine |
9p/virtiofs-backed volume mounts | rootless slirp4netns-derived networking by default |
could not fully verify Podman Desktop's UI toolkit from primary sources — treat as unconfirmed | Rosetta supported on Apple silicon machines (Podman Desktop docs) |
| Rancher Desktop | Lima-managed VM, using QEMU or vz depending on Lima's configuration |
one shared VM | user's choice: Moby dockerd or containerd via nerdctl (Rancher Desktop docs) |
Lima's own 9p/virtiofs mount, /Users-rooted like Colima |
Lima's user-mode networking | Electron, per third-party technical summaries — not independently re-verified in this pass | not confirmed to have a first-class Rosetta/x86 story distinct from Lima's |
| Colima + Lima | user-selectable: QEMU (default) or vz (recommended on macOS 13+); also krunkit for GPU-accelerated AI workloads (Colima FAQ) |
one shared VM ("the" Colima instance) | user's choice via --runtime: docker (default) or containerd |
Lima's 9p/virtiofs mount, rooted at /Users/$USER by default |
Lima's user-mode networking | CLI only — no GUI at all. | not a first-class feature; QEMU can software-emulate x86 at a large performance cost |
Apple container |
Virtualization.framework via vmnet/XPC helpers |
one dedicated micro-VM per container — the architectural outlier (Apple's own docs) | Apple's own Swift containerization runtime, OCI-compliant, not dockerd and not Docker-API-compatible |
selective per-container host-path mounts, not a shared always-on share set | container-network-vmnet, an XPC helper managing per-VM networking |
native, CLI only (no bundled GUI) | none — Apple silicon only, no x86 container support of any kind |
Reading this table honestly: Morbstack, Docker Desktop, OrbStack, Podman machine, Rancher Desktop, and Colima all converge on the same basic shape — one shared Linux VM, Virtualization.framework (or Lima's abstraction over it) as the hypervisor, VirtioFS-family bind mounts. Morbstack's specific bet inside that shape is being the only one of the six with zero modification to the actual container engine verified end-to-end (parity.md #1-#4, #12-#14) — Podman and Apple's container aren't running Docker's engine at all, and OrbStack's engine internals are unverifiable because the product is closed source. Apple's container is architecturally the odd one out entirely: per-container micro-VMs trade away exactly the shared-kernel properties (Compose networks, --network container:x, shared page cache) that architecture.md explains Morbstack deliberately kept a single shared VM to preserve.
Local inspection: what Docker Desktop actually is on this Mac
Commands run, 2026-08-02, entirely read-only, Docker Desktop's own state never touched.
$ du -sh /Applications/Docker.app 1.7G /Applications/Docker.app $ du -sh /Applications/Docker.app/Contents/*/ 1.1G /Applications/Docker.app/Contents/Resources/ 624M /Applications/Docker.app/Contents/MacOS/ 7.3M /Applications/Docker.app/Contents/Library/ $ du -sh "/Applications/Docker.app/Contents/MacOS/Docker Desktop.app" 261M .../Docker Desktop.app # the Electron UI shell alone $ du -sh /Applications/Docker.app/Contents/Resources/*/ 558M .../linuxkit/ # boot.img + kernel — the guest VM image 368M .../cli-plugins/ # buildx, compose, etc., bundled 161M .../bin/ # docker CLI, kubectl, hub-tool, credential helpers
$ codesign -dv --entitlements - "/Applications/Docker.app/Contents/MacOS/Docker Desktop.app" Identifier=com.electron.dockerdesktop ... com.apple.security.cs.allow-jit: true com.apple.security.cs.allow-unsigned-executable-memory: true
The com.electron.dockerdesktop bundle identifier, plus an on-disk Electron Framework.framework and @bugsnag/plugin-electron-app inside app.asar.unpacked, confirm the management UI is Electron, not native.
$ codesign -dv --entitlements - /Applications/Docker.app/Contents/MacOS/com.docker.backend com.apple.security.hypervisor: true com.apple.security.virtualization: true $ otool -L /Applications/Docker.app/Contents/MacOS/com.docker.backend | grep -i -E "virtualization|hypervisor" /System/Library/Frameworks/Virtualization.framework/Versions/A/Virtualization ... /System/Library/Frameworks/Hypervisor.framework/Versions/A/Hypervisor ... $ nm -g /Applications/Docker.app/Contents/MacOS/com.docker.virtualization | grep -c VZ 307
This settles a question worth settling with evidence rather than reputation: on this machine, Docker Desktop's backend links and uses Apple's Virtualization.framework and Hypervisor.framework — the same family of API Morbstack uses. The 307 VZ-prefixed symbols include VZLinuxRosettaDirectoryShare, confirming Rosetta support at the framework level, consistent with the bundled qemu-system-aarch64/qemu-img also present. Docker Desktop was running at inspection time: 8 docker/com.docker.* processes, combined RSS 89.3 MB — reported here only as an observed data point, not a performance claim about either product. Notably, the running process was launched with --analytics-enabled=true — telemetry is on by default on this installed copy.
3. Licensing and cost
This is Morbstack's most precise, least hype-dependent differentiator, so it gets stated exactly rather than rhetorically.
| Product | License | Cost to use | Commercial-use trigger |
|---|---|---|---|
| Morbstack | Apache-2.0 (LICENSE, NOTICE) | Free, always, for everyone, at any company size | none — Apache-2.0 has no commercial-use clause |
| Docker Desktop | Proprietary/closed source | Free only for non-commercial open source, or a commercial undertaking with fewer than 250 employees AND less than US $10,000,000 annual revenue. Above that: Pro ~$9/user/mo, Team ~$15/user/mo, Business $24/user/mo (annual billing) | Exceeding the 250-employee or $10M-revenue threshold — Docker Subscription Service Agreement §4.2 |
| OrbStack | Proprietary/closed source | Free for genuinely personal, non-commercial use and non-commercial student use. Commercial: Pro $8/user/mo billed annually, per-user with up to 5 devices/user; Enterprise quote-only | Professional/commercial/non-profit/government use, or >$10,000/yr generated in connection with work using OrbStack — OrbStack licensing docs |
| Podman Desktop + podman machine | Apache-2.0, fully open source | Free, always, for everyone | none |
| Rancher Desktop | Apache-2.0, fully open source (Moby, containerd, k3s) | Free, always, for everyone | none |
| Colima + Lima | MIT, fully open source | Free, always, for everyone | none |
Apple container | Apache-2.0, fully open source | Free, always, for everyone | none |
Morbstack, Podman Desktop, Rancher Desktop, Colima, and Apple's container are all genuinely free-forever open source with no commercial trigger — on licensing terms alone, Morbstack is tied with four established projects, not uniquely differentiated from all of them. Its real differentiation is narrower: it is the only one of the six simultaneously (a) free with no commercial-use asterisk, (b) built around unmodified, off-the-shelf upstream dockerd/containerd — no downstream engine patch, published ports made reachable by a small Morbstack userland proxy that dockerd execs through its own --userland-proxy-path flag — rather than a different or closed engine, and (c) aimed at drop-in Docker Desktop replacement rather than a CLI-only tool or a different API surface entirely. Whether it achieves that combination today is a feature-completeness and quality question, covered honestly in §5 and §6.
4. Feature matrix
Morbstack rows are marked directly from the 29-check parity.md audit and the compatibility contract — PASS / PARTIAL / FAIL where parity.md tested it explicitly, not yet built where roadmap.md places it at M1 or later, and not planned where compat.md states it as an explicit non-goal. Competitor cells are sourced from vendor documentation, cited inline; where a claim could not be confirmed it says so.
| Feature | Morbstack | Docker Desktop | OrbStack | Podman Desktop | Rancher Desktop | Colima | Apple container |
|---|---|---|---|---|---|---|---|
docker CLI compatibility | PASS unmodified upstream CLI against the relayed Engine API | native | full, unmodified against relayed engine | Docker-CLI-compatible shim, not the real API | full via bundled Moby, or nerdctl | full via bundled Docker, or nerdctl | no — separate CLI |
| Compose | PASS, manual one-time plugin install as of M0; auto-bundled targeted for M1 | native | supported | via podman compose/docker-compose shim | supported | supported | not supported |
| BuildKit / buildx | FAIL out of the box today — guest BuildKit fully functional once a client binary is placed, but none ships | native | supported | supported | supported | supported | not applicable — different build model |
| Kubernetes | working — morb k8s, single-node k3s+cri-dockerd, measured 8.3s cold enable | native (built-in toggle) | supported (built-in k3s) | supported (kind/other) | native — original purpose | supported via --kubernetes | not built in |
| x86-64 emulation | PASS for what's implemented — Rosetta binfmt working, byte-identical; qemu fallback written but inert | Rosetta + bundled qemu fallback | Rosetta-based | Rosetta supported | not confirmed | QEMU software emulation; no confirmed Rosetta | none at all |
| Bind-mount performance | VirtioFS tier 1; no published benchmark yet | VirtioFS (confirmed locally) | "custom dynamic caching," not independently verified | 9p/virtiofs, no independent benchmark | Lima's 9p/virtiofs | Lima's 9p/virtiofs | selective per-VM mounts, different model |
| File-watching / inotify | FAIL, documented — zero inotify events; polling is the working mitigation | works (FSEvents bridge) | claimed to work, not independently verified | not confirmed | not confirmed | not confirmed | not confirmed either way |
host.docker.internal | FAIL — no DNS/hosts entry at all today | native, this is where the name comes from | supported | supported | not a default; needs manual host networking | not applicable, different model | not applicable |
| Zero-config socket discovery | FAIL — requires manual DOCKER_HOST/context setup | native, self-configuring | supported | requires podman machine context setup | requires context/socket setup | requires manual DOCKER_HOST | different CLI, no Docker-socket concept |
| GUI | not part of M0 — no host app in this repo yet; CLI only today | Electron, confirmed locally | native app (closed source, vendor claim) | Electron-family app | Electron-based (third-party summaries) | none — CLI only | CLI only, no bundled GUI |
| CLI | morb — start/stop/status/suspend/resume/shares/rosetta/doctor/k8s/reset-disk | docker (bundled) + Desktop's own CLI surface | orb/orbctl | podman | rdctl + bundled nerdctl/docker | colima + bundled docker/nerdctl | container |
| Telemetry | none observed in the docs; not yet independently audited at scale | on by default on the inspected copy | none today; privacy policy reserves the right to add it | present, anonymized, enterprise opt-out | present, admin-configurable | could not verify | could not verify |
| Offline use | works — no network dependency once assets are fetched; offline hello-world load path tested | requires periodic license/account checks above free tier | requires periodic license check for Pro | fully offline-capable | fully offline-capable | fully offline-capable | fully offline-capable |
| Extensions / plugins | not planned as Docker Desktop Extensions compatibility; native plugin SDK is post-1.0 | native Extensions marketplace (web-view based) | no extension marketplace | extension/plugin system exists | extension system exists | none — CLI tool | none |
| GPU | not supported, explicit non-goal | exists on some platforms (Windows/WSL primarily) | not confirmed | not confirmed for macOS | documented gaps even on best-supported platform | krunkit VM type for GPU workloads | not applicable |
| Windows containers | never supported, explicit non-goal | supported (Windows host only) | not applicable | not applicable on macOS | not applicable on macOS | not applicable on macOS | not applicable |
5. Performance: claims vs. measured reality
Kept in three explicitly separate buckets, because blurring them is the single easiest way to lose a skeptical reader's trust.
(a) Vendor claims — quoted and attributed, not verified here
- OrbStack states, on its own comparison page, "fast startup," "low CPU usage," "low power usage," and "memory on demand" relative to Docker Desktop — presented as a checkmark comparison, not first-party numbers on that page itself (OrbStack vs. Docker Desktop). Third-party writeups report ~2s OrbStack startup vs. 20-30s for Docker Desktop, and roughly 200MB vs. 4GB idle memory — third-party numbers, not independently reproduced here (sliplane.io comparison).
- Apple's
containerclaims its per-container VMs achieve "sub-second startup times through careful kernel optimization," per third-party technical summaries — could not independently verify the underlying Apple source. - No performance claims from Podman Desktop, Rancher Desktop, or Colima were found stated as vendor marketing in this research pass.
(b) Morbstack's own measured numbers — with conditions, not marketing
Real, timed, end-to-end runs on one development machine, Apple silicon — from architecture.md, parity.md, amd64.md, and k8s.md — not the CI-gated morb bench numbers for M2+.
- Cold, socket-activated
docker run --rm hello-world: 2.09s wall clock, guest MRB0 control socket ready 1.69-2.01s after VM bring-up. morb stop: 0.25-0.40s. A subsequent cold boot to a responsivedocker ps: 1.69-1.73s, repeatable with zero ERROR/WARN log lines.- First-boot disk formatting (
mkfs.ext4): 22ms; mount 56ms after that; a realalpineregistry pull: 1.95s. - Idle-auto-suspend cycle: guest powered off in 384ms after the idle timer fired; next socket-activated command woke a fresh VM in 2.13s. This is a graceful stop, not a true suspend-to-zero snapshot/restore —
Virtualization.framework'srestoreMachineStateFromdoes not work for Morbstack's direct-kernel-boot guest on this development host, a documented API limitation, not a Morbstack bug. - amd64-via-Rosetta slowdown, same guest and session: no measurable container-start penalty; general-purpose compute ~1.8-2x slower; SHA-256 at 16KB blocks ~5.1x slower; RSA-2048 sign ~3.8x slower, verify ~2.3x slower.
- Kubernetes (
morb k8s): cold enable-to-Ready 8.3s with a full payload transfer; ~4s on a subsequent enable with the payload already present. Idle cost with the cluster on and nothing deployed: guest memory rose from ~137MB to ~617MB, host VM-process CPU rose from ~0.7% to ~20-23%.
(c) Morbstack's published targets — not yet measured, do not read as results
docs/roadmap.md's public performance target table commits Morbstack to publishing accurate status against these from M2 onward via morb bench — goals the project is answerable to, explicitly not claims about the current build.
| Target | Goal |
|---|---|
| Cold boot | ≤ 2.0s |
| Resume (from suspend-to-zero) | ≤ 500ms |
| Idle host CPU | ≤ 0.1% |
| Idle wakeups | < 20/s |
Host RSS (morbstackd, idle) | ≤ 120MB |
| Guest memory floor | ≤ 256MB |
git status on a bind-mounted Linux tree, vs. native | ≤ 2x native |
npm install on a bind-mounted project, vs. native | ≤ 1.5x native |
Note the overlap and the gap between (b) and (c): the cold boot measurements in (b) (2.09s, 1.69-1.73s repeat boots) already land close to the ≤2.0s target in (c) — but "resume ≤500ms" is a target with no real suspend-to-zero implementation to measure yet, and idle CPU/wakeups/RSS have no reported measurement at all as of this writing. Treat the closeness of the boot numbers as encouraging, not as evidence the harder targets are anywhere near proven.
6. Where Morbstack is worse — the honest section
This section is deliberately at least as detailed as §§2-5 combined are flattering. Everything here is either a documented FAIL/PARTIAL from the real 29-check audit, an explicit not yet built item from the roadmap, an explicit non-goal, or a structural maturity gap that is simply true of a one-maintainer, pre-alpha project regardless of what its docs say.
Things that are broken, absent, or still lack release-grade live evidence
- The bundled Docker client path has implementation, not clean-machine release proof. The development app bundle contains signed upstream
docker,docker compose, anddocker buildx. Its explicit first-run transaction places only Morbstack-owned links on PATH, registers a context, and creates the conventional per-user socket only when it is safely absent. That path still needs a clean-profile, real-VM acceptance run before it can be called a drop-in installation guarantee. host.docker.internalandgateway.docker.internalhave implementation, pending a fresh VM pass. The guest split-DNS service resolves both aliases to the VM NAT gateway, but the historical failure remains in the parity audit until a fresh run proves both resolution and a real connection to a Mac-side listener.- Zero-config discovery is deliberately consented and still needs clean-profile evidence. After reviewed setup, Morbstack creates
~/.docker/run/docker.sockonly when it is safe to own and registers its Docker context without overwriting another current context. Testcontainers, IDEs, anddocker-pyneed a fresh clean-machine acceptance pass before this is promoted from implementation to release claim. - Buildx is bundled and wired by reviewed setup, pending clean-profile evidence. The app packages the unmodified upstream Buildx plugin and the first-run transaction links it in Docker's standard plugin location. The native Builds workflow invokes that bundled tool explicitly; a clean-machine BuildKit run is still a release gate.
- The historical bare-
/tmpbind-mount corruption is repaired in source, pending VM revalidation. The default/private/tmpshare aliases/tmpin the guest, and unsafe unresolved paths are rejected before Docker receives a misleading mount request. Custom shares can still make/tmpunavailable, so this must remain an explicit error rather than a false success. - No inotify across VirtioFS bind mounts, confirmed directly. A host-side file edit is correct the instant it's read, but the change-notification event a hot-reload watcher depends on never crosses the boundary — confirmed with a live
nodemontest that produced zero restarts after an 8-second wait. The working mitigation (polling) exists and was verified, but it is a workaround, not a fix. - Fixed, non-negotiable bind-mount ownership. Every file inside a VirtioFS bind mount shows up as
root:rootin the guest regardless of which host user owns it, and a container-sidechownagainst it is silently accepted and silently discarded. - Published-port handling is intentionally bounded. Fixed loopback TCP ports reserve a real Mac listener before Docker create and activate forwarding only after the exact start success response. Dynamic TCP allocation has a constrained standard-request path; opaque, ranged, non-loopback, and nonstandard request forms do not claim the same synchronous guarantee. VM-stop recovery remains in progress.
- UDP forwarding is real but has a narrower guarantee. The loopback datagram relay preserves request/reply boundaries once Docker reports a concrete port. Dynamic or ranged UDP publishes deliberately do not claim TCP-style pre-start reservation.
- No qemu fallback for amd64, despite the plumbing existing — no static
qemu-x86_64ships, so anything Rosetta cannot translate simply fails with no fallback. - No
*.morb.localDNS, nomorbnet, no host-routable container IPs, no split-DNS. Containers get outbound NAT and nothing else today. - No synced-share filesystem tier. VirtioFS (tier 1) is the only option; the opt-in synced-copy mode does not exist yet.
Things competitors have that Morbstack has chosen never to build
Per the explicit non-goals in docs/compat.md — stated up front so readers don't mistake them for gaps that will eventually close:
- Windows containers — never supported, at any milestone. Docker Desktop on Windows hosts supports this, and it is a real category some users need.
- CUDA/GPU passthrough — not supported, no commitment to add it. Colima has a
krunkitVM type specifically for this; Docker Desktop has GPU support on some platforms. - Docker Desktop Extensions compatibility — explicitly not a target. Docker Desktop, Podman Desktop, and Rancher Desktop all have some form of extension ecosystem today; Morbstack's native (non-web-view) plugin SDK is a post-1.0 idea, not a compatibility shim.
- CRIU (checkpoint/restore) — off, not a target for 1.0 or the 1.x line as currently scoped.
Maturity gaps that are just true, regardless of documentation quality
- Pre-alpha, unreleased, no version number a user could install today. Every other product here has a real release channel; a reader cannot
brew install morbstackright now. - One maintainer. Podman Desktop (Red Hat/CNCF), Rancher Desktop (SUSE), Colima (long-running community), Apple's
container(Apple) all have an organization or sustained community behind them. Morbstack does not yet. - No independent security audit. Explicitly a 1.0 gate, not done yet.
- No notarized, signed release build; no installer. Building from source with Xcode 26+ and a Rust cross-toolchain is the only way to run it today.
- Effectively zero user base outside this repository's own test passes. No production usage, no bug reports from anyone who wasn't already working on the project.
- VM suspend/resume is not actually implemented as suspend/resume.
morb suspenddegrades to a graceful stop plus a cold boot on next use. The public "≤500ms resume" target has nothing behind it yet. - No public compat-matrix CI. Everything in this document about Morbstack's ecosystem compatibility rests on one manual audit pass, not continuous verification.
Anyone reading this page and concluding "Morbstack is strictly better" has not read it carefully enough — that conclusion isn't supported by the project's own documentation, and this section exists so it doesn't need to be argued with.
7. Who should use what
A recommendation section that doesn't send every reader to Morbstack is the only kind worth writing.
- Use Docker Desktop if:
- you need Windows container support, GPU passthrough that's actually documented and supported, Docker Desktop Extensions, or you're inside an organization already paying for it and the $9-24/user/month is a non-issue. It is also, simply, the thing with the largest install base and the least chance of a workflow-specific surprise.
- Use OrbStack if:
- you're under the $10k/yr or personal-use threshold, want a closed-source but reportedly fast and well-integrated native experience today, and don't need the source to be inspectable or the product free at any company size.
- Use Podman Desktop + podman machine if:
- you specifically want a daemonless/rootless model, need Kubernetes-native tooling, or your organization has policy reasons to avoid a Docker-Engine-shaped daemon — accepting you're not running the actual Docker Engine, only something CLI-compatible with it.
- Use Rancher Desktop if:
- Kubernetes is the primary workload, not an afterthought, and you want first-class
containerd/nerdctlalongside Moby with a choice between them. - Use Colima (+ Lima) if:
- you don't want or need a GUI at all, you're comfortable at the command line, and you want the lightest possible free and open-source Docker-API-compatible VM with maximum backend flexibility.
- Use Apple's
containerif: - per-container VM-grade isolation matters more to you than Docker ecosystem compatibility, you're on macOS 26 with Apple silicon, and you're comfortable with a CLI that doesn't speak the Docker API and has no Compose story today.
- Use Morbstack if:
- you want a free-forever, Apache-2.0, source-visible Docker Desktop replacement built around an unmodified upstream Docker Engine (published ports served through dockerd's own stock
--userland-proxy-pathhook, not an engine patch) — and you are comfortable being an early adopter of pre-alpha software with one maintainer, no security audit, missinghost.docker.internal/zero-config discovery/buildx-out-of-the-box, and the specific/tmpbind-mount and inotify gotchas documented above. If any of those gaps would break your actual workflow today, use one of the other six until Morbstack's roadmap closes them.
8. Sources
All accessed 2026-08-02 unless noted.
Morbstack (this repository, git HEAD ba9afc6)
- docs/parity.md — the 29-check drop-in parity audit
- docs/roadmap.md — milestones and the public performance target table
- docs/compat.md — the compatibility contract and explicit non-goals
- docs/architecture.md — system design and VM-lifecycle measurements
- docs/amd64.md — Rosetta translation, measured slowdowns
- docs/k8s.md —
morb k8s, measured enable/idle-cost numbers - docs/sharing.md — VirtioFS bind mounts, ownership model, inotify gap
- README.md — status, what works, what doesn't yet
Local, first-hand inspection (read-only, 2026-08-02)
/Applications/Docker.app via du, codesign -dv --entitlements -, otool -L, nm -g, ps aux; ls /Applications, which colima podman nerdctl rdctl container, brew list --cask for competitor presence.
Docker Desktop / Docker Inc.
- Docker Subscription Service Agreement — free-use thresholds (§4.2)
- Docker pricing — plan prices
- Docker Desktop release notes — current version context (4.83.0, July 20 2026)
OrbStack
- Licensing
- Architecture
- Pricing
- Terms of Service
- Privacy policy
- OrbStack vs. Docker Desktop
- sliplane.io — OrbStack vs Docker Desktop in 2026 (third-party benchmark summary, not independently reproduced)
Podman / Podman Desktop
- podman-desktop LICENSE
- Podman machine providers (DeepWiki summary)
- Podman Desktop — Rosetta support
- podman-desktop/telemetry
Rancher Desktop
- Rancher Desktop LICENSE
- Rancher Desktop docs
- GPU/CUDA limitation discussion
- Rancher (Manager) telemetry FAQ — concerns Rancher Manager, not confirmed identical to Rancher Desktop's own telemetry