The interesting part is what `--dryrun` prints, because that is the whole security argument in one line. On the author's Mac, `ramalama --dryrun run smollm:135m "hi"` expands to a `docker run` carrying `--security-opt=label=disable --cap-drop=all --security-opt=no-new-privileges --pull always`, then launches `llama-server` from `quay.io/ramalama/ramalama:0.24` [3]. Every Linux capability gets dropped and privilege escalation is disabled. The image itself is pinned by tag. That is a runtime you can hand to whoever signs your images, because it is an image [2]. The weights come from Hugging Face, Ollama, or any OCI registry [2], and `smollm:135m` resolves to `hf://HuggingFaceTB/smollm-135M-instruct-v0.2-Q8_0-GGUF` [5], so the provenance chain is a registry reference rather than a script that curls a file.
Then Metal. A Linux container on Apple Silicon has no path to the Mac's GPU, and `ramalama info` says so plainly: `"Accelerator": "none"` [7]. The escape hatch is `--nocontainer`, which runs the copy of llama.cpp that Homebrew installed alongside RamaLama [8], and Homebrew does install `llama.cpp`, `ggml` and `libomp` as dependencies of the 0.24.0 formula [4]. On the same model and prompt, native served Llama-3.2-1B (Q4_K_M) offloaded 17 of 17 layers to an Apple M4 Pro and generated at about 206 tokens/sec, against about 102 tokens/sec for the containerized CPU run [9][10]. That is a 2.02x ratio [11], measured on one M4 Pro with 48 GB and macOS 26.6, Docker 29.4 via OrbStack, on RamaLama 0.24.0 [1].
For that number to transfer you need the same three things to hold: a CPU-only container path (true for any Docker-on-macOS setup, because the VM boundary is the cause), a model small enough that 4-bit 1B weights fit comfortably in unified memory, and a thread count near the seven llama-server was given [3]. On a Linux box with a passed-through NVIDIA device, the comparison inverts and the container keeps the accelerator. The macOS penalty is a property of the virtualization boundary, not of RamaLama.
So the tradeoff is legible, which is the nicest thing I can say about a tool. Go containerized and you get dropped capabilities and a signable image, at half the tokens per second. Go native and you get full Metal offload, and you are back to trusting a Homebrew-installed binary with your host's privileges. Pick per environment. Sign the image and run it in CI where the accelerator is a real PCI device; use `--nocontainer` on the laptop where the GPU is unreachable anyway.
One caution on the smoke test. The 135M model is a 138 MB download [5] and answered the container question by inventing "2048-bit containers" and a `docker-compose up -v` flag that does not exist [6]. First-run wall clock was 2 minutes 56 seconds, nearly all of it pulling the roughly 1 GB base image and the weights [6][3]. It validates plumbing and nothing else; `llama3.2:1b` at 770 MB answers correctly [6][12].
