Firecracker won't run on a Mac, so Encore rebuilt the Linux image toolchain to match

The expensive half was never the Go binaries. Those cross-compiled with `GOOS=linux GOARCH=amd64`, rsynced to the build host, and Encore decided whether a restart was needed by counting the transferred files ^[10]. Images were the problem, because Firecracker boots a block device while Docker produces layers, and Encore says it could not find an existing tool that turned one into the other ^[11]. So the conversion got written in house: `docker save`, explode the tarball locally, rsync the layers and manifest across, then pipe a shell function into a login shell on the far end and run it there ^[12].

What that function does is a list of jobs a container runtime normally handles. It re-extracted every layer in manifest order and deleted the `.wh..wh..opq` whiteout markers with `find`, because `tar` will not apply them ^[13]. It wrote a hardcoded `/etc/resolv.conf`, since the VM had no DNS otherwise ^[14]. It lifted the image's environment variables out of the Docker config with `jq` ^[15], then called `mksquashfs` to produce something Firecracker could boot ^[16]. There was a cache keyed on the Docker image id to skip the whole path on a match ^[17], which is least useful in the case that matters: the conversion ran whenever anything in the image changed, which was most of the time if you were working on the guest side ^[18].

Underneath that, the dev host ran Firecracker inside a Docker container, which meant `--privileged` plus `/dev/kvm` and `/dev/net/tun` passed through, because the process inside was going to make tap devices and boot VMs of its own ^[20]. Firecracker wants those taps on a host bridge, and a container has no host bridge, so a script created a `docker0` bridge and made `eth0` its member before the build service came up ^[21].

The two spans Encore gives leave no gap between them, so for the entire life of the production hypervisor, nobody worked on the build system on the machine they were typing on ^[23]. Each engineer instead got a personal user on one shared box in a datacentre, reached over Tailscale ^[8]. The shell was eventually rewritten in Go, but the pipeline and the host stayed the same ^[22], which is the tell: this was not a stopgap anybody expected to remove, it was infrastructure.

The fact that carries the story is the declined port. According to Encore, a working proof of concept on Apple's Virtualization.framework existed and the maintainers turned it down ^[4], so the work of making a Mac boot the same artefact landed on the people who needed it. Encore's answer is a single microVM API over two hypervisors, and the entry fee was rebuilding much of the Linux image toolchain to run on macOS ^[6]. Firecracker's minimalism is the point of it: only what a Linux kernel needs ^[2]. The cost of that minimalism does not disappear when a shop runs Macs. It moves into the shop's own repo, where it now has to be maintained twice over.