I Replaced Linux Container Cells with macOS Users

✨ GPT-5.6 Sol’s Summary

A record of dropping the plan built around a Linux VM and per-user Containers, then redefining the execution unit as one macOS user and one native OpenClaw environment per employee.

I overturned the basic structure in a day

Yesterday, I actually connected a coordinator and workers. I experimented with splitting the output of several AIs across Worktrees, Branches, and commits, then bringing it all back together.

Alongside that work, I was also building the execution environment for AI Orchestration. Until the 14th, the basic structure looked like this.

Mac mini
→ one Colima Linux VM
→ one OpenClaw Cell Container per employee

Building a shared Image and separating the Network and Volume for each employee looked convenient for deployment and reproducibility. I had confirmed the official OpenClaw Linux arm64 Image and created contracts for the child Image and Cell Network. The plan to isolate each employee’s environment in a Container had already become quite concrete.

Then, on the 15th, I removed that structure from the default plan.

I was not trying to build a Container service

When I wrote down the purpose of AI Orchestration again, I saw where the structure had gone off course.

What I wanted was an environment where employees could state only their goal in WebChat, and their personal AI would break down the necessary work, choose tools, and carry it through to completion. It had to do more than create code and documents. It needed to control Mac apps, launch Xcode and Simulator, and leave real results under the user’s Workspace and Git identity.

The moment I tried to force macOS features through a Linux Container, the structure became strange. I would need a separate runner outside the Container, then stitch permissions and state back together, and somehow pass in the user’s Keychain and GUI Session. The layer I had introduced for isolation kept forcing me to build detours around the very capabilities I needed.

OpenClaw was not a simple stateless worker either. It was closer to a personal environment containing one user’s Gateway, Profile, Session, Memory, OAuth, and execution state. If so, defining a Cell as one Container may have been wrong from the start.

On the 15th, I redefined what a Cell meant.

one employee
= one macOS user
= one independent OpenClaw Gateway
= one set of UID, HOME, and Keychain
= one set of ChatGPT OAuth and CODEX_HOME
= one set of Workspace, Git identity, Session, and Memory

The new structure created an independent macOS user for each employee on one Mac mini and ran a complete OpenClaw Gateway natively inside each account.

I did not erase Linux and Containers as a failure

Changing direction did not mean I wanted to treat everything built through the 14th as a failure.

The Container experiments had produced real findings. Evidence about the official Image, non-root execution, a read-only root, Network separation, Volume and credential boundaries, Image provenance, and restarts still had value.

They simply did not define the final Cell.

I moved the Linux VM and Containers out of the default Pilot environment and kept them as sandbox candidates only for particular work that truly required isolation. Native macOS became the default, and a Container became a tool to use after its need had been demonstrated.

That difference mattered. If I kept pushing the Container structure simply because I had already spent so much time on it, the product would end up being dragged around by its execution environment. The amount already implemented did not justify the choice.

Splitting macOS users did not finish the isolation either

The native structure looked simpler, but it created more things to verify.

• Is the employee who logged in the same person as the macOS user actually running the work?
• Are that user’s Gateway, OAuth, Workspace, and Git author tied together correctly?
• If one user’s authentication fails, can the system ever fall back to another user’s authentication?
• Is access to another user’s HOME, Keychain, Port, and Workspace blocked?
• After fast user switching and a reboot, does each Gateway recover with its own state?

So I did not stop after changing the topology in the documentation. I created a new native macOS Cell contract and Acceptance criteria, and left every item without real Runtime evidence as NOT_READY.

A passing test fixture could not prove that two real users were isolated either. I separated hashes of external input files from evidence of actual probe execution, and kept closing loopholes that could bypass the checks with values impersonating another user, symlinks, or macOS case and Unicode path aliases.

After changing the topology at noon, I spent the entire afternoon making commits that closed “ways to lie about passing.” More code went into making the new structure’s passing conditions honest than into changing the structure itself.

I separated shared Workflows from personal state too

Even if every employee had a completely separate environment, company-managed shared Workflows still needed to be deployed at the same version. On the other hand, updating a shared Workflow could not alter personal OAuth, Memory, or Workspaces.

On the afternoon of the 15th, I pinned Workflow Releases by version and content hash, then created an admission contract that allowed only validated releases to be selected. Selecting a new release had to change atomically, running work had to remain pinned to the release chosen at startup, and neither rollback nor cleanup could remove a release still in use.

Here too, I did not record a deployment to the real Mac’s shared installation location just because I had created the Source and tests. A Runtime that had not been installed remained NOT_READY to the end.

The product came before the execution environment

On the 14th, I thought about how to divide work among several AIs and integrate their results. On the 15th, I reconsidered what kind of Cell those AIs would actually live in.

It was not painless to change direction to native macOS after preparing so much of the Container structure. But if the product needed to include Mac apps, Xcode, per-user OAuth, and Memory, the execution environment had to follow that purpose.

A Cell was not one isolated process. It was a complete personal AI environment where one person worked with their own authentication, memory, workspace, and tools.

The 15th was the day I chose the macOS user itself as the Cell boundary instead of stacking more Containers on top of a Linux VM.