What ships with it
Three providers, one interface
LinuxKit (default, battle-tested), Apple VZ (in-process on macOS 26+), and the experimental TIM bundle format all share a single Provider interface.
Immutable by design
Read-only base images with explicit writable mounts; isolation through LinuxKit, VZ, or TIM rather than a shared daemon.
Dev environments and model isolation
core/dev uses it for portable, reproducible dev environments; LEM runs each model in its own container.
Encrypted images
dm-crypt volumes under LinuxKit, Sigil encryption under TIM — images stay sealed at rest.
Surface area
Build and boot a container; choose the provider with --provider linuxkit|vz|tim.
Container lifecycle, images, and templates from the CLI; state under ~/.core/.
Embed the Provider interface in Go for build, run, encrypt, and decrypt.
Run a container
LinuxKit is the default (production); Apple VZ runs in-process on macOS 26+; TIM is the experimental homegrown format. State and images live under ~/.core/.