FEX-Emu for Podman Machine: x86_64 emulation on Apple Silicon without Rosetta

[tnk4on]

Summary

I've built a custom Podman Machine OS image that replaces Rosetta/QEMU with FEX-Emu for x86_64 container emulation on Apple Silicon Macs. This is a personal project (not an official Podman product), shared to get community feedback.

Image: quay.io/tnk4on/machine-os:5.8 (Podman 5.x) / quay.io/tnk4on/machine-os:6.0 (Podman 6.x)
Requires libkrun provider.

Repository: https://github.com/tnk4on/podman-fex

Why FEX-Emu?

Running x86_64 containers on Apple Silicon with Podman has long been problematic:

• QEMU user-mode: Slow, frequent SIGSEGV crashes (#28169, #26036, #27320)
• Rosetta 2: Not available with libkrun provider; hangs with many distros (#27210, #27817, #27799)

FEX-Emu is a JIT-based x86_64 emulator officially adopted by Fedora 42. It provides:

• JIT code cache with up to 30x speedup on repeated runs
• Zero overhead for ARM64 containers via OCI hook filtering

Results: 17 Community-Reported Issues Tested

I tested against 17 known x86_64 emulation issues from this repository:

Category	Tests	Passed	Rate
QEMU SIGSEGV	5	5	100%
Hang / Freeze	5	5	100%
Build Failures	5	2	40%
Rosetta Crash	1	0	0%
Behavioral	1	1	100%
Total	17	13	76.5%

Per-issue breakdown (click to expand)

#	Issue	Problem	Original Emulator	FEX Result
1	#28184	MSSQL 2025 AVX crash	Rosetta	❌ AVX unsupported
2	#27078	MSSQL 2022 SIGSEGV	Rosetta	❌ Runtime crash
3	#28169	rustc SIGSEGV	QEMU	✅ Fixed
4	#26036	PyArrow SIGSEGV	QEMU	✅ Fixed
5	#27320	jemalloc SIGSEGV	QEMU	✅ Fixed
6	#27210	Arch Linux hang	Rosetta	✅ Fixed
7	#27817	Fedora shell hang	Rosetta	✅ Fixed
8	#27799	Ubuntu 25.10 hang	Rosetta	✅ Fixed
9	#26881	Go build panic	Rosetta	⏱️ Timeout
10	#25272	Angular ng build hang	QEMU	❌ Go/esbuild SIGSEGV
11	#24647	sudo nosuid in BuildKit	Rosetta	✅ Fixed
12	#26572	Node.js Express freeze	Rosetta	✅ Fixed
13	#26919	Go godump build	Rosetta	❌ Go FIPS crash
14	#23219	gawk SIGSEGV (OpenWrt)	QEMU	✅ Fixed
15	#27601	redis-cluster SIGSEGV	QEMU	✅ Fixed
16	#23269	Next.js build hang (SWC)	Rosetta	✅ Fixed
17	#26656	su -l not login shell	Rosetta	✅ Fixed

13 of 17 resolved (76.5%). All hang/freeze issues (100%) and all QEMU SIGSEGV issues (100%) are fixed. Remaining failures are AVX (unsupported by FEX) and Go 1.24+ runtime compatibility (upstream FEX issue).

See TEST-RESULTS.md for per-issue details with reproduction commands and full terminal output.

Quick Start

1. Set the provider to libkrun (one-time, required):

mkdir -p ~/.config/containers
cat >> ~/.config/containers/containers.conf << 'EOF'
[machine]
provider = "libkrun"
EOF

Verify: podman machine info --format '{{.Host.DefaultMachineProvider}}' → must show libkrun

Note: This image requires the libkrun provider. It does not work with Apple Virtualization.framework (applehv).

2. Create the FEX-Emu machine (use :5.8 for Podman 5.x, :6.0 for Podman 6.x):

# Option A: Clean Install (replaces default machine)
podman machine init \
  --image docker://quay.io/tnk4on/machine-os:5.8 --now

# Option B: Side-by-Side (keeps existing machine)
podman machine init fex \
  --image docker://quay.io/tnk4on/machine-os:5.8 --now

3. Verify:

# x86_64 container
podman run --rm --platform linux/amd64 alpine uname -m
# → x86_64

# ARM64 container (regression check)
podman run --rm --platform linux/arm64 alpine uname -m
# → aarch64

If using Option B (named machine), add --connection fex to all commands.

Performance

Tested on MacBook Pro M1 Max, macOS 26.4.1, Podman 5.8.

Startup Latency — FEX-Emu adds minimal overhead:

Mode	podman run --rm alpine echo hello	Notes
Native ARM64	~2.1s	Baseline
FEX-Emu x86_64 (cold)	~2.8s	First run, JIT compilation
FEX-Emu x86_64 (warm)	~2.4s	With code cache populated

Code Cache Warmup (single container, 5 iterations — full results):

Workload	Image	Run 1	Run 4/5	Speedup
python3 -c 'print(42)'	python:3.12	3,371ms	111ms	30.4x
g++ --version	gcc:14-bookworm	1,328ms	45ms	29.5x
perl -e 'print 42'	perl:5	1,042ms	47ms	22.2x
dpkg -l | wc -l	ubuntu:24.04	1,280ms	69ms	18.6x
rpm -V bash	fedora:42	2,331ms	141ms	16.5x

Code cache is ephemeral (per-container lifetime). When a container is removed, the cache is lost and JIT recompilation occurs on the next run.

Known Limitations

Case	Reason	Workaround
MSSQL Server	Runtime crash (root cause under investigation)	Use native x86_64 host
Go 1.24+	crypto/internal/fips140 SIGSEGV	Use Go 1.23 or earlier
Angular/Node (esbuild)	esbuild (Go) SIGSEGV	Same root cause as Go crypto
applehv provider	Requires libkrun	Set provider to libkrun

Feedback, bug reports, and environment info (sw_vers -productVersion, chip model, podman --version) are welcome in the thread below.

[Luap99]

Why does this not work with applehv?

AVX/AVX2 instructions

AFAIK RHEL 10 compiles everything for x86_64-v3, does this mean the RHEL 10/ubi10 based base images will fail to run with FEX?

[tnk4on]

Good catch — my docs were outdated. FEX-Emu has supported AVX/AVX2 since mid-2024. I tested UBI 10 (RHEL 10.1) and it works fine. The original issue #28184 mentioned AVX in the title, so I assumed that was the cause of the MSSQL crash. Turns out it may be something else. Will fix the docs. Thanks!