What is com.apple.Virtualization.VirtualMachine on Mac?

What it is

Apple’s Virtualization framework lets apps run Linux and macOS virtual machines on Apple Silicon without a kernel extension. When an app starts a VM, macOS launches an XPC service from /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc. That process is the VM: it holds the guest’s memory, runs its virtual CPUs and emulates its disks, network and display.

One VM means one process. Two VMs (say, OrbStack and a UTM Linux desktop) mean two.

Why it uses memory and CPU

• Memory is mostly the guest’s RAM. A VM configured with 8 GB will show close to that once the guest has used it. Linux happily fills spare RAM with file cache, so an “idle” VM can still look large.
• CPU is whatever runs inside: containers, builds, a database, a guest desktop. Idle Linux VMs should be under 1–2%.
• Disk I/O: the VM’s disk image is a large file on your Mac. Heavy writes inside the guest become writes to that file.

On an 8 GB or 16 GB Mac, a big VM is often the reason for high memory pressure and swap.

Find which app started it

ps -o pid,ppid,rss,etime,command -p $(pgrep -f Virtualization.VirtualMachine)

The parent PID is usually launchd, because it’s an XPC service. To find the owning app, look for which VM tool is running:

ps -axo pid,command | grep -iE 'docker|orbstack|utm|limactl|colima|tart|podman|container' | grep -v grep

How to make it smaller

• Docker Desktop: Settings › Resources, lower Memory; turn on Resource Saver.
• OrbStack: Settings › System, memory limit. OrbStack returns unused memory to macOS dynamically.
• Colima / Lima: colima stop, then colima start --memory 4 --cpu 2, or edit ~/.lima/<name>/lima.yaml.
• UTM: edit the VM › System › Memory.
• Podman: podman machine set --memory 4096 with the machine stopped.

And stop VMs you aren’t using. A stopped VM uses no memory at all.

When to worry

The process is Apple’s; the guest inside is whatever you installed. Check the host binary:

codesign -dv --verbose=2 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc 2>&1 | grep Authority

A VM you didn’t start is the thing to investigate: look for the tools above, and check System Settings › General › Login Items & Extensions for one that starts at login.

Seeing it in Stat Space

Stat Space groups each VM process under the app that’s responsible for it (Docker, OrbStack, UTM and so on), so the Apps tab shows “Docker 6.1 GB” instead of a long reverse-DNS name. The memory module shows pressure and swap next to it, so you can see whether the VM’s size is actually hurting.