Containers and Group Containers on Mac: sandboxed app data explained

Group Containers is a folder in your Library on a Mac where apps from the same developer, along with their extensions and widgets, keep the data they share. Its neighbour, Containers, holds one private folder for each sandboxed app: the app's own home, with its data, settings and caches.

Is it safe to delete them? Not the folders themselves, and not the container of an app you still use: that erases the app's data and settings, sometimes including things you made in it. Caches inside a container are safe to clear, and the container of an app you've removed can go once you've checked nothing in it matters.

There's a reason leftovers pile up here. Apple's documentation says macOS creates a group container the first time an app needs it and never removes it, and dragging an app to the Trash usually leaves its container behind too. So both folders keep growing with every app you've tried.

This post answers what each folder is, what fills it, which parts are safe to remove, and how macOS 26 and macOS 27 protect them. Both count in System Data, and how to clear System Data step by step shows where they fit in a wider cleanup.

What are Containers and Group Containers?

Both come from the App Sandbox, the security system that limits what an app can reach on your Mac. Apps from the Mac App Store must use it, and many others do too.

What does the App Sandbox do?

A sandboxed app can't roam your home folder. It gets full access to one folder of its own, its container, and reaches other files only when you choose them, for example in an Open dialog, or when you grant it access in System Settings.

That's good for security: an app that's compromised can't read your other apps' data. It also means each sandboxed app keeps everything in its container rather than in the usual places in your Library.

What is a container?

When a sandboxed app opens for the first time, macOS creates a container for it in ~/Library/Containers and links it to the app. App extensions, such as share extensions and widgets, get containers of their own.

Inside is a folder called Data that works as the app's private home. It has its own Library, with Application Support, Caches and Preferences, and often a Documents folder. Most of the other items in Data are aliases that point to your real folders, such as Desktop and Downloads, not copies of them.

What is a group container?

Sometimes apps need to share data: an app and its widget, a set of apps in one suite, or an app and a helper. Apple's answer is an app group, and each app group gets a shared folder in ~/Library/Group Containers.

Apple's documentation says macOS creates this folder automatically the first time an app needs it, with Application Support, Caches and Preferences folders inside, and never removes it. On iPhone and iPad, by contrast, the system removes a group container once every app in the group is gone.

Where does a sandboxed app keep its usual files?

A sandboxed app uses the same kinds of folder as any other app, but inside its container. That's why you sometimes can't find an app's caches or settings where you'd expect them.

What	An app that isn't sandboxed	A sandboxed app
Caches	~/Library/Caches	Data/Library/Caches in its container
App data	~/Library/Application Support	Data/Library/Application Support in its container
Preferences	~/Library/Preferences	Often Data/Library/Preferences in its container
Files you save in the app	Wherever you choose	Its own Data/Documents, unless you choose a place

Eclectic Light points out that a sandboxed app's preferences often aren't in your main Preferences folder at all. If you're looking for an app's files and can't find them, look for its container.

How do the two compare?

	Containers	Group Containers
Where	~/Library/Containers	~/Library/Group Containers
One per	Sandboxed app or extension	App group, shared by one developer's apps
Usually named	After the app's bundle ID	Team ID or group., then a group name
Holds	The app's private Data folder	Shared databases, downloads, settings, caches
Removed with the app?	Not always	No: macOS never removes it
Level	Review first	Review first

There's also a Daemon Containers folder in your Library, used by sandboxed background services. It's protected, and it's not one to look into for space.

What's in Group Containers on a Mac?

The Group Containers folder is usually smaller in count than Containers, but some of its folders are among the largest app data on a Mac. Chat apps, office suites, Podcasts and developer tools keep their main data here.

How are group containers named?

On macOS, Apple asks developers to name an app group with their team ID, a ten-character code that identifies the developer, followed by a dot and a group name. Microsoft's Office apps, for example, share ~/Library/Group Containers/UBF8T346G9.Office.

Apps that also run on iPhone often use the iPhone style instead, starting with group. and a name, such as group.net.whatsapp.WhatsApp.shared. Both styles mean the same thing: data shared by one developer's apps.

Why does one app have several group containers?

Apple's documentation notes that an app can belong to more than one app group. A developer might use one group for data its app shares with a widget, another for a share extension, and a third shared with a sister app.

WhatsApp is a common example: you may find group containers ending in .shared, .private and .family, and more if WhatsApp Business is installed too.

Usually one of them holds nearly all the data: for WhatsApp, the .shared one with the message database and media. The others are usually small, and they belong to the same apps, so they stay or go together.

Which apps keep large data in group containers?

Group container	Belongs to	What's inside	What to do
group.net.whatsapp.WhatsApp.shared	WhatsApp	Message database and chat media	Delete media in WhatsApp
*.ru.keepcoder.Telegram	Telegram	Local database and media cache	Clear cache in Telegram
UBF8T346G9.Office	Microsoft Office	Outlook's mail profiles, shared settings	Manage mail in Outlook
243LU875E5.groups.com.apple.podcasts	Podcasts	Downloaded episodes and its database	Remove downloads in Podcasts
group.com.apple.VoiceMemos.shared	Voice Memos	Your recordings	Delete them in Voice Memos
HUAQ24HBR6.dev.orbstack	OrbStack	Docker data and Linux machines	Delete them in OrbStack

Several of these hold data that exists only on your Mac. Telegram's secret chats are stored only on the device where they started, and items in Outlook's On My Computer folders exist only in its profile.

Not every Apple folder starts with com.apple

Apple's own apps use group containers with team IDs too, so their names don't always start with com.apple. Podcasts uses 243LU875E5.groups.com.apple.podcasts, and the iWork apps use 74J34U3R6X.com.apple.iWork.

Some don't mention Apple at all. Shortcuts, which began as an app called Workflow, keeps its data in group.is.workflow.shortcuts. Before removing any group container, check the whole name for com.apple, and when in doubt, leave it.

Why do group containers outlive their apps?

Apple's documentation is direct about it: on a Mac, the group folder is created when an app first needs it and never removed, even after every app in the group is gone.

So a group container from a chat app you tried two years ago, with its media cache, is likely still there. That makes Group Containers a good place to look for leftovers, as long as you're sure every app in the group is gone.

Why are there so many containers?

Open Containers on a Mac that's been in use for a while and you may find hundreds of folders. Eclectic Light notes it can be a thousand or more. Most of them aren't from apps you installed.

Most of them belong to macOS

macOS's own apps and services are sandboxed too, and so are their extensions: share extensions, widgets, Quick Look previews, settings panels and background helpers. Each gets a container, so a single Apple app can account for several of them.

Those are part of macOS. Their names usually start with com.apple, and they're small. Leave them alone, even the ones whose purpose isn't obvious.

Why does Finder show app names instead of folder names?

Since macOS Big Sur, Finder shows many containers by the app's name instead of the folder's real name. Several folders can then appear with the same name: one for the app and others for its extensions. Mail, for example, can appear more than once.

To see a container's real name, select it and choose File › Get Info: the Name & Extension field can show it. Some containers are named with a long string of letters and numbers instead of a bundle ID; macOS keeps a private record of which app each one belongs to.

Are containers as big as they look?

Usually not. The aliases inside a container's Data folder point to your real Desktop, Downloads and other folders, and they take almost no space themselves. Most containers are a few megabytes.

A handful are large, and they're large because of what the app stores: media, mail, virtual machines, models. Those are the ones worth your time.

How big are containers, and what makes them grow?

Because sandboxed apps keep everything in their containers, the containers hold whatever those apps store. For a mail app that's mail; for a virtual machine app it's whole disks.

Which containers are usually the largest?

• Podcasts downloads1–250 GB · Usually safe
• Virtual machines (UTM, OrbStack)10–150 GB · Review first
• Docker Desktop's disk10–100 GB · Usually safe
• Outlook profiles5–70 GB · Review first
• WhatsApp2–50 GB · Review first
• Telegram1–50 GB · Review first
• Teams1–10 GB · Usually safe
• One removed app's container0.1–15 GB · Review first

Typical ranges on Macs that have these apps, from the research behind the app's catalog. Most containers are a few megabytes, and many Macs have none of these large ones.

The ranges are wide because use varies. A Podcasts library with automatic downloads on for dozens of shows grows far beyond one that streams; a WhatsApp account in busy group chats grows faster than a quiet one.

Which large items live in Containers?

Container	What's large inside	Level
com.docker.docker	Docker.raw, Docker's whole disk	Usually safe
com.utmapp.UTM	UTM's virtual machines	Review first
com.liuliu.draw-things	Draw Things' image models	Review first
com.apple.BKAgentService	Books you've downloaded or added	Review first
com.apple.mail	Mail Downloads: copies of attachments you opened	Usually safe
com.microsoft.teams2	Teams' cache, settings and logs	Usually safe

Docker Desktop keeps its disk image in a folder in Containers too. That disk is a sparse file, so Finder can show its maximum size rather than the space it really uses.

How do you measure them?

1. In Finder, choose Go › Go to Folder, type ~/Library/Containers and press Return.
2. Choose View › as List, then View › Show View Options, and select Calculate all sizes.
3. Click the Size column heading to put the largest first.
4. Do the same for ~/Library/Group Containers.

Finder needs time to add up hundreds of folders. Wait until the sizes stop changing before comparing.

Which Storage settings category do containers count in?

Storage settings counts most containers and group containers in System Data, which is why that category grows as sandboxed apps store more. A few of Apple's apps are the exception: Podcasts' downloads count under Podcasts, downloaded books under Books, and Mail's attachment copies under Mail.

Those categories have their own management in Storage settings or in the app, so start there for them. For the rest, the container sizes in Finder are the closest you'll get to a breakdown.

Is it safe to delete the Containers folder?

No. Moving the whole Containers folder, or the whole Group Containers folder, to the Trash takes the data and settings of every sandboxed app with it, including Apple's. Apps you use would start over, and some of what they held may exist nowhere else.

Inside them, the answer depends on whose folder it is and what's inside.

What you find	Safe to remove?	Why
The Containers or Group Containers folder itself	No	Every sandboxed app's data
A container of an app you still use	No	Erases its data and settings
A container whose name contains com.apple	No	Part of macOS
Caches inside a container	Yes	The app rebuilds them
A container of an app you've removed	After checking	May hold documents saved only there
A group container whose apps are all gone	After checking	May hold shared data you made

Is it safe to delete Group Containers?

Not the folder, and not any group container used by an app you still have. A group container is shared, so removing it affects every app in the group: removing Office's would affect Word, Excel, PowerPoint and Outlook at once.

When every app in a group is gone, its group container is a leftover like any other. Check it for your own data first, then move it to the Trash.

What happens if you delete the container of an app you still use?

The next time the app opens, macOS creates a new, empty container, and the app starts as if it were new: no settings, no history, no downloaded content. Documents you saved only inside the app are gone.

If an app misbehaves, look for a reset or a cache setting in the app before you reach for its container. Those keep what matters and clear the rest.

What's safe to clear inside a container?

Each container's Library has its own Caches folder, and each group container has one too. Those are Safe: like any cache, the app recreates what it needs, and its documents and settings live elsewhere in the container.

Other folders deserve care. Mail's Mail Downloads folder holds copies of attachments you opened; it's Usually safe, because an attachment you edited and saved in place may exist only there. Documents and Application Support inside a container can hold your own work.

What about Apple's own apps?

Their containers are part of macOS, even for apps you never open. Most are small, macOS creates them when it needs them, and removing them can reset Apple apps you do use. The few large ones, such as Podcasts, Books and Mail, hold content you manage in those apps.

To free space from Apple's apps, use their own controls: remove downloaded episodes in Podcasts, remove downloads in Books, delete recordings in Voice Memos, and manage website data in Safari's settings.

How to remove a container safely, step by step

Use the app's own controls when the app is still installed, and Finder only for apps you've already removed.

Step 1: use the app or its uninstaller first

If the app is still on your Mac and came with an uninstaller, use it. Apple notes that an uninstaller can also remove login items, extensions and data stored in other locations, which Finder can't find for you.

If you want to keep the app but free space, use its own setting. Most apps that store a lot in a container have one, and the next section lists several.

Step 2: find the container of an app you've removed

1. In Finder, open ~/Library/Containers with Go › Go to Folder.
2. Look for the app's name, or its bundle ID, such as com.developer.appname.
3. Expect more than one folder for the same app: one for the app and others for its extensions. They all belong to it.
4. In list view, check the Date Modified column. A container that hasn't changed since you removed the app is a good sign it's no longer used.

Step 3: check it for your data

Open the container's Data folder and look in Documents and in Library › Application Support. Look for files with names you gave them, projects, exports, databases or libraries.

If you find anything you might want, copy it somewhere safe first, such as an external drive. A container's Documents folder belongs to the app, not to your Documents folder, so what's saved there doesn't appear in your own Documents.

Step 4: move it to the Trash, and wait

Move the container, and any containers of the same app's extensions, to the Trash. Leave them there for a week or so before you empty it. If you reinstall the app and miss something, you can put the container back while the app is closed.

Step 5: group containers last

Only remove a group container when every app that uses it is gone. Check the developer's other apps, including small ones such as menu bar helpers and widgets, then repeat the same checks for your data.

An example of a careful removal

Say you removed a photo editor from the App Store a year ago, and its container is one of the largest in the list. Finder shows three folders with its name: the app's container and two for its extensions.

Inside the app's Data folder, Library › Caches holds most of the space, and Documents holds a few edited images that were never exported. You copy those images to your Pictures folder, then move all three containers to the Trash, and empty it a week later.

Clearing caches for an app you still use

1. Quit the app, including any icon it has in the menu bar.
2. Open its container, then Data › Library › Caches, or its group container's Library › Caches.
3. Move what's inside to the Trash.
4. Open the app, check it works, then empty the Trash.

The app opens or loads content more slowly at first, and some apps download data again. It frees space; it doesn't make a Mac faster.

Free space with each app's own controls

For the largest containers, the app's own setting is the supported way, and often the only safe one. Its database stays consistent, and it removes what it can download again rather than what it can't.

App	Where the data lives	What to do in the app
WhatsApp	Group container	Open a chat, click its name, then Media, Links, and Docs; select items and choose Delete for me
Telegram	Group container	Settings › Data and Storage › Storage Usage, then Clear cache
Outlook	Office's group container	Delete mail you don't need, empty Deleted Items, remove accounts you no longer use
Podcasts	Group container	Click Downloaded, then the More button, then Remove All Downloads
Books	Container	On a book, click the More button, Remove, then Remove Download
UTM	Container	Control-click a virtual machine you no longer need and remove it
Draw Things	Container	Settings, the Model menu, Manage, then delete models

Voice Memos and Safari

In Voice Memos, select a recording and press Delete. Deleted recordings stay in Recently Deleted for the time set in Voice Memos › Settings › Clear Deleted; to remove them sooner, select Recently Deleted and click Delete All. With iCloud, that deletes them on your other devices too.

Safari keeps part of its cache and website data in its container. Remove website data in Safari › Settings › Privacy › Manage Website Data, site by site or with Remove All. You may be signed out of those websites, and Apple notes it can change the data other apps see too.

Docker and OrbStack

Never delete Docker.raw or OrbStack's disk image to free space. Each holds every image, container and volume at once. Remove what you don't need in Docker Desktop or OrbStack, and their disks give the space back to your Mac by themselves, sometimes after a few minutes.

Teams

Microsoft's steps for clearing the Teams cache on a Mac remove both its container and its group container, and Teams rebuilds them when it opens. Your chats, channels and files stay in Microsoft 365.

It resets Teams' personal settings and removes the logs Microsoft support uses, so it's a fix for problems with the app rather than routine upkeep. You might need to sign in again.

Containers on macOS 27 and macOS 26

macOS has tightened who can read containers several times in the last few versions. This affects disk tools, backup apps and anything else that isn't the container's own app.

macOS Sonoma and macOS Sequoia

Apple's documentation says that in macOS 14 Sonoma and later, macOS links each app to its container by its code signature. When another app tries to read that container, macOS asks you whether to allow it.

Eclectic Light notes that macOS Sequoia extended this protection to group containers, so only the apps in a group can use its folder. macOS 26 Tahoe works the same way, and you may see a prompt saying an app would like to access data from other apps.

What changed in macOS 27?

Apple's release notes for macOS Golden Gate say that accessing files in other developer teams' app containers and group containers no longer prompts you. Instead, it's denied by default, and you can manage it in Privacy & Security settings.

For you, that means fewer prompts and more silence. An app that tries to read another developer's container simply can't, unless you've allowed it.

What does that mean for disk tools?

A disk tool may show a container as empty, or list it as unreadable, without asking. Apple's own workaround for tools that need access is Full Disk Access, in System Settings › Privacy & Security.

Even with it, the right way to remove most container data is still the app that owns it. The protection exists because malware targets exactly this data.

Should you allow an app access to other apps' data?

Only when you trust the app and it needs that access to do its job, such as a backup app that copies your whole Library. A prompt or setting that appears while you're using an app you don't know well is a reason to say no.

Granting access doesn't change what the owning app sees. It only lets the other app read, and possibly change, data that macOS would otherwise keep from it.

How can you tell whether an app is sandboxed?

Open Activity Monitor from the Utilities folder, choose View › Columns, and select Sandbox. With the app running, the Sandbox column says Yes for sandboxed apps.

A sandboxed app keeps its data in its container. An app that isn't sandboxed usually keeps it in Application Support, which the Application Support post covers.

If you removed a container by mistake

A container you moved to the Trash can go back exactly as it was. The one thing to watch for is the app making a new, empty container in the meantime.

Put it back from the Trash

1. Quit the app the container belongs to.
2. If you've opened the app since removing its container, macOS has made a new, empty one with the same name. Move that new one to the Trash first.
3. Click the Trash in the Dock, select the original container, and choose File › Put Back.
4. Open the app and check that your data and settings are back.

Restore it from Time Machine

If you've emptied the Trash, Time Machine can bring the container back. Quit the app, then in Finder choose Go › Go to Folder and open ~/Library/Containers or ~/Library/Group Containers.

Open Time Machine, using Spotlight to find it, and use the arrows to go back to a backup from before the removal. Select the container and click Restore: it returns to its original place. Recent removals can also come back from Time Machine's local snapshots, even without the backup disk connected.

What happens when you reinstall an app?

Because macOS doesn't remove containers with their apps, reinstalling the same app usually finds its old container still there, with its data and settings. That's the upside of leftovers: an app you might return to keeps its state.

So for an app you expect to reinstall, leaving its container in place is a reasonable choice, especially if it's small. Remove containers of apps you're sure you've finished with.

Mistakes to avoid

Containers look like a tidy list of app folders, which makes them tempting to clear in bulk. These are the mistakes that cost people data.

Removing containers in bulk

Selecting every container you don't recognise and moving them to the Trash removes dozens of Apple's containers along with any leftovers. Some of macOS's apps then reset, and you may not notice which until later.

Removing a group container that a remaining app still uses

Removing a developer's group container because you removed one of their apps can break the others. Check every app from that developer before you remove a shared folder.

Deleting a container to reset a stuck app

It works, but it takes everything the app kept, and you can't pick what survives. Look for the app's own reset or cache setting first. If you do remove the container, move it to the Trash so you can put it back.

Moving a container to another drive

macOS creates and locates containers itself. A container moved elsewhere is no longer the app's container: the app gets a new, empty one. Apps that store large data, such as virtual machine apps, often let you keep their files in another place from inside the app.

Deleting cloud storage folders

Cloud storage apps such as Dropbox keep caches in a group container, and their synced files in folders macOS manages. Leave those to the app: Dropbox clears its cache by itself every three days, and deleting synced files deletes them everywhere. For other leftovers, the guide to uninstalling apps properly lists every place an app leaves files.

How the app does it

Wombit scans your disk and explains every item in plain language, containers included. Select one in the map or list to see what it is, how safe it is to remove, and what removing it costs.

Containers and group containers are Review first: they're explained and never checked for you. Their Caches folders are Safe, and known large items inside them, such as WhatsApp's data, Podcasts downloads and UTM's virtual machines, have entries of their own with the app's own steps.

• ~/Library/Containers/*

  App containers

  The private folder a sandboxed app, such as most apps from the App Store, uses as its own home for data, settings and caches.

  Review first · Explained only: the app shows you how

• ~/Library/Group Containers/*

  Group containers

  Shared folders where apps from the same developer, and their extensions and widgets, keep data they all use.

  Review first · Explained only: the app shows you how

• ~/Library/Containers/*/Data/Library/Caches

  Sandboxed app caches

  Cached data that sandboxed apps, such as most apps from the App Store, keep inside their own containers.

  Safe · Moves it to the Trash

The uninstaller finds the containers and group containers of apps you're removing, or have already removed, and shows the evidence for each, such as one of the app's groups or macOS's container records. They start unchecked, marked as places that may hold your data. Folders macOS didn't let it read are listed, not skipped.

Seeing all of this is free. Cleanup and the uninstaller are PRO: one payment of $4.99 with lifetime access. Every Pro tool's review is free to open, so you see what would go and why before you buy.