Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork2.9k
Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.
License
sickcodes/Docker-OSX
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
Docker-OSX ·Follow @sickcodes on Twitter
Run Mac OS X in Docker with near-native performance! X11 Forwarding! iMessage security research! iPhone USB working! macOS in a Docker container!
Conduct Security Research on macOS using both Linux & Windows!
The Discord is active on #docker-osx and anyone is welcome to come and ask questions, ideas, etc.
Click to join the Discord serverhttps://discord.gg/sickchat
Click to join the Telegram serverhttps://t.me/sickcodeschat
Or reach out via Linkedin if it's private:https://www.linkedin.com/in/sickcodes
Or viahttps://sick.codes/contact/
This project is maintained bySick.Codes.(Twitter)
Additional credits can be found here:https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md
Additionally, comprehensive list of all contributors can be found here:https://github.com/sickcodes/Docker-OSX/graphs/contributors
Big thanks to@kholia for maintaining the upstream project, which Docker-OSX is built on top of:OSX-KVM.
Also special thanks to@thenickdude who maintains the valuable forkKVM-OpenCore, which was started by@Leoyzen!
Extra special thanks to the OpenCore team over at:https://github.com/acidanthera/OpenCorePkg. Their well-maintained bootloader provides much of the great functionality that Docker-OSX users enjoy :)
If you like this project, consider contributing here or upstream!
Video setup tutorial is also available here:https://www.youtube.com/watch?v=wLezYl77Ll8
Windows users:click here to see the notes below!
First time here? tryinitial setup, otherwise try the instructions below to use either Catalina or Big Sur.
Release names and their version:
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e SHORTNAME=catalina \ sickcodes/docker-osx:latest# docker build -t docker-osx .
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e SHORTNAME=big-sur \ sickcodes/docker-osx:latest# docker build -t docker-osx .
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e GENERATE_UNIQUE=true \ -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \ -e SHORTNAME=monterey \ sickcodes/docker-osx:latest# docker build -t docker-osx .
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e GENERATE_UNIQUE=true \ -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \ -e SHORTNAME=ventura \ sickcodes/docker-osx:latest# docker build -t docker-osx .
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e GENERATE_UNIQUE=true \ -e CPU='Haswell-noTSX' \ -e CPUID_FLAGS='kvm=on,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on' \ -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom-sonoma.plist' \ -e SHORTNAME=sonoma \ sickcodes/docker-osx:latest# docker build -t docker-osx .
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e GENERATE_UNIQUE=true \ -e CPU='Haswell-noTSX' \ -e CPUID_FLAGS='kvm=on,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on' \ -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom-sonoma.plist' \ -e SHORTNAME=sequoia \ sickcodes/docker-osx:latest# docker build -t docker-osx .
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e SHORTNAME=high-sierra \ sickcodes/docker-osx:latest# docker build -t docker-osx .
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e SHORTNAME=mojave \ sickcodes/docker-osx:latest# docker build -t docker-osx .
This is a particularly good way for downloading the container, in case Docker's CDN (or your connection) happens to be slow.
wget https://images2.sick.codes/mac_hdd_ng_auto.imgdocker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v"${PWD}/mac_hdd_ng_auto.img:/image" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e GENERATE_UNIQUE=true \ -e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/custom/config-nopicker-custom.plist \ -e SHORTNAME=catalina \ sickcodes/docker-osx:naked
The easiest and most secure way issshfs
# on Linux/Windowsmkdir~/mnt/osxsshfs user@localhost: -p 50922~/mnt/osx# wait a few seconds, and ~/mnt/osx will have full rootfs mounted over ssh, and in userspace# automated: sshpass -p <password> sshfs user@localhost:/ -p 50922 ~/mnt/osx
If you have a laptop see the next usbfluxd section.
If you have a desktop PC, you can use@Silfalion's instructions:https://github.com/Silfalion/Iphone_docker_osx_passthrough
Video setup tutorial for usbfluxd is also available here:https://www.youtube.com/watch?v=kTk5fGjK_PM
This method WORKS on laptop, PC, anything!
Thank you@nikias forusbfluxd viahttps://github.com/corellium!
This is done inside Linux.
Open 3 terminals on Linux
Connecting your device over USB on Linux allows you to exposeusbmuxd on port5000 usinghttps://github.com/corellium/usbfluxd to another system on the same network.
Ensureusbmuxd,socat andusbfluxd are installed.
sudo pacman -S libusbmuxd usbmuxd avahi socat
Available on the AUR:https://aur.archlinux.org/packages/usbfluxd/
yay usbfluxd
Plug in your iPhone or iPad.
Terminal 1
sudo systemctl start usbmuxdsudo avahi-daemon
Terminal 2:
# on hostsudo systemctl restart usbmuxdsudo socat tcp-listen:5000,fork unix-connect:/var/run/usbmuxdTerminal 3:
sudo usbfluxd -f -n
This is done inside macOS.
Install homebrew.
172.17.0.1 is usually the Docker bridge IP, which is your PC, but you can use any IP fromip addr...
macOS Terminal:
# on the guestbrew install make automake autoconf libtool pkg-config gcc libimobiledevice usbmuxdgit clone https://github.com/corellium/usbfluxd.gitcd usbfluxd./autogen.shmakesudo make install
Accept the USB over TCP connection, and appear as local:
(you may need to change172.17.0.1 to the IP address of the host. e.g. checkip addr)
# on the guestsudo launchctl start usbmuxdexport PATH=/usr/local/sbin:${PATH}sudo usbfluxd -f -r 172.17.0.1:5000
Close apps such as Xcode and reopen them and your device should appear!
If you need to start again on Linux, wipe the current usbfluxd, usbmuxd, and socat:
sudo killall usbfluxdsudo systemctl restart usbmuxdsudo killall socat
Make container FASTER usinghttps://github.com/sickcodes/osx-optimizer
SEE commands inhttps://github.com/sickcodes/osx-optimizer!
- Skip the GUI login screen (at your own risk!)
- Disable spotlight indexing on macOS to heavily speed up Virtual Instances.
- Disable heavy login screen wallpaper
- Disable updates (at your own risk!)
Increase disk space by moving /var/lib/docker to external drive, block storage, NFS, or any other location conceivable.
Move /var/lib/docker, following the tutorial below
- Cheap large physical disk storage instead using your server's disk, or SSD.
- Block Storage, NFS, etc.
Tutorial here:https://sick.codes/how-to-run-docker-from-block-storage/
Only follow the above tutorial if you are happy with wiping all your current Docker images/layers.
Safe mode: Disable docker temporarily so you can move the Docker folder temporarily.
- Do NOT do this until you have moved your image out alreadyhttps://github.com/dulatello08/Docker-OSX/#quick-start-your-own-image-naked-container-image
killall dockerdsystemctl disable --now dockersystemctl disable --now docker.socketsystemctl stop dockersystemctl stop docker.socket
Now, that Docker daemon is off, move /var/lib/docker somewhere
Then, symbolicly link /var/lib/docker somewhere:
mv /var/lib/docker /run/media/user/some_drive/dockerln -s /run/media/user/some_drive/docker /var/lib/docker# now check if /var/lib/docker is working stillls /var/lib/dockerIf you see folders, then it worked. You can restart Docker, or just reboot if you want to be sure.
2021-11-14 - Added High Sierra, Mojave
Pick one of these whilebuilding, irrelevant when using docker pull:
--build-arg SHORTNAME=high-sierra --build-arg SHORTNAME=mojave--build-arg SHORTNAME=catalina--build-arg SHORTNAME=big-sur--build-arg SHORTNAME=monterey--build-arg SHORTNAME=ventura--build-arg SHORTNAME=sonomaThere are currently multiple images, each with different use cases (explainedbelow):
- High Sierra (10.13)
- Mojave (10.14)
- Catalina (10.15)
- Big Sur (11)
- Monterey (12)
- Ventura (13)
- Sonoma (14)
- Auto (pre-made Catalina)
- Naked (use your own .img)
- Naked-Auto (user your own .img and SSH in)
High Sierra:
Mojave:
Catalina:
Big-Sur:
Monterey make your own image:
Ventura make your own image:
Sonoma make your own image:
Pre-madeCatalina system bySick.Codes: username:user, password:alpine
Naked: Bring-your-own-image setup (use any of the above first):
Naked Auto: same as above but with-e USERNAME &-e PASSWORD and-e OSX_COMMANDS="put your commands here"
- use iPhone OSX KVM on Linux usingusbfluxd!
- macOS Monterey VM on Linux!
- Folder sharing-
- USB passthrough (hotplug too)
- SSH enabled (
localhost:50922) - VNC enabled (
localhost:8888) if using ./vnc version - iMessage security research viaserial number generator!
- X11 forwarding is enabled
- runs on top of QEMU + KVM
- supports Big Sur, custom images, Xvfb headless mode
- you can clone your container with
docker commit
- 20GB+++ disk space for bare minimum installation (50GB if using Xcode)
- virtualization should be enabled in your BIOS settings
- a x86_64 kvm-capable host
- at least 50 GBs for
:auto(half for the base image, half for your runtime image
- documentation for security researchers
- gpu acceleration
- support for virt-manager
Images built on top of the contents of this repository are also available onDocker Hub for convenience:https://hub.docker.com/r/sickcodes/docker-osx
A comprehensive list of the available Docker images and their intended purpose can be found in theInstructions.
Docker-OSX supports Kubernetes.
Kubernetes Helm Chart & Documentation can be found under thehelm directory.
Thankscephasara for contributing this major contribution.
Feel free to open anissue, should you come across minor issues with running Docker-OSX or have any questions.
Before you open an issue, however, please check theclosed issues and confirm that you're using the latest version of this repository — your issues may have already been resolved! You might also see your answer in our questions and answers sectionbelow.
Follow@sickcodes!
For more sophisticated endeavours, we offer the following support services:
- Enterprise support, business support, or casual support.
- Custom images, custom scripts, consulting (per hour available!)
- One-on-one conversations with you or your development team.
In case you're interested, contact@sickcodes on Twitter or clickhere.
Docker-OSX is licensed under theGPL v3+. Contributions are welcomed and immensely appreciated. You are in fact permitted to use Docker-OSX as a tool to create proprietary software.
- Run Android in a Docker Container with Dock Droid
- Run Android fully native on the host!
- Run iOS 12 in a Docker container with Docker-eyeOS -https://github.com/sickcodes/Docker-eyeOS
- Run iMessage relayer in Docker with Bluebubbles.app -Getting started wiki
If you are serious about Apple Security, and possibly finding 6-figure bug bounties within the Apple Bug Bounty Program, then you're in the right place! Further notes:Is Hackintosh, OSX-KVM, or Docker-OSX legal?
Product names, logos, brands and other trademarks referred to within this project are the property of their respective trademark holders. These trademark holders are not affiliated with our repository in any capacity. They do not sponsor or endorse this project in any way.
Already set up or just looking to make a container quickly? Check out ourquick start or see a bunch more use cases under ourcontainer creation examples section.
There are several different Docker-OSX images available that are suitable for different purposes.
sickcodes/docker-osx:latest-I just want to try it out.sickcodes/docker-osx:latest-I want to use Docker-OSX to develop/secure apps in Xcode (sign into Xcode, Transporter)sickcodes/docker-osx:naked-I want to use Docker-OSX for CI/CD-related purposes (sign into Xcode, Transporter)
Create your personal image using:latest orbig-sur. Then, pull the image out the image. Afterwards, you will be able to duplicate that image and import it to the:naked container, in order to revert the container to a previous state repeatedly.
sickcodes/docker-osx:auto-I'm only interested in using the command line (useful for compiling software or using Homebrew headlessly).sickcodes/docker-osx:naked-I need iMessage/iCloud for security research.sickcodes/docker-osx:big-sur-I want to run Big Sur.sickcodes/docker-osx:monterey-I want to run Monterey.sickcodes/docker-osx:ventura-I want to run Ventura.sickcodes/docker-osx:sonoma-I want to run Sonoma.sickcodes/docker-osx:high-sierra- I want to run High Sierra.sickcodes/docker-osx:mojave- I want to run Mojave.
Before you do anything else, you will need to turn on hardware virtualization in your BIOS. Precisely how will depend on your particular machine (and BIOS), but it should be straightforward.
Then, you'll need QEMU and some other dependencies on your host:
# ARCHsudo pacman -S qemu libvirt dnsmasq virt-manager bridge-utils flex bison iptables-nft edk2-ovmf# UBUNTU DEBIANsudo apt install qemu qemu-kvm libvirt-clients libvirt-daemon-system bridge-utils virt-manager libguestfs-tools# CENTOS RHEL FEDORAsudo yum install libvirt qemu-kvm
Then, enable libvirt and load the KVM kernel module:
sudo systemctlenable --now libvirtdsudo systemctlenable --now virtlogdecho 1| sudo tee /sys/module/kvm/parameters/ignore_msrssudo modprobe kvm
Running Docker-OSX on Windows is possible using WSL2 (Windows 11 + Windows Subsystem for Linux).
You must have Windows 11 installed with build 22000+ (21H2 or higher).
First, install WSL on your computer by running this command in an administrator powershell. For more info, lookhere.
This will install Ubuntu by default.
wsl --installYou can confirm WSL2 is enabled usingwsl -l -v in PowerShell. To see other distributions that are available, usewsl -l -o.
If you have previously installed WSL1, upgrade to WSL 2. Checkthis link to upgrade from WSL1 to WSL2.
After WSL installation, go toC:/Users/<Your_Name>/.wslconfig and addnestedVirtualization=true to the end of the file (If the file doesn't exist, create it). For more information about the.wslconfig file checkthis link. Verify that you have selected "Show Hidden Files" and "Show File Extensions" in File Explorer options.The result should be like this:
[wsl2]nestedVirtualization=trueGo into your WSL distro (Runwsl in powershell) and check if KVM is enabled by using thekvm-ok command. The output should look like this:
INFO: /dev/kvm existsKVM acceleration can be usedUse the commandsudo apt -y install bridge-utils cpu-checker libvirt-clients libvirt-daemon qemu qemu-kvm to install it if it isn't.
Now download and installDocker for Windows if it is not already installed.
After installation, go into Settings and check these 2 boxes:
General -> "Use the WSL2 based engine";Resources -> WSL Integration -> "Enable integration with my default WSL distro",Ensurex11-apps is installed. Use the commandsudo apt install x11-apps -y to install it if it isn't.
Finally, there are 3 ways to get video output:
- WSLg: This is the simplest and easiest option to use. There may be some issues such as the keyboard not being fully passed through or seeing a second mouse on the desktop -Issue on WSLg - but this option is recommended.
To use WSLg's built-in X-11 server, change these two lines in the docker run command to point Docker-OSX to WSLg.
-e "DISPLAY=${DISPLAY:-:0.0}" \-v /mnt/wslg/.X11-unix:/tmp/.X11-unix \Or try:
-e "DISPLAY=${DISPLAY:-:0}" \-v /mnt/wslg/.X11-unix:/tmp/.X11-unix \For Ubuntu 20.x on Windows, see#458
- VNC: See theVNC section for more information. You could also add -vnc argument to qemu. Connect to your mac VM via a VNC Client.Here is a how to
- Desktop Environment: This will give you a full desktop linux experience but it will use a bit more of the computer's resources. Here is an example guide, but there are other guides that help set up a desktop environment.DE Example
Additional boot instructions for when you arecreating your container
Boot the macOS Base System (Press Enter)
Click
Disk UtilityErase the BIGGEST disk (around 200gb default), DO NOT MODIFY THE SMALLER DISKS.-- if you can't click
erase, you may need to reduce the disk size by 1kb(optional) Create a partition using the unused space to house the OS and your files if you want to limit the capacity. (For Xcode 12 partition at least 60gb.)
Click
Reinstall macOSThe system may require multiple reboots during installation
This is a great place to start if you are having trouble getting going, especially if you're not that familiar with Docker just yet.
Just looking to make a container quickly? Check out ourcontainer creation examples section.
More specific/advanced troubleshooting questions and answers may be found inMore Questions and Answers. You should also check out theclosed issues. Someone else might have gotten a question like yours answered already even if you can't find it in this document!
Seeinitial setup.
docker: unknown server OS: .See 'docker run --help'.
This means your docker daemon is not running.
pgrep dockerd should return nothing
Therefore, you have a few choices.
sudo dockerd for foreground Docker usage. I use this.
Or
sudo systemctl --start dockerd to start dockerd this now.
Or
sudo systemctl --enable --now dockerd for start dockerd on every reboot, and now.
Examples:
-e EXTRA='-smp 6,sockets=3,cores=2'
-e EXTRA='-smp 8,sockets=4,cores=2'
-e EXTRA='-smp 16,sockets=8,cores=2'
Note, unlike memory, CPU usage is shared. so you can allocate all of your CPU's to the container.
If you usesudo dockerd or dockerd is controlled by systemd/systemctl, then you must be in the Docker group.If you are not in the Docker group:
sudo usermod -aG docker"${USER}"and also add yourself to the kvm and libvirt groups if needed:
sudo usermod -aG libvirt"${USER}"sudo usermod -aG kvm"${USER}"
See also:initial setup.
# run ad hocsudo dockerd# or daemonize itsudo nohup dockerd&# enable it in systemd (it will persist across reboots this way)sudo systemctlenable --now docker# or just start it as your user with systemd instead of enabling itsystemctl start docker
Big thank you to our contributors who have worked out almost every conceivable issue so far!
https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md
Created a container withdocker run and want to reuse the underlying image again later?
NB: seecontainer creation examples first for how to get to the point where this is applicable.
This is for when you want to run the SAME container again later. You may need to usedocker commit to save your container before you can reuse it. Check if your container is persisted withdocker ps --all.
If you don't run this you will have a new image every time.
# look at your recent containers and copy the CONTAINER IDdocker ps --all# docker start the container IDdocker start -ai abc123xyz567# if you have many containers, you can try automate it with filters like this# docker ps --all --filter "ancestor=sickcodes/docker-osx"# for locally tagged/built containers# docker ps --all --filter "ancestor=docker-osx"
You can also pull the.img file out of the container, which is stored in/var/lib/docker, and supply it as a runtime argument to the:naked Docker image.
See also:here.
Containers that usesickcodes/docker-osx:auto can be stopped while being started.
# find last containerdocker ps -a# docker start old container with -i for interactive, -a for attach STDIN/STDOUTdocker start -ai -i<Replace this with your ID>
You may see one or more libgtk-related errors if you do not have everything set up for hardware virtualisation yet. If you have not yet done so, check out theinitial setup section and theroutine checks section as you may have missed a setup step or may not have all the needed Docker dependencies ready to go.
See also:here.
If you have not yet set up xhost, try the following:
echo$DISPLAY# ARCHsudo pacman -S xorg-xhost# UBUNTU DEBIANsudo apt install x11-xserver-utils# CENTOS RHEL FEDORAsudo yum install xorg-x11-server-utils# then runxhost +
You cannot allocate more RAM than your machine has. The default is 3 Gigabytes:-e RAM=3.
If you are trying to allocate more RAM to the container than you currently have available, you may see an error like the following:cannot set up guest memory 'pc.ram': Cannot allocate memory. See also:here,here.
For example (below) thebuff/cache already contains 20 Gigabytes of allocated RAM:
[user@hostname ~]$free -mh total used free shared buff/cache availableMem: 30Gi 3.5Gi 7.0Gi 728Mi 20Gi 26GiSwap: 11Gi 0B 11Gi
Clear the buffer and the cache:
sudo tee /proc/sys/vm/drop_caches<<<3
Now check the RAM again:
[user@hostname ~]$free -mh total used free shared buff/cache availableMem: 30Gi 3.3Gi 26Gi 697Mi 1.5Gi 26GiSwap: 11Gi 0B 11Gi
Note:AppleALC,alcid andVoodooHDA-OC do not havecodec support. However,IORegistryExplorer does show the controller component working.
docker run \ --device /dev/kvm \ -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \ -v"/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ sickcodes/docker-osxdocker run \ --device /dev/kvm \ -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \ -v"/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e PULSE_SERVER=unix:/tmp/pulseaudio.socket \ sickcodes/docker-osx pactl listdocker run \ --device /dev/kvm \ -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \ -v /mnt/wslg/runtime-dir/pulse/native:/tmp/pulseaudio.socket \ -v /mnt/wslg/.X11-unix:/tmp/.X11-unix \ sickcodes/docker-osx
It's possible to forward additional ports depending on your needs. In this example, we'll use Mac OSX to host nginx:
host:10023 <-> 10023:container:10023 <-> 80:guestOn the host machine, run:
docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,' \ -p 10023:10023 \ sickcodes/docker-osx:autoIn a Terminal session running the container, run:
/bin/bash -c"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"brew install nginxsudo sed -i -e's/8080/80/' /usr/local/etc/nginx/nginx.confcd# sudo nginx -s stopsudo nginx
nginx should now be reachable on port 10023.
Additionally, you can string multiple statements together, for example:
-e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,hostfwd=tcp::10043-:443,' -p 10023:10023 \ -p 10043:10043 \You might not need to do anything with the default setup to enable internet connectivity from inside the container. Additionally,curl may work even ifping doesn't.
See discussionhere andhere andhere.
This is not required for LOCAL installations.
Additionally note it maycause the host to leak your IP, even if you're using a VPN in the container.
However, if you're trying to connect to an instance of Docker-OSX remotely (e.g. an instance of Docker-OSX hosted in a datacenter), this may improve your performance:
# enable for current sessionsudo sysctl -w net.ipv4.ip_forward=1# OR# sudo tee /proc/sys/net/ipv4/ip_forward <<< 1# enable permanentlysudo touch /etc/sysctl.confsudo tee -a /etc/sysctl.conf<<EOFnet.ipv4.ip_forward = 1EOF# or edit manually with the editor of your choicenano /etc/sysctl.conf|| vi /etc/sysctl.conf|| vim /etc/sysctl.conf# now reboot
Sharing a folder with guest is quite simple.
Your folder, will go to /mnt/hostshare inside the Arch container which is then passed over QEMU.
Then mount usingsudo -S mount_9p hostshare from inside the mac.
For example,
FOLDER=~/somefolder-v"${FOLDER}:/mnt/hostshare" \ -e EXTRA="-virtfs local,path=/mnt/hostshare,mount_tag=hostshare,security_model=passthrough,id=hostshare" \
Full example:
# stat mac_hdd_ng.imgSHARE=~/somefolderdocker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -v"${PWD}/mac_hdd_ng.img:/home/arch/OSX-KVM/mac_hdd_ng.img" \ -v"${SHARE}:/mnt/hostshare" \ -e EXTRA="-virtfs local,path=/mnt/hostshare,mount_tag=hostshare,security_model=passthrough,id=hostshare" \ sickcodes/docker-osx:latest# !!! Open Terminal inside macOS and run the following command to mount the virtual file system# sudo -S mount_9p hostshare
To share a folder using NFS, setup a folder for on the host machine, for example,/srv/nfs/share and then append to/etc/exports:
/srv/nfs/share 127.0.0.1/0(insecure,rw,all_squash,anonuid=1000,anongid=985,no_subtree_check)
You may need to reload exports now, which will begin sharing that directory.
# reload shared folderssudo exportfs -arvGive permissions on the shared folder for theanonuid andanongid, whereanonuid andanongid matches that of your linux user;id -u
id -u ; id -g will printuserid:groupid
chown 1000:985 /srv/nfs/sharechmod u+rwx /srv/nfs/shareStart the Docker-OSX container with the additional flag--network host
Create and mount the nfs folder from the mac terminal:
mkdir -p ~/mntsudo mount_nfs -o locallocks 10.0.2.2:/srv/nfs/share ~/mntStart your container.
Pick a port, for example,7700.
lsusb to getvid:pid
On Linux:sudo usbredirserver -p 7700 1e3d:2096
Now, in the Docker window hit Enter to see the(qemu) console.
You can add/remove the disk using commands like this, even once the machine is started:
chardev-add socket,id=usbredirchardev1,port=7700,host=172.17.0.1
device_add usb-redir,chardev=usbredirchardev1,id=usbredirdev1,debug=4
PORT=7700IP_ADDRESS=172.17.0.1-e EXTRA="-chardev socket,id=usbredirchardev1,port=${PORT},host=${IP_ADDRESS} -device usb-redir,chardev=usbredirchardev1,id=usbredirdev1,debug=4"\`
Fedora's default firewall settings may prevent Docker's network interface from reaching the internet. In order to resolve this, you will need to whitelist the interface in your firewall:
# Set the docker0 bridge to the trusted zonesudo firewall-cmd --permanent --zone=trusted --add-interface=docker0sudo firewall-cmd --reloadCheck if your machine has hardware virtualization enabled:
sudo tee /sys/module/kvm/parameters/ignore_msrs<<<1egrep -c'(svm|vmx)' /proc/cpuinfo
-e NETWORKING=vmxnet3
-e NETWORKING=e1000-82545em
- Start the container as usual, and remove unnecessary files. A useful wayto do this is to use
du -sh *starting from the/directory, and findlarge directories where files can be removed. E.g. unnecessary cached files,Xcode platforms, etc. - Once you are satisfied with the amount of free space, enable trim with
sudo trimforce enable, and reboot. - Zero out the empty space on the disk with
dd if=/dev/zero of=./empty && rm -f empty - Shut down the VM and copy out the qcow image with
docker cp stoppedcontainer:/home/arch/OSX-KVM/mac_hdd_ng.img . - Run
qemu-img check -r all mac_hdd_ng.imgto fix any errors. - Run
qemu-img convert -O qcow2 mac_hdd_ng.img deduped.imgand check for errors again - OPTIONAL: Run
qemu-img convert -c -O qcow2 deduped.img compressed.imgto further compress the image. This may reduce the runtime speed though, but it should reduce the size by roughly 25%. - Check for errors again, and build a fresh docker image. E.g. with this Dockerfile
FROM sickcodes/docker-osxUSER archCOPY --chown=arch ./deduped.img /home/arch/OSX-KVM/mac_hdd_ng.imgFirst make sureautoboot is enabled
Next, you will want to set up SSH to be automatically started.
sudo systemsetup -setremotelogin on
Make sure to commit the new docker image and save it, or rebuild as described in thesection on reducing disk space.
Then run it with these arguments.
# Run with the -nographic flag, and enable a telnet interface docker run \ --device /dev/kvm \ -p 50922:10022 \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e EXTRA="-monitor telnet::45454,server,nowait -nographic -serial null" \ mycustomimage
If you are building Docker-OSX locally, you'll probably want to use Arch Linux's mirrors.
Mirror locations can be found here (uses two-letter country codes):https://archlinux.org/mirrorlist/all/
docker build -t docker-osx:latest \ --build-arg RANKMIRRORS=true \ --build-arg MIRROR_COUNTRY=US \ --build-arg MIRROR_COUNT=10 \ --build-arg SHORTNAME=catalina \ --build-arg SIZE=200G.Pass any devices/directories to the Docker container & the QEMU arguments using the handy runtime argument provider option-e EXTRA=.
# example customizationsdocker run \ -e RAM=4 \ -e SMP=4 \ -e CORES=4 \ -e EXTRA='-usb -device usb-host,hostbus=1,hostaddr=8' \ -e INTERNAL_SSH_PORT=23 \ -e MAC_ADDRESS="$(xxd -c1 -p -l 6 /dev/urandom| tr'\n'':'| cut -c1-17)" \ -e AUDIO_DRIVER=alsa \ -e IMAGE_PATH=/image \ -e SCREEN_SHARE_PORT=5900 \ -e DISPLAY=:0 \ -e NETWORKING=vmxnet3 \ --device /dev/kvm \ --device /dev/snd \ -v /tmp/.X11-unix:/tmp/.X11-unix \ docker-osx:latest
Generate serial numbers in./custom OR make docker generate them at runtime (see below).
At any time, verify your serial number before logging into iCloud, etc.
# this is a quick way to check your serial number via cli inside OSXioreg -l| grep IOPlatformSerialNumber# test some commandssshpass -p'alpine' ssh user@localhost -p 50922'ping google.com'# check your serial numbersshpass -p'alpine' ssh user@localhost -p 50922'ioreg -l | grep IOPlatformSerialNumber'
# ARCHpacman -S libguestfs# UBUNTU DEBIANapt install libguestfs -y# RHEL FEDORA CENTOSyum install libguestfs -y
Inside the./custom folder you will find4 scripts.
config-nopicker-custom.plistopencore-image-ng.sh
These two files are from OSX-KVM.
You don't need to touch these two files.
The config.plist has 5 values replaced with placeholders.Click here to see those values for no reason.
generate-unique-machine-values.shThis script will generate serial numbers, with Mac Addresses, plus output to CSV/TSV, plus make abootdisk image.
You can create hundreds,./custom/generate-unique-machine-values.sh --help
./custom/generate-unique-machine-values.sh \ --count 1 \ --tsv ./serial.tsv \ --bootdisks \ --output-bootdisk OpenCore.qcow2 \ --output-env source.env.sh
Or if you have some specific serial numbers...
generate-specific-bootdisk.sh
generate-specific-bootdisk.sh \ --model"${DEVICE_MODEL}" \ --serial"${SERIAL}" \ --board-serial"${BOARD_SERIAL}" \ --uuid"${UUID}" \ --mac-address"${MAC_ADDRESS}" \ --output-bootdisk OpenCore-nopicker.qcow2
# proof of concept only, generates random serial numbers, headlessly, and quits right after.docker run --rm -it \ --device /dev/kvm \ -p 50922:10022 \ -e NOPICKER=true \ -e GENERATE_UNIQUE=true \ -e DEVICE_MODEL="iMacPro1,1" \ sickcodes/docker-osx:auto# -e OSX_COMMANDS='ioreg -l | grep IOPlatformSerialNumber' \
# run the same as above 17gb auto image, with SSH, with nopicker, and save the bootdisk for later.# you don't need to save the bootdisk IF you supply specific serial numbers!docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -e NOPICKER=true \ -e GENERATE_SPECIFIC=true \ -e DEVICE_MODEL="iMacPro1,1" \ -e SERIAL="C02TW0WAHX87" \ -e BOARD_SERIAL="C027251024NJG36UE" \ -e UUID="5CCB366D-9118-4C61-A00A-E5BAF3BED451" \ -e MAC_ADDRESS="A8:5C:2C:9A:46:2F" \ -e OSX_COMMANDS='ioreg -l | grep IOPlatformSerialNumber' \ sickcodes/docker-osx:auto
This example generates a specific set of serial numbers at runtime, with your existing image, at 1000x1000 display resolution
# run an existing image in current directory, with a screen, with SSH, with nopicker.stat mac_hdd_ng.img# make sure you have an image if you're using :nakeddocker run -it \ -v"${PWD}/mac_hdd_ng.img:/image" \ --device /dev/kvm \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -p 50922:10022 \ -e NOPICKER=true \ -e GENERATE_SPECIFIC=true \ -e DEVICE_MODEL="iMacPro1,1" \ -e SERIAL="C02TW0WAHX87" \ -e BOARD_SERIAL="C027251024NJG36UE" \ -e UUID="5CCB366D-9118-4C61-A00A-E5BAF3BED451" \ -e MAC_ADDRESS="A8:5C:2C:9A:46:2F" \ -e WIDTH=1000 \ -e HEIGHT=1000 \ sickcodes/docker-osx:naked
If you want to generate serial numbers, either make them at runtime using -e GENERATE_UNIQUE=true \
Or you can generate them inside the./custom folder. And then use:
-e GENERATE_SPECIFIC=true \ -e SERIAL="" \ -e BOARD_SERIAL="" \ -e UUID="" \ -e MAC_ADDRESS="" \
stat mac_hdd_ng_testing.imgtouch ./output.env# generate fresh random serial numbers, with a screen, using your own image, and save env file with your new serial numbers for later.docker run -it \ --device /dev/kvm \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -p 50922:10022 \ -e NOPICKER=true \ -e GENERATE_UNIQUE=true \ -e GENERATE_SPECIFIC=true \ -e DEVICE_MODEL="iMacPro1,1" \ -v"${PWD}/output.env:/env" \ -v"${PWD}/mac_hdd_ng_testing.img:/image" \ sickcodes/docker-osx:naked
To use iMessage or iCloud you need to change5 values.
SERIALBOARD_SERIALUUIDMAC_ADDRESS
ROM is just the lowercased mac address, without: between each word.
You can tell the container to generate them for you using-e GENERATE_UNIQUE=true
Or tell the container to use specific ones using-e GENERATE_SPECIFIC=true
-e GENERATE_SPECIFIC=true \ -e DEVICE_MODEL="iMacPro1,1" \ -e SERIAL="C02TW0WAHX87" \ -e BOARD_SERIAL="C027251024NJG36UE" \ -e UUID="5CCB366D-9118-4C61-A00A-E5BAF3BED451" \ -e MAC_ADDRESS="A8:5C:2C:9A:46:2F" \
The display resolution is controlled by this line:
https://github.com/sickcodes/Docker-OSX/blob/master/custom/config-nopicker-custom.plist#L819
Instead of mounting that disk, Docker-OSX will generate a newOpenCore.qcow2 by using this one cool trick:
-e GENERATE_UNIQUE=true \-e WIDTH=800 \-e HEIGHT=600 \
To useWIDTH/HEIGHT, you must use with either-e GENERATE_UNIQUE=true or-e GENERATE_SPECIFIC=true.
It will take around 30 seconds longer to boot because it needs to make a new boot partition usinglibguestfs.
-e GENERATE_SPECIFIC=true \-e WIDTH=1920 \-e HEIGHT=1080 \-e SERIAL="" \-e BOARD_SERIAL="" \-e UUID="" \-e MAC_ADDRESS="" \
# using an image in your current directorystat mac_hdd_ng.imgdocker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v"${PWD}/mac_hdd_ng.img:/image" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e GENERATE_SPECIFIC=true \ -e DEVICE_MODEL="iMacPro1,1" \ -e SERIAL="C02TW0WAHX87" \ -e BOARD_SERIAL="C027251024NJG36UE" \ -e UUID="5CCB366D-9118-4C61-A00A-E5BAF3BED451" \ -e MAC_ADDRESS="A8:5C:2C:9A:46:2F" \ -e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/custom/config-nopicker-custom.plist \ -e WIDTH=1600 \ -e HEIGHT=900 \ sickcodes/docker-osx:naked
# generating random serial numbers, using the DIY installer, along with the screen resolution changes.docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e GENERATE_UNIQUE=true \ -e WIDTH=800 \ -e HEIGHT=600 \ sickcodes/docker-osx:latest
Here's a few other resolutions! If your resolution is invalid, it will default to 800x600.
-e WIDTH=800 \ -e HEIGHT=600 \ -e WIDTH=1280 \ -e HEIGHT=768 \ -e WIDTH=1600 \ -e HEIGHT=900 \ -e WIDTH=1920 \ -e HEIGHT=1080 \ -e WIDTH=2560 \ -e HEIGHT=1600 \First step is to stop the docker daemon
sudo systemctl stop dockerThe second step is to change container config in
/var/lib/docker/containers/[container-id]/config.v2.json(Suppose your original WIDTH is 1024 and HEIGHT is 768, you can search 1024 and replace it with the new value. Same for 768.)
The last step is to restart the docker daemon
sudo systemctl restart dockerPass the disk into the container as a volume and then pass the disk again into QEMU command line extras with.
Use theconfig-custom.plist because you probably want to see the boot menu, otherwise omit the first line:
DISK_TWO="${PWD}/mount_me.img"-e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \-v"${DISK_TWO}:/disktwo" \-e EXTRA='-device ide-hd,bus=sata.5,drive=DISK-TWO -drive id=DISK-TWO,if=none,file=/disktwo,format=qcow2' \
OSX_IMAGE="${PWD}/mac_hdd_ng_xcode_bigsur.img"DISK_TWO="${PWD}/mount_me.img"docker run -it \ --device /dev/kvm \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \ -v"${OSX_IMAGE}":/image \ -v"${DISK_TWO}":/disktwo \ -e EXTRA='-device ide-hd,bus=sata.5,drive=DISK-TWO -drive id=DISK-TWO,if=none,file=/disktwo,format=qcow2' \ sickcodes/docker-osx:naked
See also:here.
In Docker-OSX, we are usingqcow2 images.
This means the image grows as you use it, but the guest OS thinks you have 200GB available.
READ ONLY
# mount the qemu image like a real disksudo modprobe nbd max_part=8sudo qemu-nbd --connect=/dev/nbd0 ./image.imgsudo fdisk /dev/nbd0 -lmkdir -p ./mntsudo mount /dev/nbd0p1 ./mnt# inspect partitions (2 partitions)sudo fdisk /dev/nbd0 -l# mount using apfs-linux-rw OR apfs-fusemkdir -p ./partsudo mount /dev/nbd0p2 ./partsudo apfs-fuse -o allow_other /dev/nbd0p2 ./part
When you are finishing looking at your disk, you can unmount the partition, the disk, and remove the loopback device:
sudo umount ./partsudo umount ./mntsudo qemu-nbd --disconnect /dev/nbd0sudo rmmod nbd
Firstly, QEMU must be started as root.
It is also potentially possible to accomplish USB passthrough by changing the permissions of the device in the container.Seehere.
For example, create a new Dockerfile with the following
FROM sickcodes/docker-osxUSER archRUN sed -i -e s/exec\qemu/exec\sudo\qemu/ ./Launch.shCOPY --chown=arch ./new_image.img /home/arch/OSX-KVM/mac_hdd_ng.img
Wherenew_image.img is the qcow2 image you extracted. Then rebuild withdocker build .
Next we need to find out the bus and port numbers of the USB device we want to pass through to the VM:
lsusb -t/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/6p, 5000M/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/12p, 480M|__ Port 2: Dev 5, If 0, Class=Human Interface Device, Driver=usbhid, 12M|__ Port 2: Dev 5, If 1, Class=Chip/SmartCard, Driver=, 12M|__ Port 3: Dev 2, If 0, Class=Wireless, Driver=, 12M|__ Port 3: Dev 2, If 1, Class=Wireless, Driver=, 12M|__ Port 5: Dev 3, If 0, Class=Video, Driver=uvcvideo, 480M|__ Port 5: Dev 3, If 1, Class=Video, Driver=uvcvideo, 480M
In this example, we want to pass through a smartcard device. The device we want is on bus 1 and port 2.
There may also be differences if your device is usb 2.0 (ehci) vs usb 3.0 (xhci).Seehere for more details.
# hostbus and hostport correspond to the numbers from lsusb# runs in privileged mode to enable access to the usb devices.docker run \ --privileged \ --device /dev/kvm \ -e RAM=4 \ -p 50922:10022 \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e EXTRA="-device virtio-serial-pci -device usb-host,hostbus=1,hostport=2" \ mycustomimage
You should see the device show up when you dosystem_profiler SPUSBDataType in the MacOS shell.
Important Note: this will cause the host system to lose access to the USB device while the VM is running!
This is my favourite container. You can supply an existing disk image as a Docker command line argument.
Pull images out using
sudo find /var/lib/docker -name mac_hdd_ng.img -size +10GSupply your own local image with the command argument
-v "${PWD}/mac_hdd_ng.img:/image"and usesickcodes/docker-osx:nakedwhen instructing Docker to create your container.Naked image is for booting any existing .img file, e.g in the current working directory (
$PWD)By default, this image has a variable called
NOPICKERwhich is"true". This skips the disk selection menu. Use-e NOPICKER=falseor any other string than the wordtrueto enter the boot menu.This lets you use other disks instead of skipping the boot menu, e.g. recovery disk or disk utility.
docker pull sickcodes/docker-osx:naked# run your own image + SSH# change mac_hdd_ng.imgdocker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v"${PWD}/mac_hdd_ng.img:/image" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:naked# run local copy of the auto image + SSH + Boot menudocker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v"${PWD}/mac_hdd_ng_auto.img:/image" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e"NOPICKER=false" \ sickcodes/docker-osx:naked
The Quick Start command should work out of the box, provided that you keep the following lines. Works inauto &naked machines:
-v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \-e OSX_COMMANDS lets you run any commands inside the container
docker pull sickcodes/docker-osx:auto# boot to OS X shell + display + specify commands to run inside OS X!docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e"OSX_COMMANDS=/bin/bash -c\"put your commands here\"" \ sickcodes/docker-osx:auto# Boots in a minute or two!
OR if you have an image already and just want to log in and execute arbitrary commands:
docker pull sickcodes/docker-osx:naked-auto# boot to OS X shell + display + specify commands to run inside OS X!docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e USERNAME=yourusername \ -e PASSWORD=yourpassword \ -e"OSX_COMMANDS=/bin/bash -c\"put your commands here\"" \ sickcodes/docker-osx:naked-auto# Boots in a minute or two!
There's a myriad of other potential use cases that can work perfectly with Docker-OSX, some of which you'll see below!
For a headless container,remove the following two lines from yourdocker run command:
# -v /tmp/.X11-unix:/tmp/.X11-unix \ # -e "DISPLAY=${DISPLAY:-:0.0}" \This is particularly helpful for CI/CD pipelines.
# run your own image headless + SSHdocker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v"${PWD}/mac_hdd_ng.img:/image" \ sickcodes/docker-osx:naked
Must change -it to -i to be able to interact with the QEMU console
To exit a container using -i you mustdocker kill <containerid>. For example, to kill everything,docker ps | xargs docker kill.
Native QEMU VNC example
docker run -i \ --device /dev/kvm \ -p 50922:10022 \ -p 5999:5999 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e EXTRA="-display none -vnc 0.0.0.0:99,password=on" \ sickcodes/docker-osx:big-sur# type `change vnc password myvncusername` into the docker terminal and set a password# connect to localhost:5999 using VNC# qemu 6 seems to require a username for vnc now
NOT TLS/HTTPS Encrypted at all!
Orssh -N root@1.1.1.1 -L 5999:127.0.0.1:5999, where1.1.1.1 is your remote server IP.
(Note: if you close port 5999 and use the SSH tunnel, this becomes secure.)
Add the following line:
-e EXTRA="-display none -vnc 0.0.0.0:99,password=on"
In the Docker terminal, pressenter until you see(qemu).
Typechange vnc password someusername
Enter a password for your new vnc username^.
You also need the container IP:docker inspect <containerid> | jq -r '.[0].NetworkSettings.IPAddress'
Orip n will usually show the container IP first.
Now VNC connects using the Docker container IP, for example172.17.0.2:5999
Remote VNC over SSH:ssh -N root@1.1.1.1 -L 5999:172.17.0.2:5999, where1.1.1.1 is your remote server IP and172.17.0.2 is your LAN container IP.
Now you can direct connect VNC to any container built with this command!
Optionally, you can enable the SPICE protocol, which allows use ofremote-viewer to access your OSX container rather than VNC.
Note:-disable-ticketing will allow unauthenticated access to the VM. See thespice manual for help setting up authenticated access ("Ticketing").
docker run \ --device /dev/kvm \ -p 3001:3001 \ -p 50922:10022 \ -e"DISPLAY=${DISPLAY:-:0.0}" \ -e EXTRA="-monitor telnet::45454,server,nowait -nographic -serial null -spice disable-ticketing,port=3001" \ mycustomimage
Then simply doremote-viewer spice://localhost:3001 and add--spice-debug for debugging.
# You can create an image of an already configured and setup container.# This allows you to effectively duplicate a system.# To do this, run the following commands# make note of your container iddocker ps --alldocker commit containerid newImageName# To run this image do the followingdocker run \ --device /dev/kvm \ --device /dev/snd \ -v /tmp/.X11-unix:/tmp/.X11-unix \ newImageName
docker pull sickcodes/docker-osx:auto# boot directly into a real OS X shell with no display (Xvfb) [HEADLESS]docker run -it \ --device /dev/kvm \ -p 50922:10022 \ sickcodes/docker-osx:auto# username is user# password is alpine# Wait 2-3 minutes until you drop into the shell.
docker pull sickcodes/docker-osx:latestdocker run -it \ --device /dev/kvm \ --device /dev/snd \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:latest# press CTRL + G if your mouse gets stuck# scroll down to troubleshooting if you have problems# need more RAM and SSH on localhost -p 50922?
docker run -it \ --device /dev/kvm \ --device /dev/snd \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e"DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:latest# turn on SSH after you've installed OS X in the "Sharing" settings.ssh user@localhost -p 50922
Add the extra option-e NOPICKER=true.
Old machines:
# find your containerIDdocker ps# move the no picker script on top of the Launch script# NEW CONTAINERSdockerexec containerID mv ./Launch-nopicker.sh ./Launch.sh# VNC-VERSION-CONTAINERdockerexec containerID mv ./Launch-nopicker.sh ./Launch_custom.sh# LEGACY CONTAINERSdockerexec containerID bash -c"grep -v InstallMedia ./Launch.sh > ./Launch-nopicker.shchmod +x ./Launch-nopicker.shsed -i -e s/OpenCore\.qcow2/OpenCore\-nopicker\.qcow2/ ./Launch-nopicker.sh"
Automatic updates are still on in the container's settings. You may wish to turn them off.We have future plans for development around this.
$DISPLAY is the shell variable that refers to your X11 display server.
${DISPLAY} is the same, but allows you to join variables like this:
- e.g.
${DISPLAY}_${DISPLAY}would print:0.0_:0.0 - e.g.
$DISPLAY_$DISPLAYwould print:0.0
...because$DISPLAY_ is not$DISPLAY
${variable:-fallback} allows you to set a "fallback" variable to be substituted if$variable is not set.
You can also use${variable:=fallback} to set that variable (in your current terminal).
In Docker-OSX, we assume,:0.0 is your default$DISPLAY variable.
You can see what yours is
echo$DISPLAY
That way,${DISPLAY:-:0.0} will use whatever variable your X11 server has set for you, else:0.0
-v is a Docker command-line option that lets you pass a volume to the container.
The directory that we are letting the Docker container use is a X server display socket.
/tmp/.X11-unix
If we let the Docker container use the same display socket as our own environment, then any applications you run inside the Docker container will show up on your screen too!https://www.x.org/archive/X11R6.8.0/doc/RELNOTES5.html
You may when initialising or booting into a container see errors from the(qemu) console of the following form:ALSA lib blahblahblah: (function name) returned error: no such file or directory. These are more or less expected. As long as you are able to boot into the container and everything is working, no reason to worry about these.
See also:here.
About
Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.
Topics
Resources
License
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Releases
Sponsor this project
Uh oh!
There was an error while loading.Please reload this page.
Packages0
Uh oh!
There was an error while loading.Please reload this page.