{"id":13437406,"url":"https://github.com/sickcodes/Docker-OSX","last_synced_at":"2025-03-19T06:31:09.206Z","repository":{"id":37671654,"uuid":"269336148","full_name":"sickcodes/Docker-OSX","owner":"sickcodes","description":"Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.","archived":false,"fork":false,"pushed_at":"2024-11-18T15:00:58.000Z","size":13803,"stargazers_count":49954,"open_issues_count":390,"forks_count":2790,"subscribers_count":447,"default_branch":"master","last_synced_at":"2025-03-18T02:04:44.688Z","etag":null,"topics":["container","docker","docker-osx","kvm","macos","os","osx","osx-kvm","x","x11"],"latest_commit_sha":null,"homepage":"https://hub.docker.com/r/sickcodes/docker-osx","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sickcodes.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"sickcodes"}},"created_at":"2020-06-04T11:01:37.000Z","updated_at":"2025-03-17T23:20:47.000Z","dependencies_parsed_at":"2023-02-13T01:45:59.253Z","dependency_job_id":"410f631c-9ead-4870-b223-9d096c5accb4","html_url":"https://github.com/sickcodes/Docker-OSX","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sickcodes%2FDocker-OSX","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sickcodes%2FDocker-OSX/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sickcodes%2FDocker-OSX/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sickcodes%2FDocker-OSX/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sickcodes","download_url":"https://codeload.github.com/sickcodes/Docker-OSX/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244371033,"owners_count":20442330,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["container","docker","docker-osx","kvm","macos","os","osx","osx-kvm","x","x11"],"created_at":"2024-07-31T03:00:56.711Z","updated_at":"2025-03-19T06:31:09.194Z","avatar_url":"https://github.com/sickcodes.png","language":"Shell","readme":"# Docker-OSX · [Follow @sickcodes on Twitter](https://twitter.com/sickcodes)\n\n![Running Mac OS X in a Docker container](/running-mac-inside-docker-qemu.png?raw=true \"OSX KVM DOCKER\")\n\nRun Mac OS X in Docker with near-native performance! X11 Forwarding! iMessage security research! iPhone USB working! macOS in a Docker container!\n\nConduct Security Research on macOS using both Linux \u0026 Windows!\n\n# Docker-OSX now has a Discord server \u0026 Telegram!\n\nThe Discord is active on #docker-osx and anyone is welcome to come and ask questions, ideas, etc.\n\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"https://hub.docker.com/r/sickcodes/docker-osx\"\u003e\u003cimg src=\"https://dockeri.co/image/sickcodes/docker-osx\"/\u003e\u003c/a\u003e\u003ca href=\"https://discord.gg/sickchat\"\u003e\u003ca href=\"https://discord.gg/sickchat\" target=\"_blank\"\u003e\u003cimg src=\"https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/discord-logo.svg\"\u003e\u003c/a\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\n### Click to join the Discord server [https://discord.gg/sickchat](https://discord.gg/sickchat)\n\n### Click to join the Telegram server [https://t.me/sickcodeschat](https://t.me/sickcodeschat)\n\nOr reach out via Linkedin if it's private: [https://www.linkedin.com/in/sickcodes](https://www.linkedin.com/in/sickcodes)\n\nOr via [https://sick.codes/contact/](https://sick.codes/contact/)\n\n## Author\n\nThis project is maintained by [Sick.Codes](https://sick.codes/). [(Twitter)](https://twitter.com/sickcodes)\n\nAdditional credits can be found here: https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md\n\nAdditionally, comprehensive list of all contributors can be found here: https://github.com/sickcodes/Docker-OSX/graphs/contributors\n\nBig thanks to [@kholia](https://twitter.com/kholia) for maintaining the upstream project, which Docker-OSX is built on top of: [OSX-KVM](https://github.com/kholia/OSX-KVM).\n\nAlso special thanks to [@thenickdude](https://github.com/thenickdude) who maintains the valuable fork [KVM-OpenCore](https://github.com/thenickdude/KVM-Opencore), which was started by [@Leoyzen](https://github.com/Leoyzen/)!\n\nExtra special thanks to the OpenCore team over at: https://github.com/acidanthera/OpenCorePkg. Their well-maintained bootloader provides much of the great functionality that Docker-OSX users enjoy :)\n\nIf you like this project, consider contributing here or upstream!\n\n## Quick Start Docker-OSX\n\nVideo setup tutorial is also available here: https://www.youtube.com/watch?v=wLezYl77Ll8\n\n**Windows users:** [click here to see the notes below](#id-like-to-run-docker-osx-on-windows)!\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://www.youtube.com/watch?v=wLezYl77Ll8\" target=\"_blank\"\u003e\u003cimg src=\"https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/Youtube-Screenshot-Docker-OSX-Setup.png\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\nFirst time here? try [initial setup](#initial-setup), otherwise try the instructions below to use either Catalina or Big Sur.\n\n## Any questions, ideas, or just want to hang out?\n# [https://discord.gg/sickchat](https://discord.gg/sickchat)\n\nRelease names and their version:\n\n### Catalina (10.15) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n```bash\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e SHORTNAME=catalina \\\n    sickcodes/docker-osx:latest\n\n# docker build -t docker-osx .\n```\n### Big Sur (11) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/big-sur?label=sickcodes%2Fdocker-osx%3Abig-sur](https://img.shields.io/docker/image-size/sickcodes/docker-osx/big-sur?label=sickcodes%2Fdocker-osx%3Abig-sur)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n```bash\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e SHORTNAME=big-sur \\\n    sickcodes/docker-osx:latest\n\n# docker build -t docker-osx .\n```\n\n### Monterey (12) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/monterey?label=sickcodes%2Fdocker-osx%3Amonterey](https://img.shields.io/docker/image-size/sickcodes/docker-osx/monterey?label=sickcodes%2Fdocker-osx%3Amonterey)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n```bash\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e GENERATE_UNIQUE=true \\\n    -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \\\n    -e SHORTNAME=monterey \\\n    sickcodes/docker-osx:latest\n\n# docker build -t docker-osx .\n```\n\n### Ventura (13) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/ventura?label=sickcodes%2Fdocker-osx%3Aventura](https://img.shields.io/docker/image-size/sickcodes/docker-osx/ventura?label=sickcodes%2Fdocker-osx%3Aventura)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n```bash\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e GENERATE_UNIQUE=true \\\n    -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \\\n    -e SHORTNAME=ventura \\\n    sickcodes/docker-osx:latest\n\n# docker build -t docker-osx .\n```\n\n### Sonoma (14) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/sonoma?label=sickcodes%2Fdocker-osx%3Asonoma](https://img.shields.io/docker/image-size/sickcodes/docker-osx/sonoma?label=sickcodes%2Fdocker-osx%3Asonoma)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n```bash\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e GENERATE_UNIQUE=true \\\n    -e CPU='Haswell-noTSX' \\\n    -e CPUID_FLAGS='kvm=on,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on' \\\n    -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom-sonoma.plist' \\\n    -e SHORTNAME=sonoma \\\n    sickcodes/docker-osx:latest\n\n# docker build -t docker-osx .\n```\n\n#### Run Catalina Pre-Installed [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/auto?label=sickcodes%2Fdocker-osx%3Aauto](https://img.shields.io/docker/image-size/sickcodes/docker-osx/auto?label=sickcodes%2Fdocker-osx%3Aauto)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n```bash\n# 40GB disk space required: 20GB original image 20GB your container.\ndocker pull sickcodes/docker-osx:auto\n\n# boot directly into a real OS X shell with a visual display [NOT HEADLESS]\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e GENERATE_UNIQUE=true \\\n    sickcodes/docker-osx:auto\n\n# username is user\n# password is alpine\n```\n\n### Older Systems\n\n### High Sierra [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/high-sierra?label=sickcodes%2Fdocker-osx%3Ahigh-sierra](https://img.shields.io/docker/image-size/sickcodes/docker-osx/high-sierra?label=sickcodes%2Fdocker-osx%3Ahigh-sierra)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n```bash\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e SHORTNAME=high-sierra \\\n    sickcodes/docker-osx:latest\n\n# docker build -t docker-osx .\n```\n\n### Mojave [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/mojave?label=sickcodes%2Fdocker-osx%3Amojave](https://img.shields.io/docker/image-size/sickcodes/docker-osx/mojave?label=sickcodes%2Fdocker-osx%3Amojave)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n```bash\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e SHORTNAME=mojave \\\n    sickcodes/docker-osx:latest\n\n# docker build -t docker-osx .\n```\n\n\n\n#### Download the image manually and use it in Docker \n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked](https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n\nThis is a particularly good way for downloading the container, in case Docker's CDN (or your connection) happens to be slow.\n\n```bash\nwget https://images2.sick.codes/mac_hdd_ng_auto.img\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v \"${PWD}/mac_hdd_ng_auto.img:/image\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e GENERATE_UNIQUE=true \\\n    -e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/custom/config-nopicker-custom.plist \\\n    -e SHORTNAME=catalina \\\n    sickcodes/docker-osx:naked\n```\n\n\n#### Use your own image and manually and automatically log into a shell\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked-auto?label=sickcodes%2Fdocker-osx%3Anaked-auto](https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked-auto?label=sickcodes%2Fdocker-osx%3Anaked-auto)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n\nEnable SSH in network sharing inside the guest first. Change `-e \"USERNAME=user\"` and `-e \"PASSWORD=password\"` to your credentials. The container will add itself to `~/.ssh/authorized_keys`\n\nSince you can't see the screen, use the PLIST with nopicker, for example:\n\n```bash\n# Catalina\n# wget https://images2.sick.codes/mac_hdd_ng_auto.img\n# Monterey\nwget https://images.sick.codes/mac_hdd_ng_auto_monterey.img\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v \"${PWD}/mac_hdd_ng_auto_monterey.img:/image\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e \"USERNAME=user\" \\\n    -e \"PASSWORD=alpine\" \\\n    -e GENERATE_UNIQUE=true \\\n    -e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/custom/config-nopicker-custom.plist \\\n    -e SHORTNAME=monterey \\\n    sickcodes/docker-osx:naked-auto\n```\n\n# Share directories, sharing files, shared folder, mount folder\nThe easiest and most secure way is `sshfs`\n```bash\n# on Linux/Windows\nmkdir ~/mnt/osx\nsshfs user@localhost:/ -p 50922 ~/mnt/osx\n# wait a few seconds, and ~/mnt/osx will have full rootfs mounted over ssh, and in userspace\n# automated: sshpass -p \u003cpassword\u003e sshfs user@localhost:/ -p 50922 ~/mnt/osx\n```\n\n\n# (VFIO) iPhone USB passthrough (VFIO)\n\nIf you have a laptop see the next usbfluxd section.\n\nIf you have a desktop PC, you can use [@Silfalion](https://github.com/Silfalion)'s instructions: [https://github.com/Silfalion/Iphone_docker_osx_passthrough](https://github.com/Silfalion/Iphone_docker_osx_passthrough)\n\n# (USBFLUXD) iPhone USB -\u003e Network style passthrough OSX-KVM Docker-OSX\n\nVideo setup tutorial for usbfluxd is also available here: https://www.youtube.com/watch?v=kTk5fGjK_PM\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://www.youtube.com/watch?v=kTk5fGjK_PM\" target=\"_blank\"\u003e\u003cimg alt=\"iPhone USB passthrough on macOS virtual machine Linux \u0026 Windows\" src=\"https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/Youtube-USBFLUXD-Screenshot-Docker-OSX.png\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\nThis method WORKS on laptop, PC, anything!\n\nThank you [@nikias](https://github.com/nikias) for [usbfluxd](https://github.com/corellium/usbfluxd) via [https://github.com/corellium](https://github.com/corellium)!\n\n**This is done inside Linux.**\n\nOpen 3 terminals on Linux\n\nConnecting your device over USB on Linux allows you to expose `usbmuxd` on port `5000` using [https://github.com/corellium/usbfluxd](https://github.com/corellium/usbfluxd) to another system on the same network.\n\nEnsure `usbmuxd`, `socat` and `usbfluxd` are installed.\n\n`sudo pacman -S libusbmuxd usbmuxd avahi socat`\n\nAvailable on the AUR: [https://aur.archlinux.org/packages/usbfluxd/](https://aur.archlinux.org/packages/usbfluxd/)\n\n`yay usbfluxd`\n\nPlug in your iPhone or iPad.\n\nTerminal 1\n```bash\nsudo systemctl start usbmuxd\nsudo avahi-daemon\n```\n\nTerminal 2:\n```bash\n# on host\nsudo systemctl restart usbmuxd\nsudo socat tcp-listen:5000,fork unix-connect:/var/run/usbmuxd\n```\n\nTerminal 3:\n```bash\nsudo usbfluxd -f -n\n```\n\n### Connect to a host running usbfluxd\n\n**This is done inside macOS.**\n\nInstall homebrew.\n\n`172.17.0.1` is usually the Docker bridge IP, which is your PC, but you can use any IP from `ip addr`...\n\nmacOS Terminal:\n```zsh\n# on the guest\nbrew install make automake autoconf libtool pkg-config gcc libimobiledevice usbmuxd\n\ngit clone https://github.com/corellium/usbfluxd.git\ncd usbfluxd\n\n./autogen.sh\nmake\nsudo make install\n```\n\nAccept the USB over TCP connection, and appear as local:\n\n(you may need to change `172.17.0.1` to the IP address of the host. e.g. check `ip addr`)\n\n```bash\n# on the guest\nsudo launchctl start usbmuxd\nexport PATH=/usr/local/sbin:${PATH}\nsudo usbfluxd -f -r 172.17.0.1:5000\n```\n\nClose apps such as Xcode and reopen them and your device should appear!\n\n*If you need to start again on Linux, wipe the current usbfluxd, usbmuxd, and socat:*\n```bash\nsudo killall usbfluxd\nsudo systemctl restart usbmuxd\nsudo killall socat\n```\n\n## Make container FASTER using [https://github.com/sickcodes/osx-optimizer](https://github.com/sickcodes/osx-optimizer)\n\nSEE commands in [https://github.com/sickcodes/osx-optimizer](https://github.com/sickcodes/osx-optimizer)!\n\n- Skip the GUI login screen (at your own risk!)\n- Disable spotlight indexing on macOS to heavily speed up Virtual Instances.\n- Disable heavy login screen wallpaper\n- Disable updates (at your own risk!)\n\n## Increase disk space by moving /var/lib/docker to external drive, block storage, NFS, or any other location conceivable.\n\nMove /var/lib/docker, following the tutorial below\n\n- Cheap large physical disk storage instead using your server's disk, or SSD.\n- Block Storage, NFS, etc.\n\nTutorial here: https://sick.codes/how-to-run-docker-from-block-storage/\n\nOnly follow the above tutorial if you are happy with wiping all your current Docker images/layers.\n\nSafe mode: Disable docker temporarily so you can move the Docker folder temporarily.\n\n- Do NOT do this until you have moved your image out already [https://github.com/dulatello08/Docker-OSX/#quick-start-your-own-image-naked-container-image](https://github.com/dulatello08/Docker-OSX/#quick-start-your-own-image-naked-container-image)\n\n```bash\nkillall dockerd\nsystemctl disable --now docker\nsystemctl disable --now docker.socket\nsystemctl stop docker\nsystemctl stop docker.socket\n```\nNow, that Docker daemon is off, move /var/lib/docker somewhere\n\nThen, symbolicly link /var/lib/docker somewhere:\n\n```bash\nmv /var/lib/docker /run/media/user/some_drive/docker\nln -s /run/media/user/some_drive/docker /var/lib/docker\n\n# now check if /var/lib/docker is working still\nls /var/lib/docker\n```\nIf you see folders, then it worked. You can restart Docker, or just reboot if you want to be sure.\n\n## Important notices:\n\n**2021-11-14** - Added High Sierra, Mojave\n\nPick one of these while **building**, irrelevant when using docker pull:\n```\n--build-arg SHORTNAME=high-sierra \n--build-arg SHORTNAME=mojave\n--build-arg SHORTNAME=catalina\n--build-arg SHORTNAME=big-sur\n--build-arg SHORTNAME=monterey\n--build-arg SHORTNAME=ventura\n--build-arg SHORTNAME=sonoma\n```\n\n\n## Technical details\n\nThere are currently multiple images, each with different use cases (explained [below](#container-images)):\n\n- High Sierra (10.13)\n- Mojave (10.14)\n- Catalina (10.15)\n- Big Sur (11)\n- Monterey (12)\n- Ventura (13)\n- Sonoma (14)\n- Auto (pre-made Catalina)\n- Naked (use your own .img)\n- Naked-Auto (user your own .img and SSH in)\n\nHigh Sierra:\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/high-sierra?label=sickcodes%2Fdocker-osx%3Ahigh-sierra](https://img.shields.io/docker/image-size/sickcodes/docker-osx/high-sierra?label=sickcodes%2Fdocker-osx%3Ahigh-sierra)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nMojave:\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/mojave?label=sickcodes%2Fdocker-osx%3Amojave](https://img.shields.io/docker/image-size/sickcodes/docker-osx/mojave?label=sickcodes%2Fdocker-osx%3Amojave)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nCatalina:\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nBig-Sur:\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/big-sur?label=sickcodes%2Fdocker-osx%3Abig-sur](https://img.shields.io/docker/image-size/sickcodes/docker-osx/big-sur?label=sickcodes%2Fdocker-osx%3Abig-sur)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nMonterey make your own image:\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/monterey?label=sickcodes%2Fdocker-osx%3Amonterey](https://img.shields.io/docker/image-size/sickcodes/docker-osx/monterey?label=sickcodes%2Fdocker-osx%3Amonterey)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nVentura make your own image:\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/ventura?label=sickcodes%2Fdocker-osx%3Aventura](https://img.shields.io/docker/image-size/sickcodes/docker-osx/ventura?label=sickcodes%2Fdocker-osx%3Aventura)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nSonoma make your own image:\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/sonoma?label=sickcodes%2Fdocker-osx%3Asonoma](https://img.shields.io/docker/image-size/sickcodes/docker-osx/sonoma?label=sickcodes%2Fdocker-osx%3Asonoma)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nPre-made **Catalina** system by [Sick.Codes](https://sick.codes): username: `user`, password: `alpine`\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/auto?label=sickcodes%2Fdocker-osx%3Aauto](https://img.shields.io/docker/image-size/sickcodes/docker-osx/auto?label=sickcodes%2Fdocker-osx%3Aauto)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nNaked: Bring-your-own-image setup (use any of the above first):\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked](https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nNaked Auto: same as above but with `-e USERNAME` \u0026 `-e PASSWORD` and `-e OSX_COMMANDS=\"put your commands here\"`\n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked-auto?label=sickcodes%2Fdocker-osx%3Anaked-auto](https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked-auto?label=sickcodes%2Fdocker-osx%3Anaked-auto)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n## Capabilities\n- use iPhone OSX KVM on Linux using [usbfluxd](https://github.com/corellium/usbfluxd)!\n- macOS Monterey VM on Linux!\n- Folder sharing-\n- USB passthrough (hotplug too)\n- SSH enabled (`localhost:50922`)\n- VNC enabled (`localhost:8888`) if using ./vnc version\n- iMessage security research via [serial number generator!](https://github.com/sickcodes/osx-serial-generator)\n- X11 forwarding is enabled\n- runs on top of QEMU + KVM\n- supports Big Sur, custom images, Xvfb headless mode\n- you can clone your container with `docker commit`\n\n### Requirements\n\n- 20GB+++ disk space for bare minimum installation (50GB if using Xcode)\n- virtualization should be enabled in your BIOS settings\n- a x86_64 kvm-capable host\n- at least 50 GBs for `:auto` (half for the base image, half for your runtime image\n\n### TODO\n\n- documentation for security researchers\n- gpu acceleration\n- support for virt-manager\n\n## Docker\n\nImages built on top of the contents of this repository are also available on **Docker Hub** for convenience: https://hub.docker.com/r/sickcodes/docker-osx\n\nA comprehensive list of the available Docker images and their intended purpose can be found in the [Instructions](#instructions).\n\n## Kubernetes\n\nDocker-OSX supports Kubernetes.\n\nKubernetes Helm Chart \u0026 Documentation can be found under the [helm directory](helm/README.md).\n\nThanks [cephasara](https://github.com/cephasara) for contributing this major contribution.\n\n[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/docker-osx)](https://artifacthub.io/packages/search?repo=docker-osx)\n\n## Support\n\n### Small questions \u0026 issues\n\nFeel free to open an [issue](https://github.com/sickcodes/Docker-OSX/issues/new/choose), should you come across minor issues with running Docker-OSX or have any questions.\n\n#### Resolved issues\n\nBefore you open an issue, however, please check the [closed issues](https://github.com/sickcodes/Docker-OSX/issues?q=is%3Aissue+is%3Aclosed) and confirm that you're using the latest version of this repository — your issues may have already been resolved! You might also see your answer in our questions and answers section [below](#more-questions-and-answers).\n\n### Feature requests and updates\n\nFollow [@sickcodes](https://twitter.com/sickcodes)!\n\n### Professional support\n\nFor more sophisticated endeavours, we offer the following support services:\n\n- Enterprise support, business support, or casual support.\n- Custom images, custom scripts, consulting (per hour available!)\n- One-on-one conversations with you or your development team.\n\nIn case you're interested, contact [@sickcodes on Twitter](https://twitter.com/sickcodes) or click [here](https://sick.codes/contact).\n\n## License/Contributing\n\nDocker-OSX is licensed under the [GPL v3+](LICENSE). Contributions are welcomed and immensely appreciated. You are in fact permitted to use Docker-OSX as a tool to create proprietary software.\n\n### Other cool Docker/QEMU based projects\n- [Run Android in a Docker Container with Dock Droid](https://github.com/sickcodes/dock-droid)\n- [Run Android fully native on the host!](https://github.com/sickcodes/droid-native)\n- [Run iOS 12 in a Docker container with Docker-eyeOS](https://github.com/sickcodes/Docker-eyeOS) - [https://github.com/sickcodes/Docker-eyeOS](https://github.com/sickcodes/Docker-eyeOS)\n- [Run iMessage relayer in Docker with Bluebubbles.app](https://bluebubbles.app/) - [Getting started wiki](https://github.com/BlueBubblesApp/BlueBubbles-Server/wiki/Running-via-Docker)\n\n## Disclaimer\n\nIf you are serious about Apple Security, and possibly finding 6-figure bug bounties within the Apple Bug Bounty Program, then you're in the right place! Further notes: [Is Hackintosh, OSX-KVM, or Docker-OSX legal?](https://sick.codes/is-hackintosh-osx-kvm-or-docker-osx-legal/)\n\nProduct names, logos, brands and other trademarks referred to within this project are the property of their respective trademark holders. These trademark holders are not affiliated with our repository in any capacity. They do not sponsor or endorse this project in any way.\n\n# Instructions\n\n## Container images\n\n### Already set up or just looking to make a container quickly? Check out our [quick start](#quick-start-docker-osx) or see a bunch more use cases under our [container creation examples](#container-creation-examples) section.\n\nThere are several different Docker-OSX images available that are suitable for different purposes.\n\n- `sickcodes/docker-osx:latest` - [I just want to try it out.](#quick-start-docker-osx)\n- `sickcodes/docker-osx:latest` - [I want to use Docker-OSX to develop/secure apps in Xcode (sign into Xcode, Transporter)](#quick-start-your-own-image-naked-container-image)\n- `sickcodes/docker-osx:naked` - [I want to use Docker-OSX for CI/CD-related purposes (sign into Xcode, Transporter)](#building-a-headless-container-from-a-custom-image)\n\nCreate your personal image using `:latest` or `big-sur`. Then, pull the image out the image. Afterwards, you will be able to duplicate that image and import it to the `:naked` container, in order to revert the container to a previous state repeatedly.\n\n- `sickcodes/docker-osx:auto` - [I'm only interested in using the command line (useful for compiling software or using Homebrew headlessly).](#prebuilt-image-with-arbitrary-command-line-arguments)\n- `sickcodes/docker-osx:naked` - [I need iMessage/iCloud for security research.](#generating-serial-numbers)\n- `sickcodes/docker-osx:big-sur` - [I want to run Big Sur.](#quick-start-docker-osx)\n- `sickcodes/docker-osx:monterey` - [I want to run Monterey.](#quick-start-docker-osx)\n- `sickcodes/docker-osx:ventura` - [I want to run Ventura.](#quick-start-docker-osx)\n- `sickcodes/docker-osx:sonoma` - [I want to run Sonoma.](#quick-start-docker-osx)\n\n- `sickcodes/docker-osx:high-sierra` - I want to run High Sierra.\n- `sickcodes/docker-osx:mojave` - I want to run Mojave.\n\n## Initial setup\nBefore you do anything else, you will need to turn on hardware virtualization in your BIOS. Precisely how will depend on your particular machine (and BIOS), but it should be straightforward.\n\nThen, you'll need QEMU and some other dependencies on your host:\n\n```bash\n# ARCH\nsudo pacman -S qemu libvirt dnsmasq virt-manager bridge-utils flex bison iptables-nft edk2-ovmf\n\n# UBUNTU DEBIAN\nsudo apt install qemu qemu-kvm libvirt-clients libvirt-daemon-system bridge-utils virt-manager libguestfs-tools\n\n# CENTOS RHEL FEDORA\nsudo yum install libvirt qemu-kvm\n```\n\nThen, enable libvirt and load the KVM kernel module:\n\n```bash\nsudo systemctl enable --now libvirtd\nsudo systemctl enable --now virtlogd\n\necho 1 | sudo tee /sys/module/kvm/parameters/ignore_msrs\n\nsudo modprobe kvm\n```\n\n### I'd like to run Docker-OSX on Windows\n\nRunning Docker-OSX on Windows is possible using WSL2 (Windows 11 + Windows Subsystem for Linux).\n\nYou must have Windows 11 installed with build 22000+ (21H2 or higher).\n\nFirst, install WSL on your computer by running this command in an administrator powershell. For more info, look [here](https://docs.microsoft.com/en-us/windows/wsl/install).\n\nThis will install Ubuntu by default.\n```\nwsl --install\n```\n\n You can confirm WSL2 is enabled using `wsl -l -v` in PowerShell. To see other distributions that are available, use `wsl -l -o`.\n\nIf you have previously installed WSL1, upgrade to WSL 2. Check [this link to upgrade from WSL1 to WSL2](https://docs.microsoft.com/en-us/windows/wsl/install#upgrade-version-from-wsl-1-to-wsl-2).\n\nAfter WSL installation, go to `C:/Users/\u003cYour_Name\u003e/.wslconfig` and add `nestedVirtualization=true` to the end of the file (If the file doesn't exist, create it). For more information about the `.wslconfig` file check [this link](https://docs.microsoft.com/en-us/windows/wsl/wsl-config#wslconfig). Verify that you have selected \"Show Hidden Files\" and \"Show File Extensions\" in File Explorer options.\nThe result should be like this:\n```\n[wsl2]\nnestedVirtualization=true\n```\n\nGo into your WSL distro (Run `wsl` in powershell) and check if KVM is enabled by using the `kvm-ok` command. The output should look like this:\n\n```\nINFO: /dev/kvm exists\nKVM acceleration can be used\n```\n\nUse the command `sudo apt -y install bridge-utils cpu-checker libvirt-clients libvirt-daemon qemu qemu-kvm` to install it if it isn't.\n\nNow download and install [Docker for Windows](https://docs.docker.com/desktop/windows/install/) if it is not already installed.\n\nAfter installation, go into Settings and check these 2 boxes:\n\n```\nGeneral -\u003e \"Use the WSL2 based engine\";\nResources -\u003e WSL Integration -\u003e \"Enable integration with my default WSL distro\", \n```\n\nEnsure `x11-apps` is installed. Use the command `sudo apt install x11-apps -y` to install it if it isn't.\n\nFinally, there are 3 ways to get video output:\n\n- WSLg: This is the simplest and easiest option to use. There may be some issues such as the keyboard not being fully passed through or seeing a second mouse on the desktop - [Issue on WSLg](https://github.com/microsoft/wslg/issues/376) - but this option is recommended.\n\nTo use WSLg's built-in X-11 server, change these two lines in the docker run command to point Docker-OSX to WSLg.\n\n```\n-e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n-v /mnt/wslg/.X11-unix:/tmp/.X11-unix \\\n```\nOr try:\n\n```\n-e \"DISPLAY=${DISPLAY:-:0}\" \\\n-v /mnt/wslg/.X11-unix:/tmp/.X11-unix \\\n```\n\nFor Ubuntu 20.x on Windows, see [https://github.com/sickcodes/Docker-OSX/discussions/458](https://github.com/sickcodes/Docker-OSX/discussions/458)\n\n- VNC: See the [VNC section](#building-a-headless-container-which-allows-insecure-vnc-on-localhost-for-local-use-only) for more information. You could also add -vnc argument to qemu. Connect to your mac VM via a VNC Client. [Here is a how to](https://wiki.archlinux.org/title/QEMU#VNC)\n- Desktop Environment: This will give you a full desktop linux experience but it will use a bit more of the computer's resources. Here is an example guide, but there are other guides that help set up a desktop environment. [DE Example](https://www.makeuseof.com/tag/linux-desktop-windows-subsystem/)\n\n## Additional boot instructions for when you are [creating your container](#container-creation-examples)\n\n- Boot the macOS Base System (Press Enter)\n\n- Click `Disk Utility`\n\n- Erase the BIGGEST disk (around 200gb default), DO NOT MODIFY THE SMALLER DISKS.\n-- if you can't click `erase`, you may need to reduce the disk size by 1kb\n\n- (optional) Create a partition using the unused space to house the OS and your files if you want to limit the capacity. (For Xcode 12 partition at least 60gb.)\n\n- Click `Reinstall macOS`\n\n- The system may require multiple reboots during installation\n\n## Troubleshooting\n\n### Routine checks\n\nThis is a great place to start if you are having trouble getting going, especially if you're not that familiar with Docker just yet.\n\nJust looking to make a container quickly? Check out our [container creation examples](#container-creation-examples) section.\n\nMore specific/advanced troubleshooting questions and answers may be found in [More Questions and Answers](#more-questions-and-answers). You should also check out the [closed issues](https://github.com/sickcodes/Docker-OSX/issues?q=is%3Aissue+is%3Aclosed). Someone else might have gotten a question like yours answered already even if you can't find it in this document!\n\n#### Confirm that your CPU supports virtualization\n\nSee [initial setup](#initial-setup).\n\n\n\n#### Docker Unknown Server OS error\n\n```console\ndocker: unknown server OS: .\nSee 'docker run --help'.\n```\n\nThis means your docker daemon is not running.\n\n`pgrep dockerd` should return nothing\n\nTherefore, you have a few choices.\n\n`sudo dockerd` for foreground Docker usage. I use this.\n\nOr\n\n`sudo systemctl --start dockerd` to start dockerd this now.\n\nOr\n\n`sudo systemctl --enable --now dockerd` for start dockerd on every reboot, and now.\n\n\n#### Use more CPU Cores/SMP\n\nExamples:\n\n`-e EXTRA='-smp 6,sockets=3,cores=2'`\n\n`-e EXTRA='-smp 8,sockets=4,cores=2'`\n\n`-e EXTRA='-smp 16,sockets=8,cores=2'`\n\nNote, unlike memory, CPU usage is shared. so you can allocate all of your CPU's to the container.\n\n### Confirm your user is part of the Docker group, KVM group, libvirt group\n\n#### Add yourself to the Docker group\n\nIf you use `sudo dockerd` or dockerd is controlled by systemd/systemctl, then you must be in the Docker group.\nIf you are not in the Docker group:\n\n```bash\nsudo usermod -aG docker \"${USER}\"\n```\nand also add yourself to the kvm and libvirt groups if needed:\n\n```bash\nsudo usermod -aG libvirt \"${USER}\"\nsudo usermod -aG kvm \"${USER}\"\n```\n\nSee also: [initial setup](#initial-setup).\n\n#### Is the docker daemon enabled?\n\n```bash\n# run ad hoc\nsudo dockerd\n\n# or daemonize it\nsudo nohup dockerd \u0026\n\n# enable it in systemd (it will persist across reboots this way)\nsudo systemctl enable --now docker\n\n# or just start it as your user with systemd instead of enabling it\nsystemctl start docker\n```\n\n## More Questions and Answers\n\nBig thank you to our contributors who have worked out almost every conceivable issue so far!\n\n[https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md](https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md)\n\n\n### Start the same container later (persistent disk)\n\nCreated a container with `docker run` and want to reuse the underlying image again later? \n\nNB: see [container creation examples](#container-creation-examples) first for how to get to the point where this is applicable.\n\nThis is for when you want to run the SAME container again later. You may need to use `docker commit` to save your container before you can reuse it. Check if your container is persisted with `docker ps --all`.\n\nIf you don't run this you will have a new image every time. \n\n```bash\n# look at your recent containers and copy the CONTAINER ID\ndocker ps --all\n\n# docker start the container ID\ndocker start -ai abc123xyz567\n\n# if you have many containers, you can try automate it with filters like this\n# docker ps --all --filter \"ancestor=sickcodes/docker-osx\"\n# for locally tagged/built containers\n# docker ps --all --filter \"ancestor=docker-osx\"\n\n```\n\nYou can also pull the `.img` file out of the container, which is stored in `/var/lib/docker`, and supply it as a runtime argument to the `:naked` Docker image. \n\nSee also: [here](https://github.com/sickcodes/Docker-OSX/issues/197).\n\n### I have used Docker-OSX before and want to restart a container that starts automatically\n\nContainers that use `sickcodes/docker-osx:auto` can be stopped while being started.\n\n```bash\n# find last container\ndocker ps -a\n\n# docker start old container with -i for interactive, -a for attach STDIN/STDOUT\ndocker start -ai -i \u003cReplace this with your ID\u003e\n```\n\n### LibGTK errors \"connection refused\"\n\nYou may see one or more libgtk-related errors if you do not have everything set up for hardware virtualisation yet. If you have not yet done so, check out the [initial setup](#initial-setup) section and the [routine checks](#routine-checks) section as you may have missed a setup step or may not have all the needed Docker dependencies ready to go.\n\nSee also: [here](https://github.com/sickcodes/Docker-OSX/issues/174).\n\n#### Permissions denied error\n\nIf you have not yet set up xhost, try the following:\n\n```bash\necho $DISPLAY\n\n# ARCH\nsudo pacman -S xorg-xhost\n\n# UBUNTU DEBIAN\nsudo apt install x11-xserver-utils\n\n# CENTOS RHEL FEDORA\nsudo yum install xorg-x11-server-utils\n\n# then run\nxhost +\n\n```\n\n### RAM over-allocation\nYou cannot allocate more RAM than your machine has. The default is 3 Gigabytes: `-e RAM=3`.\n\nIf you are trying to allocate more RAM to the container than you currently have available, you may see an error like the following: `cannot set up guest memory 'pc.ram': Cannot allocate memory`. See also: [here](https://github.com/sickcodes/Docker-OSX/issues/188), [here](https://github.com/sickcodes/Docker-OSX/pull/189).\n\nFor example (below) the `buff/cache` already contains 20 Gigabytes of allocated RAM:\n\n```console\n[user@hostname ~]$ free -mh\n               total        used        free      shared  buff/cache   available\nMem:            30Gi       3.5Gi       7.0Gi       728Mi        20Gi        26Gi\nSwap:           11Gi          0B        11Gi\n```\n\nClear the buffer and the cache:\n\n```bash\nsudo tee /proc/sys/vm/drop_caches \u003c\u003c\u003c 3\n```\n\nNow check the RAM again:\n\n```console\n[user@hostname ~]$ free -mh\n               total        used        free      shared  buff/cache   available\nMem:            30Gi       3.3Gi        26Gi       697Mi       1.5Gi        26Gi\nSwap:           11Gi          0B        11Gi\n```\n\n### PulseAudio\n\n#### Use PulseAudio for sound\n\nNote: [AppleALC](https://github.com/acidanthera/AppleALC), [`alcid`](https://dortania.github.io/OpenCore-Post-Install/universal/audio.html) and [VoodooHDA-OC](https://github.com/chris1111/VoodooHDA-OC) do not have [codec support](https://osy.gitbook.io/hac-mini-guide/details/hda-fix#hda-codec). However, [IORegistryExplorer](https://github.com/vulgo/IORegistryExplorer) does show the controller component working.\n\n```bash\ndocker run \\\n    --device /dev/kvm \\\n    -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \\\n    -v \"/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    sickcodes/docker-osx\n```\n\n#### PulseAudio debugging\n\n```bash\ndocker run \\\n    --device /dev/kvm \\\n    -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \\\n    -v \"/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e PULSE_SERVER=unix:/tmp/pulseaudio.socket \\\n    sickcodes/docker-osx pactl list\n```\n\n#### PulseAudio with WSLg\n\n```bash\ndocker run \\\n    --device /dev/kvm \\\n    -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \\\n    -v /mnt/wslg/runtime-dir/pulse/native:/tmp/pulseaudio.socket \\\n    -v /mnt/wslg/.X11-unix:/tmp/.X11-unix \\\n    sickcodes/docker-osx\n```\n\n### Forward additional ports (nginx hosting example)\n\nIt's possible to forward additional ports depending on your needs. In this example, we'll use Mac OSX to host nginx:\n\n```\nhost:10023 \u003c-\u003e 10023:container:10023 \u003c-\u003e 80:guest\n```\n\nOn the host machine, run:\n\n```bash\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,' \\\n    -p 10023:10023 \\\n    sickcodes/docker-osx:auto\n```\n\nIn a Terminal session running the container, run:\n\n```bash\n/bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"\n\nbrew install nginx\nsudo sed -i -e 's/8080/80/' /usr/local/etc/nginx/nginx.confcd\n# sudo nginx -s stop\nsudo nginx\n```\n\n**nginx should now be reachable on port 10023.**\n\nAdditionally, you can string multiple statements together, for example:\n\n```bash\n    -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,hostfwd=tcp::10043-:443,'\n    -p 10023:10023 \\\n    -p 10043:10043 \\\n```\n\n### Bridged networking\n\nYou might not need to do anything with the default setup to enable internet connectivity from inside the container. Additionally, `curl` may work even if `ping` doesn't.\n\nSee discussion [here](https://github.com/sickcodes/Docker-OSX/issues/177) and [here](https://github.com/sickcodes/Docker-OSX/issues/72) and [here](https://github.com/sickcodes/Docker-OSX/issues/88).\n\n### Enable IPv4 forwarding for bridged network connections for remote installations\n\nThis is not required for LOCAL installations.\n\nAdditionally note it may [cause the host to leak your IP, even if you're using a VPN in the container](https://sick.codes/cve-2020-15590/).\n\nHowever, if you're trying to connect to an instance of Docker-OSX remotely (e.g. an instance of Docker-OSX hosted in a datacenter), this may improve your performance:\n\n```bash\n# enable for current session\nsudo sysctl -w net.ipv4.ip_forward=1\n\n# OR\n# sudo tee /proc/sys/net/ipv4/ip_forward \u003c\u003c\u003c 1\n\n# enable permanently\nsudo touch /etc/sysctl.conf\nsudo tee -a /etc/sysctl.conf \u003c\u003cEOF\nnet.ipv4.ip_forward = 1\nEOF\n\n# or edit manually with the editor of your choice\nnano /etc/sysctl.conf || vi /etc/sysctl.conf || vim /etc/sysctl.conf\n\n# now reboot\n```\n\n## Share folder with Docker-OSX QEMU macOS\n\nSharing a folder with guest is quite simple.\n\nYour folder, will go to /mnt/hostshare inside the Arch container which is then passed over QEMU.\n\nThen mount using `sudo -S mount_9p hostshare` from inside the mac.\n\nFor example,\n\n```bash\nFOLDER=~/somefolder\n```\n\n```bash\n    -v \"${FOLDER}:/mnt/hostshare\" \\\n    -e EXTRA=\"-virtfs local,path=/mnt/hostshare,mount_tag=hostshare,security_model=passthrough,id=hostshare\" \\\n```\n\nFull example:\n\n```bash\n# stat mac_hdd_ng.img\nSHARE=~/somefolder\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -v \"${PWD}/mac_hdd_ng.img:/home/arch/OSX-KVM/mac_hdd_ng.img\" \\\n    -v \"${SHARE}:/mnt/hostshare\" \\\n    -e EXTRA=\"-virtfs local,path=/mnt/hostshare,mount_tag=hostshare,security_model=passthrough,id=hostshare\" \\\n    sickcodes/docker-osx:latest\n\n# !!! Open Terminal inside macOS and run the following command to mount the virtual file system\n# sudo -S mount_9p hostshare\n\n```\n### Share Linux NFS Drive into macOS\n\nTo share a folder using NFS, setup a folder for on the host machine, for example, `/srv/nfs/share` and then append to `/etc/exports`:\n```bash\n/srv/nfs/share      127.0.0.1/0(insecure,rw,all_squash,anonuid=1000,anongid=985,no_subtree_check)\n```\n\nYou may need to reload exports now, which will begin sharing that directory.\n\n```bash\n# reload shared folders\nsudo exportfs -arv\n```\n\n[Source \u0026 Explanation](https://serverfault.com/questions/716350/mount-nfs-volume-on-ubuntu-linux-server-from-macos-client)\n\nGive permissions on the shared folder for the `anonuid` and `anongid`, where `anonuid` and `anongid` matches that of your linux user; `id -u`\n\n`id -u ; id -g` will print `userid:groupid`\n```\nchown 1000:985 /srv/nfs/share\nchmod u+rwx /srv/nfs/share\n```\n\nStart the Docker-OSX container with the additional flag `--network host`\n\nCreate and mount the nfs folder from the mac terminal:\n```\nmkdir -p ~/mnt\nsudo mount_nfs -o locallocks 10.0.2.2:/srv/nfs/share ~/mnt\n```\n\n### Share USB Drive into macOS over QEMU\n\n## Mount USB Drive (Hotplug/Hot Plug USB)\n\nStart your container.\n\nPick a port, for example, `7700`.\n\n`lsusb` to get `vid:pid`\n\nOn Linux:\n`sudo usbredirserver -p 7700 1e3d:2096`\n\nNow, in the Docker window hit Enter to see the `(qemu)` console.\n\nYou can add/remove the disk using commands like this, even once the machine is started:\n\n`chardev-add socket,id=usbredirchardev1,port=7700,host=172.17.0.1`\n\n`device_add usb-redir,chardev=usbredirchardev1,id=usbredirdev1,debug=4`\n\n## Mount USB Drive inside macOS at boot Docker OSX\n\n```bash\nPORT=7700\nIP_ADDRESS=172.17.0.1\n\n-e EXTRA=\"-chardev socket,id=usbredirchardev1,port=${PORT},host=${IP_ADDRESS} -device usb-redir,chardev=usbredirchardev1,id=usbredirdev1,debug=4\" \\`\n```\n\n### Fedora: enable internet connectivity with a bridged network\n\nFedora's default firewall settings may prevent Docker's network interface from reaching the internet. In order to resolve this, you will need to whitelist the interface in your firewall:\n\n```bash\n# Set the docker0 bridge to the trusted zone\nsudo firewall-cmd --permanent --zone=trusted --add-interface=docker0\nsudo firewall-cmd --reload\n```\n\n### Nested Hardware Virtualization\n\nCheck if your machine has hardware virtualization enabled:\n\n```bash\nsudo tee /sys/module/kvm/parameters/ignore_msrs \u003c\u003c\u003c 1\n\negrep -c '(svm|vmx)' /proc/cpuinfo\n```\n\n### Virtual network adapters\n\n#### Fast internet connectivity\n\n`-e NETWORKING=vmxnet3`\n\n#### Slow internet connectivity\n\n`-e NETWORKING=e1000-82545em`\n\n### CI/CD Related Improvements\n\n#### Tips for reducing the size of the image\n\n- Start the container as usual, and remove unnecessary files. A useful way\n  to do this is to use `du -sh *` starting from the `/` directory, and find\n  large directories where files can be removed. E.g. unnecessary cached files,\n  Xcode platforms, etc.\n- Once you are satisfied with the amount of free space, enable trim with `sudo trimforce enable`, and reboot.\n- Zero out the empty space on the disk with `dd if=/dev/zero of=./empty \u0026\u0026 rm -f empty`\n- Shut down the VM and copy out the qcow image with `docker cp stoppedcontainer:/home/arch/OSX-KVM/mac_hdd_ng.img .`\n- Run `qemu-img check -r all mac_hdd_ng.img` to fix any errors.\n- Run `qemu-img convert -O qcow2 mac_hdd_ng.img deduped.img` and check for errors again\n- **OPTIONAL:** Run `qemu-img convert -c -O qcow2 deduped.img compressed.img` to further compress the image. This may reduce the runtime speed though, but it should reduce the size by roughly 25%.\n- Check for errors again, and build a fresh docker image. E.g. with this Dockerfile\n\n```\nFROM sickcodes/docker-osx\nUSER arch\nCOPY --chown=arch ./deduped.img /home/arch/OSX-KVM/mac_hdd_ng.img\n```\n\n### Run Docker-OSX headlessly with Telnet\n\nFirst make sure [autoboot is enabled](#autoboot-into-osx-after-youve-installed-everything)\n\nNext, you will want to set up SSH to be automatically started.\n\n```bash\nsudo systemsetup -setremotelogin on\n```\n\nMake sure to commit the new docker image and save it, or rebuild as described in the [section on reducing disk space](#how-to-reduce-the-size-of-the-image).\n\nThen run it with these arguments.\n\n```bash\n# Run with the -nographic flag, and enable a telnet interface\n  docker run \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e EXTRA=\"-monitor telnet::45454,server,nowait -nographic -serial null\" \\\n    mycustomimage\n```\n\n### What mirrors are appropriate to use to build Docker-OSX locally?\n\nIf you are building Docker-OSX locally, you'll probably want to use Arch Linux's mirrors.\n\nMirror locations can be found here (uses two-letter country codes): https://archlinux.org/mirrorlist/all/\n\n```bash\ndocker build -t docker-osx:latest \\\n    --build-arg RANKMIRRORS=true \\\n    --build-arg MIRROR_COUNTRY=US \\\n    --build-arg MIRROR_COUNT=10 \\\n    --build-arg SHORTNAME=catalina \\\n    --build-arg SIZE=200G .\n```\n\n### Custom QEMU Arguments (passthrough devices)\n\nPass any devices/directories to the Docker container \u0026 the QEMU arguments using the handy runtime argument provider option `-e EXTRA=`.\n\n```bash\n# example customizations\ndocker run \\\n    -e RAM=4 \\\n    -e SMP=4 \\\n    -e CORES=4 \\\n    -e EXTRA='-usb -device usb-host,hostbus=1,hostaddr=8' \\\n    -e INTERNAL_SSH_PORT=23 \\\n    -e MAC_ADDRESS=\"$(xxd -c1 -p -l 6 /dev/urandom | tr '\\n' ':' | cut -c1-17)\" \\\n    -e AUDIO_DRIVER=alsa \\\n    -e IMAGE_PATH=/image \\\n    -e SCREEN_SHARE_PORT=5900 \\\n    -e DISPLAY=:0 \\\n    -e NETWORKING=vmxnet3 \\\n    --device /dev/kvm \\\n    --device /dev/snd \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    docker-osx:latest\n```\n\n### Generating serial numbers\n\nGenerate serial numbers in `./custom` OR make docker generate them at runtime (see below).\n\nAt any time, verify your serial number before logging into iCloud, etc.\n\n```bash\n# this is a quick way to check your serial number via cli inside OSX\nioreg -l | grep IOPlatformSerialNumber\n\n# test some commands\nsshpass -p 'alpine' ssh user@localhost -p 50922 'ping google.com'\n\n# check your serial number\nsshpass -p 'alpine' ssh user@localhost -p 50922 'ioreg -l | grep IOPlatformSerialNumber'\n```\n\n#### Getting started with serial numbers\n\n```bash\n# ARCH\npacman -S libguestfs\n\n# UBUNTU DEBIAN\napt install libguestfs -y\n\n# RHEL FEDORA CENTOS\nyum install libguestfs -y\n```\n\nInside the `./custom` folder you will find `4` scripts.\n\n- `config-nopicker-custom.plist`\n- `opencore-image-ng.sh`\n\nThese two files are from OSX-KVM.\n\nYou don't need to touch these two files.\n\nThe config.plist has 5 values replaced with placeholders. [Click here to see those values for no reason.](https://github.com/sickcodes/Docker-OSX/blob/master/custom/config-nopicker-custom.plist#L705)\n\n- `generate-unique-machine-values.sh`\nThis script will generate serial numbers, with Mac Addresses, plus output to CSV/TSV, plus make a `bootdisk image`.\n\nYou can create hundreds, `./custom/generate-unique-machine-values.sh --help`\n\n```bash\n./custom/generate-unique-machine-values.sh \\\n    --count 1 \\\n    --tsv ./serial.tsv \\\n    --bootdisks \\\n    --output-bootdisk OpenCore.qcow2 \\\n    --output-env source.env.sh\n```\n\nOr if you have some specific serial numbers...\n\n- `generate-specific-bootdisk.sh`\n```bash\ngenerate-specific-bootdisk.sh \\\n    --model \"${DEVICE_MODEL}\" \\\n    --serial \"${SERIAL}\" \\\n    --board-serial \"${BOARD_SERIAL}\" \\\n    --uuid \"${UUID}\" \\\n    --mac-address \"${MAC_ADDRESS}\" \\\n    --output-bootdisk OpenCore-nopicker.qcow2\n```\n#### This example generates a random set of serial numbers at runtime, headlessly\n\n```bash\n# proof of concept only, generates random serial numbers, headlessly, and quits right after.\ndocker run --rm -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -e NOPICKER=true \\\n    -e GENERATE_UNIQUE=true \\\n    -e DEVICE_MODEL=\"iMacPro1,1\" \\\n    sickcodes/docker-osx:auto\n\n# -e OSX_COMMANDS='ioreg -l | grep IOPlatformSerialNumber' \\\n```\n\n#### This example generates a specific set of serial numbers at runtime\n\n```bash\n# run the same as above 17gb auto image, with SSH, with nopicker, and save the bootdisk for later.\n# you don't need to save the bootdisk IF you supply specific serial numbers!\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -e NOPICKER=true \\\n    -e GENERATE_SPECIFIC=true \\\n    -e DEVICE_MODEL=\"iMacPro1,1\" \\\n    -e SERIAL=\"C02TW0WAHX87\" \\\n    -e BOARD_SERIAL=\"C027251024NJG36UE\" \\\n    -e UUID=\"5CCB366D-9118-4C61-A00A-E5BAF3BED451\" \\\n    -e MAC_ADDRESS=\"A8:5C:2C:9A:46:2F\" \\\n    -e OSX_COMMANDS='ioreg -l | grep IOPlatformSerialNumber' \\\n    sickcodes/docker-osx:auto\n```\n\n#### This example generates a specific set of serial numbers at runtime, with your existing image, at 1000x1000 display resolution\n\n```bash\n# run an existing image in current directory, with a screen, with SSH, with nopicker.\n\nstat mac_hdd_ng.img # make sure you have an image if you're using :naked\n\ndocker run -it \\\n    -v \"${PWD}/mac_hdd_ng.img:/image\" \\\n    --device /dev/kvm \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -p 50922:10022 \\\n    -e NOPICKER=true \\\n    -e GENERATE_SPECIFIC=true \\\n    -e DEVICE_MODEL=\"iMacPro1,1\" \\\n    -e SERIAL=\"C02TW0WAHX87\" \\\n    -e BOARD_SERIAL=\"C027251024NJG36UE\" \\\n    -e UUID=\"5CCB366D-9118-4C61-A00A-E5BAF3BED451\" \\\n    -e MAC_ADDRESS=\"A8:5C:2C:9A:46:2F\" \\\n    -e WIDTH=1000 \\\n    -e HEIGHT=1000 \\\n    sickcodes/docker-osx:naked\n```\n\nIf you want to generate serial numbers, either make them at runtime using\n`    -e GENERATE_UNIQUE=true \\`\n\nOr you can generate them inside the `./custom` folder. And then use:\n```bash\n    -e GENERATE_SPECIFIC=true \\\n    -e SERIAL=\"\" \\\n    -e BOARD_SERIAL=\"\" \\\n    -e UUID=\"\" \\\n    -e MAC_ADDRESS=\"\" \\\n```\n\n#### Making serial numbers persist across reboots\n\n```bash\n\nstat mac_hdd_ng_testing.img\ntouch ./output.env\n\n# generate fresh random serial numbers, with a screen, using your own image, and save env file with your new serial numbers for later.\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -p 50922:10022 \\\n    -e NOPICKER=true \\\n    -e GENERATE_UNIQUE=true \\\n    -e GENERATE_SPECIFIC=true \\\n    -e DEVICE_MODEL=\"iMacPro1,1\" \\\n    -v \"${PWD}/output.env:/env\" \\\n    -v \"${PWD}/mac_hdd_ng_testing.img:/image\" \\\n    sickcodes/docker-osx:naked\n```\n\nTo use iMessage or iCloud you need to change `5` values.\n\n- `SERIAL`\n- `BOARD_SERIAL`\n- `UUID`\n- `MAC_ADDRESS`\n\n_`ROM` is just the lowercased mac address, without `:` between each word._\n\nYou can tell the container to generate them for you using `-e GENERATE_UNIQUE=true`\n\nOr tell the container to use specific ones using `-e GENERATE_SPECIFIC=true`\n\n```bash\n    -e GENERATE_SPECIFIC=true \\\n    -e DEVICE_MODEL=\"iMacPro1,1\" \\\n    -e SERIAL=\"C02TW0WAHX87\" \\\n    -e BOARD_SERIAL=\"C027251024NJG36UE\" \\\n    -e UUID=\"5CCB366D-9118-4C61-A00A-E5BAF3BED451\" \\\n    -e MAC_ADDRESS=\"A8:5C:2C:9A:46:2F\" \\\n```\n\n### Changing display resolution\n\nThe display resolution is controlled by this line:\n\nhttps://github.com/sickcodes/Docker-OSX/blob/master/custom/config-nopicker-custom.plist#L819\n\nInstead of mounting that disk, Docker-OSX will generate a new `OpenCore.qcow2` by using this one cool trick:\n\n```bash\n-e GENERATE_UNIQUE=true \\\n-e WIDTH=800 \\\n-e HEIGHT=600 \\\n```\n\nTo use `WIDTH`/`HEIGHT`, you must use with either `-e GENERATE_UNIQUE=true` or `-e GENERATE_SPECIFIC=true`.\n\nIt will take around 30 seconds longer to boot because it needs to make a new boot partition using `libguestfs`.\n\n```bash\n-e GENERATE_SPECIFIC=true \\\n-e WIDTH=1920 \\\n-e HEIGHT=1080 \\\n-e SERIAL=\"\" \\\n-e BOARD_SERIAL=\"\" \\\n-e UUID=\"\" \\\n-e MAC_ADDRESS=\"\" \\\n```\n\n#### Change Docker-OSX Resolution Examples\n\n```bash\n# using an image in your current directory\nstat mac_hdd_ng.img\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v \"${PWD}/mac_hdd_ng.img:/image\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e GENERATE_SPECIFIC=true \\\n    -e DEVICE_MODEL=\"iMacPro1,1\" \\\n    -e SERIAL=\"C02TW0WAHX87\" \\\n    -e BOARD_SERIAL=\"C027251024NJG36UE\" \\\n    -e UUID=\"5CCB366D-9118-4C61-A00A-E5BAF3BED451\" \\\n    -e MAC_ADDRESS=\"A8:5C:2C:9A:46:2F\" \\\n    -e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/custom/config-nopicker-custom.plist \\\n    -e WIDTH=1600 \\\n    -e HEIGHT=900 \\\n    sickcodes/docker-osx:naked\n```\n\n```bash\n# generating random serial numbers, using the DIY installer, along with the screen resolution changes.\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e GENERATE_UNIQUE=true \\\n    -e WIDTH=800 \\\n    -e HEIGHT=600 \\\n    sickcodes/docker-osx:latest\n```\n\nHere's a few other resolutions! If your resolution is invalid, it will default to 800x600.\n\n```\n    -e WIDTH=800 \\\n    -e HEIGHT=600 \\\n```\n\n```\n    -e WIDTH=1280 \\\n    -e HEIGHT=768 \\\n```\n\n```\n    -e WIDTH=1600 \\\n    -e HEIGHT=900 \\\n```\n\n```\n    -e WIDTH=1920 \\\n    -e HEIGHT=1080 \\\n```\n\n```\n    -e WIDTH=2560 \\\n    -e HEIGHT=1600 \\\n```\n\n#### This example shows how to change resolution after the container is created.\n\nFirst step is to stop the docker daemon\n```\nsudo systemctl stop docker\n```\nThe second step is to change container config in \n```\n/var/lib/docker/containers/[container-id]/config.v2.json\n```\n(Suppose your original WIDTH is 1024 and HEIGHT is 768, you can search 1024 and replace it with the new value. Same for 768.)\n\nThe last step is to restart the docker daemon\n```\nsudo systemctl restart docker\n```\n\n### Mounting physical disks in Mac OSX\n\nPass the disk into the container as a volume and then pass the disk again into QEMU command line extras with.\n\nUse the `config-custom.plist` because you probably want to see the boot menu, otherwise omit the first line:\n\n```bash\nDISK_TWO=\"${PWD}/mount_me.img\"\n```\n```dockerfile\n-e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \\\n-v \"${DISK_TWO}:/disktwo\" \\\n-e EXTRA='-device ide-hd,bus=sata.5,drive=DISK-TWO -drive id=DISK-TWO,if=none,file=/disktwo,format=qcow2' \\\n```\n\n#### Physical disk mounting example\n\n```bash\nOSX_IMAGE=\"${PWD}/mac_hdd_ng_xcode_bigsur.img\"\nDISK_TWO=\"${PWD}/mount_me.img\"\n\ndocker run -it \\\n    --device /dev/kvm \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \\\n    -v \"${OSX_IMAGE}\":/image \\\n    -v \"${DISK_TWO}\":/disktwo \\\n    -e EXTRA='-device ide-hd,bus=sata.5,drive=DISK-TWO -drive id=DISK-TWO,if=none,file=/disktwo,format=qcow2' \\\n    sickcodes/docker-osx:naked\n```\n\nSee also: [here](https://github.com/sickcodes/Docker-OSX/issues/222).\n\n\n#### Extracting the APFS disk on Linux\n\nIn Docker-OSX, we are using `qcow2` images.\n\nThis means the image grows as you use it, but the guest OS thinks you have 200GB available.\n\n\n**READ ONLY**\n\n```bash\n# mount the qemu image like a real disk\nsudo modprobe nbd max_part=8\nsudo qemu-nbd --connect=/dev/nbd0 ./image.img\nsudo fdisk /dev/nbd0 -l\n\nmkdir -p ./mnt\nsudo mount /dev/nbd0p1 ./mnt\n\n# inspect partitions (2 partitions)\nsudo fdisk /dev/nbd0 -l\n\n# mount using apfs-linux-rw OR apfs-fuse\nmkdir -p ./part\n\nsudo mount /dev/nbd0p2 ./part\nsudo apfs-fuse -o allow_other /dev/nbd0p2 ./part\n\n```\n\nWhen you are finishing looking at your disk, you can unmount the partition, the disk, and remove the loopback device:\n\n```bash\nsudo umount ./part\nsudo umount ./mnt\nsudo qemu-nbd --disconnect /dev/nbd0\nsudo rmmod nbd\n```\n\n### USB Passthrough\n\nFirstly, QEMU must be started as root. \n\nIt is also potentially possible to accomplish USB passthrough by changing the permissions of the device in the container.\nSee [here](https://www.linuxquestions.org/questions/slackware-14/qemu-usb-permissions-744557/#post3628691).\n\nFor example, create a new Dockerfile with the following\n\n```bash\nFROM sickcodes/docker-osx\nUSER arch\nRUN sed -i -e s/exec\\ qemu/exec\\ sudo\\ qemu/ ./Launch.sh\nCOPY --chown=arch ./new_image.img /home/arch/OSX-KVM/mac_hdd_ng.img\n```\n\nWhere `new_image.img` is the qcow2 image you extracted. Then rebuild with `docker build .`\n\nNext we need to find out the bus and port numbers of the USB device we want to pass through to the VM:\n\n```bash\nlsusb -t\n/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/6p, 5000M\n/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/12p, 480M\n    |__ Port 2: Dev 5, If 0, Class=Human Interface Device, Driver=usbhid, 12M\n    |__ Port 2: Dev 5, If 1, Class=Chip/SmartCard, Driver=, 12M\n    |__ Port 3: Dev 2, If 0, Class=Wireless, Driver=, 12M\n    |__ Port 3: Dev 2, If 1, Class=Wireless, Driver=, 12M\n    |__ Port 5: Dev 3, If 0, Class=Video, Driver=uvcvideo, 480M\n    |__ Port 5: Dev 3, If 1, Class=Video, Driver=uvcvideo, 480M\n```\n\nIn this example, we want to pass through a smartcard device. The device we want is on bus 1 and port 2.\n\nThere may also be differences if your device is usb 2.0 (ehci) vs usb 3.0 (xhci).\nSee [here](https://unix.stackexchange.com/a/452946/101044) for more details.\n\n\n```bash\n# hostbus and hostport correspond to the numbers from lsusb\n# runs in privileged mode to enable access to the usb devices.\ndocker run \\\n  --privileged \\\n  --device /dev/kvm \\\n  -e RAM=4 \\\n  -p 50922:10022 \\\n  -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n  -e EXTRA=\"-device virtio-serial-pci -device usb-host,hostbus=1,hostport=2\" \\\n  mycustomimage\n```\n\nYou should see the device show up when you do `system_profiler SPUSBDataType` in the MacOS shell.\n\nImportant Note: this will cause the host system to lose access to the USB device while the VM is running!\n\n## Container creation examples\n\n#### Quick Start your own image (naked container image)\n\nThis is my favourite container. You can supply an existing disk image as a Docker command line argument.\n\n- Pull images out using `sudo find /var/lib/docker -name mac_hdd_ng.img -size +10G`\n\n- Supply your own local image with the command argument `-v \"${PWD}/mac_hdd_ng.img:/image\"` and use `sickcodes/docker-osx:naked` when instructing Docker to create your container.\n\n  - Naked image is for booting any existing .img file, e.g in the current working directory (`$PWD`)\n  - By default, this image has a variable called `NOPICKER` which is `\"true\"`. This skips the disk selection menu. Use `-e NOPICKER=false` or any other string than the word `true` to enter the boot menu.\n\n    This lets you use other disks instead of skipping the boot menu, e.g. recovery disk or disk utility.\n\n```bash\ndocker pull sickcodes/docker-osx:naked\n\n# run your own image + SSH\n# change mac_hdd_ng.img\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v \"${PWD}/mac_hdd_ng.img:/image\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    sickcodes/docker-osx:naked\n\n# run local copy of the auto image + SSH + Boot menu\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v \"${PWD}/mac_hdd_ng_auto.img:/image\" \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e \"NOPICKER=false\" \\\n    sickcodes/docker-osx:naked\n```\n\n### Building an OSX container with video output\n\nThe Quick Start command should work out of the box, provided that you keep the following lines. Works in `auto` \u0026 `naked` machines:\n\n```\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n```\n\n#### Prebuilt image with arbitrary command line arguments \n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/auto?label=sickcodes%2Fdocker-osx%3Aauto](https://img.shields.io/docker/image-size/sickcodes/docker-osx/auto?label=sickcodes%2Fdocker-osx%3Aauto)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\n`-e OSX_COMMANDS` lets you run any commands inside the container\n\n```bash\ndocker pull sickcodes/docker-osx:auto\n\n# boot to OS X shell + display + specify commands to run inside OS X!\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e \"OSX_COMMANDS=/bin/bash -c \\\"put your commands here\\\"\" \\\n    sickcodes/docker-osx:auto\n\n# Boots in a minute or two!\n```\n\nOR if you have an image already and just want to log in and execute arbitrary commands:\n\n```bash\ndocker pull sickcodes/docker-osx:naked-auto\n\n# boot to OS X shell + display + specify commands to run inside OS X!\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e USERNAME=yourusername \\\n    -e PASSWORD=yourpassword \\\n    -e \"OSX_COMMANDS=/bin/bash -c \\\"put your commands here\\\"\" \\\n    sickcodes/docker-osx:naked-auto\n\n# Boots in a minute or two!\n\n```\n\n### Further examples\n\nThere's a myriad of other potential use cases that can work perfectly with Docker-OSX, some of which you'll see below!\n\n### Building a headless OSX container\n\nFor a headless container, **remove** the following two lines from your `docker run` command:\n\n```\n    # -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    # -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n```\n\n#### Building a headless container from a custom image \n\n[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked](https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1\u0026ordering=last_updated)\n\nThis is particularly helpful for CI/CD pipelines.\n\n```bash\n# run your own image headless + SSH\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -v \"${PWD}/mac_hdd_ng.img:/image\" \\\n    sickcodes/docker-osx:naked\n```\n\n### Building a headless container that allows insecure VNC on localhost (!for local use only!)\n\n**Must change -it to -i to be able to interact with the QEMU console**\n\n**To exit a container using -i you must `docker kill \u003ccontainerid\u003e`. For example, to kill everything, `docker ps | xargs docker kill`.**\n\nNative QEMU VNC example\n\n```bash\ndocker run -i \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    -p 5999:5999 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e EXTRA=\"-display none -vnc 0.0.0.0:99,password=on\" \\\n    sickcodes/docker-osx:big-sur\n\n# type `change vnc password myvncusername` into the docker terminal and set a password\n# connect to localhost:5999 using VNC\n# qemu 6 seems to require a username for vnc now\n```\n\n**NOT TLS/HTTPS Encrypted at all!**\n\nOr `ssh -N root@1.1.1.1 -L  5999:127.0.0.1:5999`, where `1.1.1.1` is your remote server IP.\n\n(Note: if you close port 5999 and use the SSH tunnel, this becomes secure.)\n\n### Building a headless container to run remotely with secure VNC\n\nAdd the following line:\n\n`-e EXTRA=\"-display none -vnc 0.0.0.0:99,password=on\"`\n\nIn the Docker terminal, press `enter` until you see `(qemu)`.\n\nType `change vnc password someusername`\n\nEnter a password for your new vnc username^.\n\nYou also need the container IP: `docker inspect \u003ccontainerid\u003e | jq -r '.[0].NetworkSettings.IPAddress'`\n\nOr `ip n` will usually show the container IP first.\n\nNow VNC connects using the Docker container IP, for example `172.17.0.2:5999`\n\nRemote VNC over SSH: `ssh -N root@1.1.1.1 -L  5999:172.17.0.2:5999`, where `1.1.1.1` is your remote server IP and `172.17.0.2` is your LAN container IP.\n\nNow you can direct connect VNC to any container built with this command!\n\n### I'd like to use SPICE instead of VNC\n\nOptionally, you can enable the SPICE protocol, which allows use of `remote-viewer` to access your OSX container rather than VNC.\n\nNote: `-disable-ticketing` will allow unauthenticated access to the VM. See the [spice manual](https://www.spice-space.org/spice-user-manual.html) for help setting up authenticated access (\"Ticketing\").\n\n```bash\n  docker run \\\n    --device /dev/kvm \\\n    -p 3001:3001 \\\n    -p 50922:10022 \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    -e EXTRA=\"-monitor telnet::45454,server,nowait -nographic -serial null -spice disable-ticketing,port=3001\" \\\n    mycustomimage\n```\n\nThen simply do `remote-viewer spice://localhost:3001` and add `--spice-debug` for debugging.\n\n#### Creating images based on an already configured and set up container\n```bash\n# You can create an image of an already configured and setup container.\n# This allows you to effectively duplicate a system.\n# To do this, run the following commands\n\n# make note of your container id\ndocker ps --all\ndocker commit containerid newImageName\n\n# To run this image do the following\ndocker run \\\n    --device /dev/kvm \\\n    --device /dev/snd \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    newImageName\n```\n\n```bash\ndocker pull sickcodes/docker-osx:auto\n\n# boot directly into a real OS X shell with no display (Xvfb) [HEADLESS]\ndocker run -it \\\n    --device /dev/kvm \\\n    -p 50922:10022 \\\n    sickcodes/docker-osx:auto\n\n# username is user\n# password is alpine\n# Wait 2-3 minutes until you drop into the shell.\n```\n\n#### Run the original version of Docker-OSX\n\n```bash\n\ndocker pull sickcodes/docker-osx:latest\n\ndocker run -it \\\n    --device /dev/kvm \\\n    --device /dev/snd \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    sickcodes/docker-osx:latest\n\n# press CTRL + G if your mouse gets stuck\n# scroll down to troubleshooting if you have problems\n# need more RAM and SSH on localhost -p 50922?\n```\n\n#### Run but enable SSH in OS X (Original Version)!\n\n```bash\ndocker run -it \\\n    --device /dev/kvm \\\n    --device /dev/snd \\\n    -p 50922:10022 \\\n    -v /tmp/.X11-unix:/tmp/.X11-unix \\\n    -e \"DISPLAY=${DISPLAY:-:0.0}\" \\\n    sickcodes/docker-osx:latest\n\n# turn on SSH after you've installed OS X in the \"Sharing\" settings.\nssh user@localhost -p 50922\n```\n\n#### Autoboot into OS X after you've installed everything\n\nAdd the extra option `-e NOPICKER=true`.\n\nOld machines:\n\n```bash\n# find your containerID\ndocker ps\n\n# move the no picker script on top of the Launch script\n# NEW CONTAINERS\ndocker exec containerID mv ./Launch-nopicker.sh ./Launch.sh\n\n# VNC-VERSION-CONTAINER\ndocker exec containerID mv ./Launch-nopicker.sh ./Launch_custom.sh\n\n# LEGACY CONTAINERS\ndocker exec containerID bash -c \"grep -v InstallMedia ./Launch.sh \u003e ./Launch-nopicker.sh\nchmod +x ./Launch-nopicker.sh\nsed -i -e s/OpenCore\\.qcow2/OpenCore\\-nopicker\\.qcow2/ ./Launch-nopicker.sh\n\"\n```\n\n\n\n### The big-sur image starts slowly after installation. Is this expected?\n\nAutomatic updates are still on in the container's settings. You may wish to turn them off. [We have future plans for development around this.](https://github.com/sickcodes/Docker-OSX/issues/227)\n\n### What is `${DISPLAY:-:0.0}`?\n\n`$DISPLAY` is the shell variable that refers to your X11 display server.\n\n`${DISPLAY}` is the same, but allows you to join variables like this:\n\n- e.g. `${DISPLAY}_${DISPLAY}` would print `:0.0_:0.0`\n- e.g. `$DISPLAY_$DISPLAY`     would print `:0.0`\n\n...because `$DISPLAY_` is not `$DISPLAY`\n\n`${variable:-fallback}` allows you to set a \"fallback\" variable to be substituted if `$variable` is not set.\n\nYou can also use `${variable:=fallback}` to set that variable (in your current terminal).\n\nIn Docker-OSX, we assume, `:0.0` is your default `$DISPLAY` variable.\n\nYou can see what yours is\n\n```bash\necho $DISPLAY\n```\n\nThat way, `${DISPLAY:-:0.0}` will use whatever variable your X11 server has set for you, else `:0.0`\n\n### What is `-v /tmp/.X11-unix:/tmp/.X11-unix`?\n\n`-v` is a Docker command-line option that lets you pass a volume to the container.\n\nThe directory that we are letting the Docker container use is a X server display socket.\n\n`/tmp/.X11-unix`\n\nIf we let the Docker container use the same display socket as our own environment, then any applications you run inside the Docker container will show up on your screen too! [https://www.x.org/archive/X11R6.8.0/doc/RELNOTES5.html](https://www.x.org/archive/X11R6.8.0/doc/RELNOTES5.html)\n\n### ALSA errors on startup or container creation\n\nYou may when initialising or booting into a container see errors from the `(qemu)` console of the following form: \n`ALSA lib blahblahblah: (function name) returned error: no such file or directory`. These are more or less expected. As long as you are able to boot into the container and everything is working, no reason to worry about these.\n\nSee also: [here](https://github.com/sickcodes/Docker-OSX/issues/174).\n","funding_links":["https://github.com/sponsors/sickcodes"],"categories":["Shell","HarmonyOS","Dockerfile (2)","Docker","Websites","Dockerfile","Dockerfile (37)","macos","其他__大数据","docker","Infrastructure Tooling","os"],"sub_categories":["Windows Manager","网络服务_其他","Web"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsickcodes%2FDocker-OSX","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsickcodes%2FDocker-OSX","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsickcodes%2FDocker-OSX/lists"}