krzkowalczyk/docker-osx repository overview

⁠Docker-OSX · Follow @sickcodes on Twitter⁠

Run Mac OS X in Docker with near-native performance! X11 Forwarding! iMessage security research!

⁠Author

This project is maintained by Sick.Codes⁠. (Twitter)⁠

Additional credits can be found here: https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md⁠

Additionally, comprehensive list of all contributors can be found here: https://github.com/sickcodes/Docker-OSX/graphs/contributors⁠

Big thanks to @kholia⁠ for maintaining the upstream project, which Docker-OSX is built on top of: OSX-KVM⁠.

Also special thanks to @thenickdude⁠ who maintains the valuable fork KVM-OpenCore⁠, which was started by @Leoyzen⁠!

Extra special thanks to the OpenCore team over at: https://github.com/acidanthera/OpenCorePkg⁠. Their well-maintained bootloader provides much of the great functionality that Docker-OSX users enjoy :)

If you like this project, consider contributing here or upstream!

⁠Quick Start Docker-OSX

First time here? try initial setup⁠, otherwise try the instructions below to use either Catalina or Big Sur.

⁠Catalina

docker run -it \
    --device /dev/kvm \
    -p 50922:10022 \
    -v /tmp/.X11-unix:/tmp/.X11-unix \
    -e "DISPLAY=${DISPLAY:-:0.0}" \
    sickcodes/docker-osx:latest

⁠Big Sur

docker run -it \
    --device /dev/kvm \
    -p 50922:10022 \
    -v /tmp/.X11-unix:/tmp/.X11-unix \
    -e "DISPLAY=${DISPLAY:-:0.0}" \
    -e GENERATE_UNIQUE=true \
    -e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist \
    sickcodes/docker-osx:big-sur

⁠Important notices:

2021-05-04: Big Sur requires an updated OpenCore.qcow2 image, simply add:

    -e GENERATE_UNIQUE=true \
    -e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist \

⁠Technical details

There currently four images, each with different use cases (explained below⁠):

Catalina make your own image:

Big-Sur make your own image:

Pre-made system by Sick.Codes⁠: username: user, password: alpine

Bring-your-own-image setup (use any of the above first):

⁠Capabilities

• SSH enabled (localhost:50922)
• VNC enabled (localhost:8888) if using ./vnc version
• serial number generator!⁠
• X11 forwarding is enabled
• runs on top of QEMU + KVM
• supports Big Sur, custom images, Xvfb headless mode
• you can clone your container with docker commit

⁠Requirements

• 20GB disk space for bare minimum installation
• virtualization should be enabled in your BIOS settings
• a kvm-capable host
• at least 50 GBs for :auto (half for the base image, half for your runtime image

⁠TODO

• documentation for security researchers
• gpu acceleration
• support for virt-manager

⁠Docker

Images built on top of the contents of this repository are also available on Docker Hub for convenience: https://hub.docker.com/r/sickcodes/docker-osx⁠

A comprehensive list of the available Docker images and their intended purpose can be found in the Instructions⁠.

⁠Kubernetes

Docker-OSX supports Kubernetes.

Kubernetes Helm Chart & Documentation can be found under the helm directory⁠.

Thanks cephasara⁠ for contributing this major contribution.

⁠Support

⁠Small questions & issues

Feel free to open an issue⁠, should you come across minor issues with running Docker-OSX or have any questions.

⁠Resolved issues

Before you open an issue, however, please check the closed issues⁠ and confirm that you're using the latest version of this repository — your issues may have already been resolved! You might also see your answer in our questions and answers section below⁠.

⁠Feature requests and updates

Follow @sickcodes⁠!

⁠Professional support

For more sophisticated endeavours, we offer the following support services:

• Enterprise support, business support, or casual support.
• Custom images, custom scripts, consulting (per hour available!)
• One-on-one conversations with you or your development team.

In case you're interested, contact @sickcodes on Twitter⁠ or click here⁠.

⁠License/Contributing

Docker-OSX is licensed under the GPL v3+⁠. Contributions are welcomed and immensely appreciated. You are in-fact permitted to use Docker-OSX as a tool to create proprietary software.

⁠Other cool Docker/QEMU based projects

• Run iOS in a Docker container with Docker-eyeOS⁠ - https://github.com/sickcodes/Docker-eyeOS⁠
• Run iMessage relayer in Docker with Bluebubbles.app⁠ - Getting started wiki⁠

⁠Disclaimer

If you are serious about Apple Security, and possibly finding 6-figure bug bounties within the Apple Bug Bounty Program, then you're in the right place! Further notes: Is Hackintosh, OSX-KVM, or Docker-OSX legal?⁠

Product names, logos, brands and other trademarks referred to within this project are the property of their respective trademark holders. These trademark holders are not affiliated with our repository in any capacity. They do not sponsor or endorse this project in any way.

⁠Instructions

⁠Container images

⁠Already set up or just looking to make a container quickly? Check out our quick start⁠ or see a bunch more use cases under our container creation examples⁠ section.

There are several different Docker-OSX images available which are suitable for different purposes.

• sickcodes/docker-osx:latest - I just want to try it out.⁠
• sickcodes/docker-osx:latest - I want to use Docker-OSX to develop/secure apps in Xcode (sign into Xcode, Transporter)⁠
• sickcodes/docker-osx:naked - I want to use Docker-OSX for CI/CD-related purposes (sign into Xcode, Transporter)⁠

Create your personal image using :latest or big-sur. Then, pull the image out the image. Afterwards, you will be able to duplicate that image and import it to the :naked container, in order to revert the container to a previous state repeatedly.

• sickcodes/docker-osx:auto - I'm only interested in using the command line (useful for compiling software or using Homebrew headlessly).⁠
• sickcodes/docker-osx:naked - I need iMessage/iCloud for security research.⁠
• sickcodes/docker-osx:big-sur - I want to run Big Sur.⁠

⁠Initial setup

Before you do anything else, you will need to turn on hardware virtualization in your BIOS. Precisely how will depend on your particular machine (and BIOS), but it should be straightforward.

Then, you'll need QEMU and some other dependencies on your host:

# ARCH
sudo pacman -S qemu libvirt dnsmasq virt-manager bridge-utils flex bison iptables-nft edk2-ovmf

# UBUNTU DEBIAN
sudo apt install qemu qemu-kvm libvirt-clients libvirt-daemon-system bridge-utils virt-manager

# CENTOS RHEL FEDORA
sudo yum install libvirt qemu-kvm

Then, enable libvirt and load the KVM kernel module:

sudo systemctl enable --now libvirtd
sudo systemctl enable --now virtlogd

echo 1 | sudo tee /sys/module/kvm/parameters/ignore_msrs

sudo modprobe kvm

⁠Additional boot instructions for when you are creating your container⁠

• Boot the macOS Base System

• Click Disk Utility

• Erase the BIGGEST disk (around 200gb default), DO NOT MODIFY THE SMALLER DISKS. -- if you can't click erase, you may need to reduce the disk size by 1kb

• (optional) Create a partition using the unused space to house the OS and your files if you want to limit the capacity. (For Xcode 12 partition at least 60gb.)

• Click Reinstall macOS

⁠Troubleshooting

⁠Routine checks

This is a great place to start if you are having trouble getting going, especially if you're not that familiar with Docker just yet.

Just looking to make a container quickly? Check out our container creation examples⁠ section.

More specific/advanced troubleshooting questions and answers may be found in More Questions and Answers⁠. You should also check out the closed issues⁠. Someone else might have gotten a question like yours answered already even if you can't find it in this document!

⁠Confirm that your CPU supports virtualization

See initial setup⁠.

⁠Confirm your user is part of the the Docker group, KVM group, libvirt group

If you use sudo dockerd or dockerd is controlled by systemd/systemctl, then you must be in the Docker group. If you are not in the Docker group:

sudo usermod -aG docker "${USER}"

and also add yourself to the kvm and libvirt groups if needed:

sudo usermod -aG libvirt "${USER}"
sudo usermod -aG kvm "${USER}"

See also: initial setup⁠.

⁠Is the docker daemon enabled?

# enable it in systemd (it will persist across reboots this way)
sudo systemctl enable --now docker

# or just start it as your user with systemd instead of enabling it
systemctl start docker

# or run ad hoc
sudo dockerd

# or daemonize it
sudo nohup dockerd &

⁠More Questions and Answers

Big thank you to our contributors who have worked out almost every conceivable issue so far!

https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md⁠

⁠The big-sur image starts slowly after installation. Is this expected?

Automatic updates are still on in the container's settings. You may wish to turn them off. We have future plans for development around this.⁠

⁠What is ${DISPLAY:-:0.0}?

$DISPLAY is the shell variable that refers to your X11 display server.

${DISPLAY} is the same, but allows you to join variables like this:

• e.g. ${DISPLAY}_${DISPLAY} would print :0.0_:0.0
• e.g. $DISPLAY_$DISPLAY would print :0.0

...because $DISPLAY_ is not $DISPLAY

${variable:-fallback} allows you to set a "fallback" variable to be substituted if $variable is not set.

You can also use ${variable:=fallback} to set that variable (in your current terminal).

In Docker-OSX, we assume, :0.0 is your default $DISPLAY variable.

You can see what yours is

echo $DISPLAY

That way, ${DISPLAY:-:0.0} will use whatever variable your X11 server has set for you, else :0.0

⁠What is -v /tmp/.X11-unix:/tmp/.X11-unix?

-v is a Docker command-line option that lets you pass a volume to the container.

The directory that we are letting the Docker container use is a X server display socket.

/tmp/.X11-unix

If we let the Docker container use the same display socket as our own environment, then any applications you run inside the Docker container will show up on your screen too! https://www.x.org/archive/X11R6.8.0/doc/RELNOTES5.html⁠

⁠ALSA errors on startup or container creation

You may when initialising or booting into a container see errors from the (qemu) console of the following form: ALSA lib blahblahblah: (function name) returned error: no such file or directory. These are more or less expected. As long as you are able to boot into the container and everything is working, no reason to worry about these.

See also: here⁠.

⁠Start the same container later (persistent disk)

Created a container with docker run and want to reuse the underlying image again later?

NB: see container creation examples⁠ first for how to get to the point where this is applicable.

This is for when you want to run the SAME container again later. You may need to use docker commit to save your container before you can reuse it. Check if your container is persisted with docker ps --all.

If you don't run this you will have a new image every time.

# look at your recent containers and copy the CONTAINER ID
docker ps --all

# docker start the container ID
docker start -ai abc123xyz567

# if you have many containers, you can try automate it with filters like this
# docker ps --all --filter "ancestor=sickcodes/docker-osx"
# for locally tagged/built containers
# docker ps --all --filter "ancestor=docker-osx"

You can also pull the .img file out of the container, which is stored in /var/lib/docker, and supply it as a runtime argument to the :naked Docker image.

See also: here⁠.

⁠I have used Docker-OSX before and want to restart a container that starts automatically

Containers that use sickcodes/docker-osx:auto can be stopped while being started.

# find last container
docker ps -a

# docker start old container with -i for interactive, -a for attach STDIN/STDOUT
docker start -ai -i <Replace this with your ID>

⁠LibGTK errors

You may see one or more libgtk-related errors if you do not have everything set up for hardware virtualisation yet. If you have not yet done so, check out the initial setup⁠ section and the routine checks⁠ section as you may have missed a setup step or may not have all the needed Docker dependencies ready to go.

See also: here⁠.

⁠Permissions denied error

If you have not yet set up xhost, try the following:

echo $DISPLAY

# ARCH
sudo pacman -S xorg-xhost

# UBUNTU DEBIAN
sudo apt install x11-xserver-utils

# CENTOS RHEL FEDORA
sudo yum install xorg-x11-server-utils

# then run
xhost +

⁠RAM over-allocation

You cannot allocate more RAM than your machine has. The default is 3 Gigabytes: -e RAM=3.

If you are trying to allocate more RAM to the container than you currently have available, you may see an error like the following: cannot set up guest memory 'pc.ram': Cannot allocate memory. See also: here⁠, here⁠.

For example (below) the buff/cache already contains 20 Gigabytes of allocated RAM:

[user@hostname ~]$ free -mh
               total        used        free      shared  buff/cache   available
Mem:            30Gi       3.5Gi       7.0Gi       728Mi        20Gi        26Gi
Swap:           11Gi          0B        11Gi

Clear the buffer and the cache:

sudo tee /proc/sys/vm/drop_caches <<< 3

Now check the RAM again:

[user@hostname ~]$ free -mh
               total        used        free      shared  buff/cache   available
Mem:            30Gi       3.3Gi        26Gi       697Mi       1.5Gi        26Gi
Swap:           11Gi          0B        11Gi

⁠PulseAudio

⁠Use PulseAudio for sound

Note: AppleALC⁠, alcid⁠ and VoodooHDA-OC⁠ do not have codec support⁠. However, IORegistryExplorer⁠ does show the controller component working.

docker run \
    --device /dev/kvm \
    -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \
    -v "/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket" \
    -v /tmp/.X11-unix:/tmp/.X11-unix \
    sickcodes/docker-osx

⁠PulseAudio debugging

docker run \
    --device /dev/kvm \
    -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \
    -v "/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket" \
    -v /tmp/.X11-unix:/tmp/.X11-unix \
    -e PULSE_SERVER=unix:/tmp/pulseaudio.socket \
    sickcodes/docker-osx pactl list

⁠Forward additional ports (nginx hosting example)

It's possible to forward additional ports depending on your needs. In this example, we'll use Mac OSX to host nginx:

host:10023 <-> 10023:container:10023 <-> 80:guest

On the host machine, run:

docker run -it \
    --device /dev/kvm \
    -p 50922:10022 \
    -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,' \
    -p 10023:10023 \
    sickcodes/docker-osx:auto

In a Terminal session running the container, run:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

brew install nginx
sudo sed -i -e 's/8080/80/' /usr/local/etc/nginx/nginx.confcd
# sudo nginx -s stop
sudo nginx

nginx should now be reachable on port 10023.

Additionally, you can string multiple statements together, for example:

    -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,hostfwd=tcp::10043-:443,'
    -p 10023:10023 \
    -p 10043:10043 \

⁠Bridged networking

You might not need to do anything with the default setup to enable internet connectivity from inside the container. Additionally, curl may work even if ping doesn't.

See discussion here⁠ and here⁠ and here⁠.

⁠Enable IPv4 forwarding for bridged network connections for remote installations

This is not required for LOCAL installations.

Additionally note it may cause the host to leak your IP, even if you're using a VPN in the container⁠.

However, if you're trying to connect to an instance of Docker-OSX remotely (e.g. an instance of Docker-OSX hosted in a datacenter), this may improve your performance:

# enable for current session
sudo sysctl -w net.ipv4.ip_forward=1

# OR
# sudo tee /proc/sys/net/ipv4/ip_forward <<< 1

# enable permanently
sudo touch /etc/sysctl.conf
sudo tee -a /etc/sysctl.conf <<EOF
net.ipv4.ip_forward = 1
EOF

# or edit manually with the editor of your choice
nano /etc/sysctl.conf || vi /etc/sysctl.conf || vim /etc/sysctl.conf

# now reboot

⁠Fedora: enable internet connectivity with a bridged network

Fedora's default firewall settings may prevent Docker's network interface from reaching the internet. In order to reoslve this, you will need to whitelist the interface in your firewall:

# Set the docker0 bridge to the trusted zone
sudo firewall-cmd --permanent --zone=trusted --add-interface=docker0
sudo firewall-cmd --reload

⁠Nested Hardware Virtualization

Check if your machine has hardware virtualization enabled:

sudo tee /sys/module/kvm/parameters/ignore_msrs <<< 1

egrep -c '(svm|vmx)' /proc/cpuinfo

⁠Virtual network adapters

⁠Fast internet connectivity

-e NETWORKING=vmxnet3

⁠Slow internet connectivity

-e NETWORKING=e1000-82545em

⁠CI/CD Related Improvements

⁠Tips for reducing the size of the image

• Start the container as usual, and remove unnecessary files. A useful way to do this is to use du -sh * starting from the / directory, and find large directories where files can be removed. E.g. unnecessary cached files, Xcode platforms, etc.
• Once you are satisfied with the amount of free space, enable trim with sudo trimforce enable, and reboot.
• Zero out the empty space on the disk with dd if=/dev/zero of=./empty && rm -f empty
• Shut down the VM and copy out the qcow image with docker cp stoppedcontainer:/home/arch/OSX-KVM/mac_hdd_ng.img .
• Run qemu-img check -r all mac_hdd_ng.img to fix any errors.
• Run qemu-img convert -O qcow2 mac_hdd_ng.img deduped.img and check for errors again
• OPTIONAL: Run qemu-img convert -c -O qcow2 deduped.img compressed.img to further compress the image. This may reduce the runtime speed though, but it should reduce the size by roughly 25%.
• Check for errors again, and build a fresh docker image. E.g. with this Dockerfile

FROM sickcodes/docker-osx
USER arch
COPY --chown=arch ./deduped.img /home/arch/OSX-KVM/mac_hdd_ng.img

⁠Run Docker-OSX headlessly with Telnet

First make sure autoboot is enabled⁠

Next, you will want to set up SSH to be automatically started.

sudo systemsetup -setremotelogin on

Make sure to commit the new docker image and save it, or rebuild as described in the section on reducing disk space⁠.

Then run it with these arguments.

# Run with the -nographic flag, and enable a telnet interface
  docker run \
    --device /dev/kvm \
    -p 50922:10022 \
    -e "DISPLAY=${DISPLAY:-:0.0}" \
    -e EXTRA="-monitor telnet::45454,server,nowait -nographic -serial null" \
    mycustomimage

⁠What mirrors are appropriate to use to build Docker-OSX locally?

If you are building Docker-OSX locally, you'll probably want to use Arch Linux's mirrors.

Mirror locations can be found here (uses two-letter country codes): https://archlinux.org/mirrorlist/all/⁠

docker build -t docker-osx:latest \
    --build-arg RANKMIRRORS=true \
    --build-arg MIRROR_COUNTRY=US \
    --build-arg MIRROR_COUNT=10 \
    --build-arg VERSION=10.15.6 \
    --build-arg SIZE=200G .

⁠Custom QEMU Arguments (passthrough devices)

Pass any devices/directories to the Docker container & the QEMU arguments using the handy runtime argument provider option -e EXTRA=.

# example customizations
docker run \
    -e RAM=4 \
    -e SMP=4 \
    -e CORES=4 \
    -e EXTRA='-usb -device usb-host,hostbus=1,hostaddr=8' \
    -e INTERNAL_SSH_PORT=23 \
    -e MAC_ADDRESS="$(xxd -c1 -p -l 6 /dev/urandom | tr '\n' ':' | cut -c1-17)" \
    -e AUDIO_DRIVER=alsa \
    -e IMAGE_PATH=/image \
    -e SCREEN_SHARE_PORT=5900 \
    -e DIS