# Docker-OSX · [Follow @sickcodes on Twitter](https://twitter.com/sickcodes) ![Running Mac OS X in a Docker container](/running-mac-inside-docker-qemu.png?raw=true "OSX KVM DOCKER") Run Mac OS X in Docker with near-native performance! X11 Forwarding! iMessage security research! ## Author This project is maintained by [Sick.Codes](https://sick.codes/). [(Twitter)](https://twitter.com/sickcodes) Additional credits can be found here: https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md Additionally, comprehensive list of all contributors can be found here: https://github.com/sickcodes/Docker-OSX/graphs/contributors Special thanks to [@kholia](https://twitter.com/kholia) for maintaining the upstream project, which Docker-OSX is built on top of: [OSX-KVM](https://github.com/kholia/OSX-KVM). ## Technical details **Current large image size:** 17.5GB The images (excluding `:naked`) launch a container with an existing installation with a couple of premade configurations. This special image was developed by [Sick.Codes](https://sick.codes): - username: `user`, password: `alpine` - ssh enabled (`localhost:50922`) - vnc enabled (`localhost:8888`) - auto-updates disabled - serial number generators! - x11 forwarding is enabled - runs on top of QEMU + KVM - supports big sur, custom images, xfvb headless mode - you can clone your container with `docker commit` ### Requirements - at least 50 GBs (half for the base image, half for your runtime image - virtualization should be enabled in your bios settings - a kvm-capable host ### To be done - documentation for security researchers - gpu acceleration - support for virt-manager Big thanks to the OpenCore team over at: https://github.com/acidanthera/OpenCorePkg. Their well-maintained bootloader provides much of the great functionality that Docker-OSX users enjoy :) If you like this project, consider contributing upstream! ## Docker Images built on top of the contents of this repository are also available on **Docker Hub** for convenience: https://hub.docker.com/r/sickcodes/docker-osx A comprehensive list of the available Docker images and their intended purpose can be found in the [Instructions](README.md#Instructions). ## Kubernetes Docker-OSX supports Kubernetes. Kubernetes Helm Chart & Documentation can be found under the [helm directory](helm/README.md). Thanks [cephasara](https://github.com/cephasara) for contributing this major contribution. [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/docker-osx)](https://artifacthub.io/packages/search?repo=docker-osx) ## Support ### Small questions & issues Feel free to open an [issue](https://github.com/sickcodes/Docker-OSX/issues/new/choose), should you come across minor issues with running Docker-OSX or have any questions. #### Resolved issues Before you open an issue, however, please check the [closed issues](https://github.com/sickcodes/Docker-OSX/issues?q=is%3Aissue+is%3Aclosed) and confirm that you're using the latest version of this repository — your issues may have already been resolved! ### Feature requests and updates Follow [@sickcodes](https://twitter.com/sickcodes)! ### Professional support For more sophisticated endeavours, we offer the following support services: - Enterprise support, business support, or casual support. - Custom images, custom scripts, consulting (per hour available!) - One-on-one conversations with you or your development team. In case you're interested, contact [@sickcodes on Twitter](https://twitter.com/sickcodes) or click [here](https://sick.codes/contact). ## License/Contributing Docker-OSX is licensed under the [GPL v3+](LICENSE). Contributions are welcomed and immensely appreciated. You are in-fact permitted to use Docker-OSX as a tool to create proprietary software. ### Other cool Docker/QEMU based projects - [Run iOS in a Docker container with Docker-eyeOS](https://github.com/sickcodes/Docker-eyeOS) - [https://github.com/sickcodes/Docker-eyeOS](https://github.com/sickcodes/Docker-eyeOS) ## Disclaimer If you are serious about Apple Security, and possibly finding 6-figure bug bounties within the Apple Bug Bounty Program, then you're in the right place! Further notes: [Is Hackintosh, OSX-KVM, or Docker-OSX legal?](https://sick.codes/is-hackintosh-osx-kvm-or-docker-osx-legal/). Product names, logos, brands and other trademarks referred to within this project are the property of their respective trademark holders. These trademark holders are not affiliated with our repository in any capacity. They do not sponsor or endorse this project in any way. ## Instructions #### Quick Start ```bash docker pull sickcodes/docker-osx:latest # Catalina docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:latest docker pull sickcodes/docker-osx:big-sur # Big Sur docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:big-sur # Wait 2-3 minutes until the logo appears. ``` ### Container images There are three different Docker images available, which are suitable for different purposes: **latest**, **auto** and **naked**. - `sickcodes/docker-osx:latest` - [I just want to try it out.](https://github.com/sickcodes/Docker-OSX#quick-start-large-pre-made-image) - `sickcodes/docker-osx:latest` - [I want to use Docker-OSX to develop/secure apps in Xcode (sign into Xcode, Transporter)](https://github.com/sickcodes/Docker-OSX#basic-quick-start-docker-osx) - `sickcodes/docker-osx:naked` - [I want to use Docker-OSX for CI/CD-related purposes (sign into Xcode, Transporter)](https://github.com/sickcodes/Docker-OSX#fully-headless-using-my-own-image-for-cicd) Create your personal image using `:latest`. Then, extract the image. Afterwards, you will be able to duplicate that image and import it to the `:naked` container, in order to revert the container to a previous state repeatedly. - `sickcodes/docker-osx:auto` - [I'm only interested in using the command line. (Useful for compiling software or using Homebrew headlessly).](https://github.com/sickcodes/Docker-OSX#pre-built-image-arbitrary-command-line-arguments) - `sickcodes/docker-osx:naked` - [I need iMessage/iCloud for security research.](https://github.com/sickcodes/Docker-OSX#serial-numbers) #### I need video output. The Quick Start command should work out of the box, provided that you keep the following lines. Works in `auto` & `naked` machines: ``` -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ ``` #### I need to use Docker-OSX headlessly. In that case, **remove** the two lines in your command: ``` # -v /tmp/.X11-unix:/tmp/.X11-unix \ # -e "DISPLAY=${DISPLAY:-:0.0}" \ ``` #### I need VNC to a Remote Host (Secure) Now you can direct connect VNC to any image! Add the following line: `-e EXTRA="-display none -vnc 0.0.0.0:99,password"` In the Docker terminal, press `enter` until you see `(qemu)`. Type `change vnc password` `ip n` will usually show the container IP first. Port is `5999`. Now VNC connect using the Docker container IP, for example `172.17.0.2:5999` You can also find the container IP: `docker inspect | jq -r '.[0].NetworkSettings.IPAddress'` Remote VNC over SSH: `ssh -N root@1.1.1.1 -L 5999:172.17.0.2:5999`, where `1.1.1.1` is your remote server IP and `172.17.0.2` is your LAN container IP. #### I need VNC on localhost (Local use only!) ##### VNC Insecure **NOT TLS/HTTPS Encrypted at all!** ``` -p 5999:5999 -e EXTRA="-display none -vnc 0.0.0.0:99,password" ``` VNC Connect to `localhost:5999`. Or `ssh -N root@1.1.1.1 -L 5999:127.0.0.1:5999`, where `1.1.1.1` is your remote server IP. (Note: if you close port 5999 and use the SSH tunnel, this becomes secure.) #### I have used Docker-OSX before and wish to extract my Mac OS X image. Use `docker commit`, copy the ID, and then run `docker start -ai `. **Alternatively:** [Extract the .img file](https://github.com/sickcodes/Docker-OSX#backup-the-disk-wheres-my-disk), and then use that [.img file with :naked](https://github.com/sickcodes/Docker-OSX#quick-start-own-image-naked-container-image) #### Further examples Apart from the previous examples, there's a myriad of other potential use cases that can work perfectly with Docker-OSX. ### Run Mac OS X ```bash docker pull sickcodes/docker-osx:auto # boot directly into a real OS X shell with no display (Xvfb) [HEADLESS] docker run -it \ --device /dev/kvm \ -p 50922:10022 \ sickcodes/docker-osx:auto # Wait 2-3 minutes until you drop into the shell. ``` ```bash docker pull sickcodes/docker-osx:auto # boot directly into a real OS X shell with a visual display [NOT HEADLESS] docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:auto ``` ### Download the image manually and use it in Docker This is a particularly good way for downloading the container, in case Docker's CDN (or your connection) happens to be slow. ```bash wget https://images2.sick.codes/mac_hdd_ng_auto.img docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v "${PWD}/mac_hdd_ng_auto.img:/image" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:naked ``` ### Use a pre-built image + arbitrary command line arguments. ```bash docker pull sickcodes/docker-osx:auto # boot to OS X shell + display + specify commands to run inside OS X! docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ -e "OSX_COMMANDS=/bin/bash -c \"pwd && uname -a\"" \ sickcodes/docker-osx:auto # Boots in a minute or two! ``` ### Run Mac OS X headlessly with a custom image This is particularly helpful for CI/CD pipelines. ```bash # run your own image headless + SSH docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v "${PWD}/mac_hdd_ng.img:/image" \ sickcodes/docker-osx:naked ``` ### Restart a container that starts automatically Containers that use `sickcodes/docker-osx:auto` can be stopped while being started. ```bash # find last container docker ps -a # docker start old container with -i for interactive, -a for attach STDIN/STDOUT docker start -ai -i ``` ### Quick Start your own image (naked container image) This is my favourite container. You can supply an existing disk image as a Docker command line argument. - Pull images out using `sudo find /var/lib/docker -size +10G | grep mac_hdd_ng.img` - Supply your own local image with the command argument `-v "${PWD}/mac_hdd_ng.img:/image"` and use `sickcodes/docker-osx:naked` when instructing Docker to create your container. - Naked image is for booting any existing .img file, e.g in the current working directory (`$PWD`) - By default, this image has a variable called `NOPICKER` which is `"true"`. This skips the disk selection menu. Use `-e NOPICKER=false` or any other string than the word `true` to enter the boot menu. This lets you use other disks instead of skipping the boot menu, e.g. recovery disk or disk utility. ```bash docker pull sickcodes/docker-osx:naked # run your own image + SSH # change mac_hdd_ng.img docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v "${PWD}/mac_hdd_ng.img:/image" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:naked # run local copy of the auto image + SSH + Boot menu docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -v "${PWD}/mac_hdd_ng_auto.img:/image" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ -e "NOPICKER=false" \ sickcodes/docker-osx:naked ``` ### Run the original version of Docker-OSX ```bash docker pull sickcodes/docker-osx:latest docker run -it \ --device /dev/kvm \ --device /dev/snd \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:latest # press CTRL + G if your mouse gets stuck # scroll down to troubleshooting if you have problems # need more RAM and SSH on localhost -p 50922? ``` # Run but enable SSH in OS X (Original Version)! ```bash docker run -it \ --device /dev/kvm \ --device /dev/snd \ -p 50922:10022 \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e "DISPLAY=${DISPLAY:-:0.0}" \ sickcodes/docker-osx:latest # turn on SSH after you've installed OS X in the "Sharing" settings. ssh user@localhost -p 50922 ``` ### Autoboot into OS X after you've installed everything You can use `-e NOPICKER=true`. Old machines: ```bash # find you containerID docker ps # move the no picker script on top of the Launch script # NEW CONTAINERS docker exec containerID mv ./Launch-nopicker.sh ./Launch.sh # VNC-VERSION-CONTAINER docker exec containerID mv ./Launch-nopicker.sh ./Launch_custom.sh # LEGACY CONTAINERS docker exec containerID bash -c "grep -v InstallMedia ./Launch.sh > ./Launch-nopicker.sh chmod +x ./Launch-nopicker.sh sed -i -e s/OpenCore\.qcow2/OpenCore\-nopicker\.qcow2/ ./Launch-nopicker.sh " ``` # Requirements: KVM on the host Need to turn on hardware virtualization in your BIOS, very easy to do. Then have QEMU on the host if you haven't already ```bash # ARCH sudo pacman -S qemu libvirt dnsmasq virt-manager bridge-utils flex bison iptables-nft edk2-ovmf # UBUNTU DEBIAN sudo apt install qemu qemu-kvm libvirt-clients libvirt-daemon-system bridge-utils virt-manager # CENTOS RHEL FEDORA sudo yum install libvirt qemu-kvm # then run sudo systemctl enable --now libvirtd sudo systemctl enable --now virtlogd echo 1 | sudo tee /sys/module/kvm/parameters/ignore_msrs sudo modprobe kvm ``` # Start the same container later (persistent disk) 1. You can now pull the `.img` file out of the container, which is stored in `/var/lib/docker`, and supply it as a runtime argument to the `:naked` Docker image. See above. 2. This is for when you want to run the SAME container again later. If you don't run this you will have a new image every time. ```bash # look at your recent containers and copy the CONTAINER ID docker ps --all # docker start the container ID docker start -ai abc123xyz567 # if you have many containers, you can try automate it with filters like this # docker ps --all --filter "ancestor=sickcodes/docker-osx" # for locally tagged/built containers # docker ps --all --filter "ancestor=docker-osx" ``` # Additional Boot Instructions - Boot the macOS Base System - Click `Disk Utility` - Erase the BIGGEST disk (around 200gb default), DO NOT MODIFY THE SMALLER DISKS. -- if you can't click `erase`, you may need to reduce the disk size by 1kb - (optional) Create a partition using the unused space to house the OS and your files if you want to limit the capacity. (For Xcode 12 partition at least 60gb.) - Click `Reinstall macOS` ## Creating images: ```bash # You can create an image of an already configured and setup container. # This allows you to effectively duplicate a system. # To do this, run the following commands # make note of your container id docker ps --all docker commit containerid newImageName # To run this image do the following docker run \ --device /dev/kvm \ --device /dev/snd \ -v /tmp/.X11-unix:/tmp/.X11-unix \ newImageName ``` ## Troubleshooting Big thank you to our contributors who have worked out almost every conceivable issue so far! ### LibGTK - Permission denied [https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md](https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md) #### libgtk permissions denied error ```bash echo $DISPLAY # ARCH sudo pacman -S xorg-xhost # UBUNTU DEBIAN sudo apt install x11-xserver-utils # CENTOS RHEL FEDORA sudo yum install xorg-x11-server-utils # then run xhost + ``` #### RAM over-allocation Error Cause by trying to allocate more ram to the container than you currently have available for allocation: `cannot set up guest memory 'pc.ram': Cannot allocate memory`. For example: ```console [user@hostname ~]$ free -mh total used free shared buff/cache available Mem: 30Gi 3.5Gi 7.0Gi 728Mi 20Gi 26Gi Swap: 11Gi 0B 11Gi ``` In the example above, the `buff/cache` already contains 20 Gigabytes of allocated RAM. Clear the buffer and the cache: ```bash sudo tee /proc/sys/vm/drop_caches <<< 3 ``` Now check the ram again: ```console [user@hostname ~]$ free -mh total used free shared buff/cache available Mem: 30Gi 3.3Gi 26Gi 697Mi 1.5Gi 26Gi Swap: 11Gi 0B 11Gi ``` Of course you cannot allocate more RAM that your have. The default is 3 Gigabytes: `-e RAM=3`. #### PulseAudio ### Use PulseAudio for sound Note: [AppleALC](https://github.com/acidanthera/AppleALC), [`alcid`](https://dortania.github.io/OpenCore-Post-Install/universal/audio.html) and [VoodooHDA-OC](https://github.com/chris1111/VoodooHDA-OC) do not have [codec support](https://osy.gitbook.io/hac-mini-guide/details/hda-fix#hda-codec). However, [IORegistryExplorer](https://github.com/vulgo/IORegistryExplorer) does show the controller component working. ```bash docker run \ --device /dev/kvm \ -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \ -v "/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ sickcodes/docker-osx ``` #### PulseAudio debugging ```bash docker run \ --device /dev/kvm \ -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \ -v "/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket" \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e PULSE_SERVER=unix:/tmp/pulseaudio.socket \ sickcodes/docker-osx pactl list ``` #### Nested Hardware Virtualization Check if your PC has hardware virtualization enabled: ```bash sudo tee /sys/module/kvm/parameters/ignore_msrs <<< 1 egrep -c '(svm|vmx)' /proc/cpuinfo ``` ### Routine checks #### Confirm that your CPU supports virtualization #### Add yourself to the Docker group, KVM group, libvirt group. If you use `sudo dockerd` or dockerd is controlled by systemd/systemctl, then you must be in the Docker group: #### Try adding yourself to the docker group ```bash sudo usermod -aG docker "${USER}" ``` and also to the kvm and libvirt groups: ```bash sudo usermod -aG libvirt "${USER}" sudo usermod -aG kvm "${USER}" ``` #### Enable docker daemon ```bash # enable it in systemd sudo systemctl enable --now docker # or run ad hoc sudo dockerd # or daemonize it sudo nohup dockerd & ``` #### Forward additional ports (nginx) It's possible to forward additional ports depending on your needs. In this example, we're going to use Mac OS X to host nginx in a way that looks like this: ``` host:10023 <-> 10023:container:10023 <-> 80:guest ``` On the host machine, you should run: ```bash docker run -it \ --device /dev/kvm \ -p 50922:10022 \ -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,' \ -p 10023:10023 \ sickcodes/docker-osx:auto ``` In a Terminal session running the container, you should run: ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" brew install nginx sudo sed -i -e 's/8080/80/' /usr/local/etc/nginx/nginx.confcd # sudo nginx -s stop sudo nginx ``` **nginx should now be reachable on the port 10023.** Additionally, you can string multiple statements, for example: ```bash -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,hostfwd=tcp::10043-:443,' -p 10023:10023 \ -p 10043:10043 \ ``` ### Enable IPv4 forwarding for bridged network connections This is not required for LOCAL installations and may [cause the host to leak your IP, even if you're using a VPN in the container](https://sick.codes/cve-2020-15590/). However, if you're trying to connect to an instance of Docker-OSX remotely (e.g. an instance of Docker-OSX hosted in a datacenter), this may improve your performance: ```bash # enable for current session sudo sysctl -w net.ipv4.ip_forward=1 # OR # sudo tee /proc/sys/net/ipv4/ip_forward <<< 1 # enable permanently sudo touch /etc/sysctl.conf sudo tee -a /etc/sysctl.conf <