Docker-OSX · Follow @sickcodes on Twitter
Run Mac OS X in Docker with near-native performance! X11 Forwarding! iMessage security research! iPhone USB working! macOS in a Docker container!
Conduct Security Research on macOS using both Linux & Windows!
The Discord is active on #docker-osx and anyone is welcome to come and ask questions, ideas, etc.
Click to join the Discord server https://discord.gg/sickchat
Click to join the Telegram server https://t.me/sickcodeschat
Or reach out via Linkedin if it's private: https://www.linkedin.com/in/sickcodes
Or via https://sick.codes/contact/
This project is maintained by Sick.Codes. (Twitter)
Additional credits can be found here: https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md
Additionally, comprehensive list of all contributors can be found here: https://github.com/sickcodes/Docker-OSX/graphs/contributors
Big thanks to @kholia for maintaining the upstream project, which Docker-OSX is built on top of: OSX-KVM.
Also special thanks to @thenickdude who maintains the valuable fork KVM-OpenCore, which was started by @Leoyzen!
Extra special thanks to the OpenCore team over at: https://github.com/acidanthera/OpenCorePkg. Their well-maintained bootloader provides much of the great functionality that Docker-OSX users enjoy :)
If you like this project, consider contributing here or upstream!
Video setup tutorial is also available here: https://www.youtube.com/watch?v=wLezYl77Ll8
Windows users: click here to see the notes below!
First time here? try initial setup, otherwise try the instructions below to use either Catalina or Big Sur.
docker run -it \
--device /dev/kvm \
-p 50922:10022 \
-v /tmp/.X11-unix:/tmp/.X11-unix \
-e "DISPLAY=${DISPLAY:-:0.0}" \
sickcodes/docker-osx:latest
# docker build -t docker-osx .
docker run -it \
--device /dev/kvm \
-p 50922:10022 \
-v /tmp/.X11-unix:/tmp/.X11-unix \
-e "DISPLAY=${DISPLAY:-:0.0}" \
sickcodes/docker-osx:big-sur
# docker build -t docker-osx --build-arg SHORTNAME=big-sur .
docker run -it \
--device /dev/kvm \
-p 50922:10022 \
-v /tmp/.X11-unix:/tmp/.X11-unix \
-e "DISPLAY=${DISPLAY:-:0.0}" \
-e GENERATE_UNIQUE=true \
-e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \
sickcodes/docker-osx:monterey
# docker build -t docker-osx --build-arg SHORTNAME=monterey .
# 40GB disk space required: 20GB original image 20GB your container.
docker pull sickcodes/docker-osx:auto
# boot directly into a real OS X shell with a visual display [NOT HEADLESS]
docker run -it \
--device /dev/kvm \
-p 50922:10022 \
-v /tmp/.X11-unix:/tmp/.X11-unix \
-e "DISPLAY=${DISPLAY:-:0.0}" \
-e GENERATE_UNIQUE=true \
sickcodes/docker-osx:auto
# username is user
# passsword is alpine
docker run -it \
--device /dev/kvm \
-p 50922:10022 \
-v /tmp/.X11-unix:/tmp/.X11-unix \
-e "DISPLAY=${DISPLAY:-:0.0}" \
sickcodes/docker-osx:high-sierra
# docker build -t docker-osx --build-arg SHORTNAME=high-sierra .
docker run -it \
--device /dev/kvm \
-p 50922:10022 \
-v /tmp/.X11-unix:/tmp/.X11-unix \
-e "DISPLAY=${DISPLAY:-:0.0}" \
sickcodes/docker-osx:mojave
# docker build -t docker-osx --build-arg SHORTNAME=mojave .
This is a particularly good way for downloading the container, in case Docker's CDN (or your connection) happens to be slow.
wget https://images2.sick.codes/mac_hdd_ng_auto.img
docker run -it \
--device /dev/kvm \
-p 50922:10022 \
-v "${PWD}/mac_hdd_ng_auto.img:/image" \
-v /tmp/.X11-unix:/tmp/.X11-unix \
-e "DISPLAY=${DISPLAY:-:0.0}" \
-e GENERATE_UNIQUE=true \
-e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/custom/config-nopicker-custom.plist \
sickcodes/docker-osx:naked
Enable SSH in network sharing inside the guest first. Change -e "USERNAME=user" and -e "PASSWORD=password" to your credentials. The container will add itself to ~/.ssh/authorized_keys
Since you can't see the screen, use the PLIST with nopicker, for example:
# Catalina
# wget https://images2.sick.codes/mac_hdd_ng_auto.img
# Monterey
wget https://images.sick.codes/mac_hdd_ng_auto_monterey.img
docker run -it \
--device /dev/kvm \
-p 50922:10022 \
-v "${PWD}/mac_hdd_ng_auto_monterey:/image" \
-v /tmp/.X11-unix:/tmp/.X11-unix \
-e "DISPLAY=${DISPLAY:-:0.0}" \
-e "USERNAME=user" \
-e "PASSWORD=alpine" \
-e GENERATE_UNIQUE=true \
-e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/custom/config-nopicker-custom.plist \
sickcodes/docker-osx:naked-autoThe easiest and most secure way is sshfs
# on Linux/Windows
mkdir ~/mnt/osx
sshfs user@localhost:/ -p 50922 ~/mnt/osx
# wait a few seconds, and ~/mnt/osx will have full rootfs mounted over ssh, and in userspace
# automated: sshpass -p <password> sshfs user@localhost:/ -p 50922 ~/mnt/osxIf you have a laptop see the next usbfluxd section.
If you have a desktop PC, you can use @Silfalion's instructions : https://github.com/Silfalion/Iphone_docker_osx_passthrough
Video setup tutorial for usbfluxd is also available here: https://www.youtube.com/watch?v=kTk5fGjK_PM
This method WORKS on laptop, PC, anything!
Thank you @nikias for usbfluxd via https://github.com/corellium!
This is done inside Linux.
Open 3 terminals on Linux
Connecting your device over USB on Linux allows you to expose usbmuxd on port 5000 using https://github.com/corellium/usbfluxd to another system on the same network.
Ensure usbmuxd, socat and usbfluxd are installed.
sudo pacman -S libusbmuxd usbmuxd avahi socat
Available on the AUR: https://aur.archlinux.org/packages/usbfluxd/
yay usbfluxd
Plug in your iPhone or iPad.
Terminal 1
sudo systemctl start usbmuxd
sudo avahi-daemonTerminal 2:
# on host
sudo systemctl restart usbmuxd
sudo socat tcp-listen:5000,fork unix-connect:/var/run/usbmuxdTerminal 3:
sudo usbfluxd -f -nThis is done inside macOS.
Install homebrew.
172.17.0.1 is usually the Docker bridge IP, which is your PC, but you can use any IP from ip addr...
macOS Terminal:
# on the guest
brew install make automake autoconf libtool pkg-config gcc libimobiledevice usbmuxd
git clone https://github.com/corellium/usbfluxd.git
cd usbfluxd
./autogen.sh
make
sudo make installAccept the USB over TCP connection, and appear as local:
(you may need to change 172.17.0.1 to the IP address of the host. e.g. check ip addr)
# on the guest
sudo launchctl start usbmuxd
export PATH=/usr/local/sbin:${PATH}
sudo usbfluxd -f -r 172.17.0.1:5000Close apps such as Xcode and reopen them and your device should appear!
If you need to start again on Linux, wipe the current usbfluxd, usbmuxd, and socat:
sudo killall usbfluxd
sudo systemctl restart usbmuxd
sudo killall socatMake container FASTER using https://github.com/sickcodes/osx-optimizer
SEE commands in https://github.com/sickcodes/osx-optimizer!
- Skip the GUI login screen (at your own risk!)
- Disable spotlight indexing on macOS to heavily speed up Virtual Instances.
- Disable heavy login screen wallpaper
- Disable updates (at your own risk!)
Increase disk space by moving /var/lib/docker to external drive, block storage, NFS, or any other location conceivable.
Move /var/lib/docker, following the tutorial below
- Cheap large physical disk storage instead using your server's disk, or SSD.
- Block Storage, NFS, etc.
Tutorial here: https://sick.codes/how-to-run-docker-from-block-storage/
Only follow the above tutorial if you are happy with wiping all your current Docker images/layers.
Safe mode: Disable docker temporarily so you can move the Docker folder temporarily.
- Do NOT do this until you have moved your image out already https://github.com/dulatello08/Docker-OSX/#quick-start-your-own-image-naked-container-image
killall dockerd
systemctl disable --now docker
systemctl disable --now docker.socket
systemctl stop docker
systemctl stop docker.socketNow, that Docker daemon is off, move /var/lib/docker somewhere
Then, symbolicly link /var/lib/docker somewhere:
mv /var/lib/docker /run/media/user/some_drive/docker
ln -s /run/media/user/some_drive/docker /var/lib/docker
# now check if /var/lib/docker is working still
ls /var/lib/dockerIf you see folders, then it worked. You can restart Docker, or just reboot if you want to be sure.
2021-11-14 - Added High Sierra, Mojave
Pick one of these while building, irrelevant when using docker pull:
--build-arg SHORTNAME=high-sierra
--build-arg SHORTNAME=mojave
--build-arg SHORTNAME=catalina
--build-arg SHORTNAME=big-sur
--build-arg SHORTNAME=monterey
There currently multiple images, each with different use cases (explained below):
- High Sierra
- Mojave
- Catalina
- Big Sur
- Monterey
- Auto (pre-made Catalina)
- Naked (use your own .img)
- Naked-Auto (user your own .img and SSH in)
High Sierra:
Mojave:
Catalina:
Big-Sur:
Monterey make your own image:
Pre-made Catalina system by Sick.Codes: username: user, password: alpine
Naked: Bring-your-own-image setup (use any of the above first):
Naked Auto: same as above but with -e USERNAME & -e PASSWORD and -e OSX_COMMANDS="put your commands here"
- use iPhone OSX KVM on Linux using usbfluxd!
- macOS Monterey VM on Linux!
- Folder sharing-
- USB passthrough (hotplug too)
- SSH enabled (
localhost:50922) - VNC enabled (
localhost:8888) if using ./vnc version - iMessage security research via serial number generator!
- X11 forwarding is enabled
- runs on top of QEMU + KVM
- supports Big Sur, custom images, Xvfb headless mode
- you can clone your container with
docker commit
- 20GB+++ disk space for bare minimum installation (50GB if using Xcode)
- virtualization should be enabled in your BIOS settings
- a x86_64 kvm-capable host
- at least 50 GBs for
:auto(half for the base image, half for your runtime image
- documentation for security researchers
- gpu acceleration
- support for virt-manager
Images built on top of the contents of this repository are also available on Docker Hub for convenience: https://hub.docker.com/r/sickcodes/docker-osx
A comprehensive list of the available Docker images and their intended purpose can be found in the Instructions.
Docker-OSX supports Kubernetes.
Kubernetes Helm Chart & Documentation can be found under the helm directory.
Thanks cephasara for contributing this major contribution.
Feel free to open an issue, should you come across minor issues with running Docker-OSX or have any questions.
Before you open an issue, however, please check the closed issues and confirm that you're using the latest version of this repository — your issues may have already been resolved! You might also see your answer in our questions and answers section below.
Follow @sickcodes!
For more sophisticated endeavours, we offer the following support services:
- Enterprise support, business support, or casual support.
- Custom images, custom scripts, consulting (per hour available!)
- One-on-one conversations with you or your development team.
In case you're interested, contact @sickcodes on Twitter or click here.
Docker-OSX is licensed under the GPL v3+. Contributions are welcomed and immensely appreciated. You are in-fact permitted to use Docker-OSX as a tool to create proprietary software.
- Run Android in a Docker Container with Dock Droid
- Run Android fully native on the host!
- Run iOS 12 in a Docker container with Docker-eyeOS - https://github.com/sickcodes/Docker-eyeOS
- Run iMessage relayer in Docker with Bluebubbles.app - Getting started wiki
If you are serious about Apple Security, and possibly finding 6-figure bug bounties within the Apple Bug Bounty Program, then you're in the right place! Further notes: Is Hackintosh, OSX-KVM, or Docker-OSX legal?
Product names, logos, brands and other trademarks referred to within this project are the property of their respective trademark holders. These trademark holders are not affiliated with our repository in any capacity. They do not sponsor or endorse this project in any way.
Already set up or just looking to make a container quickly? Check out our quick start or see a bunch more use cases under our container creation examples section.
There are several different Docker-OSX images available which are suitable for different purposes.
sickcodes/docker-osx:latest- I just want to try it out.sickcodes/docker-osx:latest- I want to use Docker-OSX to develop/secure apps in Xcode (sign into Xcode, Transporter)sickcodes/docker-osx:naked- I want to use Docker-OSX for CI/CD-related purposes (sign into Xcode, Transporter)
Create your personal image using :latest or big-sur. Then, pull the image out the image. Afterwards, you will be able to duplicate that image and import it to the :naked container, in order to revert the container to a previous state repeatedly.
-
sickcodes/docker-osx:auto- I'm only interested in using the command line (useful for compiling software or using Homebrew headlessly). -
sickcodes/docker-osx:naked- I need iMessage/iCloud for security research. -
sickcodes/docker-osx:big-sur- I want to run Big Sur. -
sickcodes/docker-osx:monterey- I want to run Monterey. -
sickcodes/docker-osx:high-sierra- I want to run High Sierra. -
sickcodes/docker-osx:mojave- I want to run Mojave.
Before you do anything else, you will need to turn on hardware virtualization in your BIOS. Precisely how will depend on your particular machine (and BIOS), but it should be straightforward.
Then, you'll need QEMU and some other dependencies on your host:
# ARCH
sudo pacman -S qemu libvirt dnsmasq virt-manager bridge-utils flex bison iptables-nft edk2-ovmf
# UBUNTU DEBIAN
sudo apt install qemu qemu-kvm libvirt-clients libvirt-daemon-system bridge-utils virt-manager libguestfs-tools
# CENTOS RHEL FEDORA
sudo yum install libvirt qemu-kvmThen, enable libvirt and load the KVM kernel module:
sudo systemctl enable --now libvirtd
sudo systemctl enable --now virtlogd
echo 1 | sudo tee /sys/module/kvm/parameters/ignore_msrs
sudo modprobe kvmRunning Docker-OSX on Windows is possible using WSL2 (Windows 11 + Windows Subsystem for Linux).
You must have Windows 11 installed with build 22000+ (21H2 or higher).
First, install WSL on your computer by running this command in an administrator powershell. For more info, look here.
This will install Ubuntu by default.
wsl --install
You can confirm WSL2 is enabled using wsl -l -v in PowerShell. To see other distributions that are available, use wsl -l -o.
If you have previously installed WSL1, upgrade to WSL 2. Check this link to upgrade from WSL1 to WSL2.
After WSL installation, go to C:/Users/<Your_Name>/.wslconfig and add nestedVirtualization=true to the end of the file (If the file doesn't exist, create it). For more information about the .wslconfig file check this link. Verify that you have selected "Show Hidden Files" and "Show File Extensions" in File Explorer options.
The result should be like this:
[wsl2]
nestedVirtualization=true
Go into your WSL distro (Run wsl in powershell) and check if KVM is enabled by using the kvm-ok command. The output should look like this:
INFO: /dev/kvm exists
KVM acceleration can be used
Now download and install Docker for Windows if it is not already installed.
After installation, go into Settings and check these 2 boxes:
General -> "Use the WSL2 based engine";
Resources -> WSL Integration -> "Enable integration with my default WSL distro",
Ensure x11-apps is installed. Use the command sudo apt install x11-apps -y to install it if it isn't.
Finally, there are 3 ways to get video output:
- WSLg: This is the simplest and easiest option to use. There may be some issues such as the keyboard not being fully passed through or seeing a second mouse on the desktop - Issue on WSLg - but this option is recommended.
To use WSLg's built-in X-11 server, change these two lines in the docker run command to point Docker-OSX to WSLg.
-e "DISPLAY=${DISPLAY:-:0.0}" \
-v /mnt/wslg/.X11-unix:/tmp/.X11-unix \
Or try:
-e "DISPLAY=${DISPLAY:-:0}" \
-v /mnt/wslg/.X11-unix:/tmp/.X11-unix \
For Ubuntu 20.x on Windows, see sickcodes#458
- VNC: See the VNC section for more information. You could also add -vnc argument to qemu. Connect to your mac VM via a VNC Client. Here is a how to
- Desktop Environment: This will give you a full desktop linux experiencem but it will use a bit more of the computer's resources. Here is an example guide, but there are other guides that help set up a desktop environment. DE Example
Additional boot instructions for when you are creating your container
-
Boot the macOS Base System (Press Enter)
-
Click
Disk Utility -
Erase the BIGGEST disk (around 200gb default), DO NOT MODIFY THE SMALLER DISKS. -- if you can't click
erase, you may need to reduce the disk size by 1kb -
(optional) Create a partition using the unused space to house the OS and your files if you want to limit the capacity. (For Xcode 12 partition at least 60gb.)
-
Click
Reinstall macOS -
The system may require multiple reboots during installation
This is a great place to start if you are having trouble getting going, especially if you're not that familiar with Docker just yet.
Just looking to make a container quickly? Check out our container creation examples section.
More specific/advanced troubleshooting questions and answers may be found in More Questions and Answers. You should also check out the closed issues. Someone else might have gotten a question like yours answered already even if you can't find it in this document!
See initial setup.
docker: unknown server OS: .
See 'docker run --help'.This means your docker daemon is not running.
pgrep dockerd should return nothing
Therefore, you have a few choices.
sudo dockerd for foreground Docker usage. I use this.
Or
sudo systemctl --start dockerd to start dockerd this now.
Or
sudo systemctl --enable --now dockerd for start dockerd on every reboot, and now.
Examples:
-e EXTRA='-smp 6,sockets=3,cores=2'
-e EXTRA='-smp 8,sockets=4,cores=2'
-e EXTRA='-smp 16,sockets=8,cores=2'
Note, unlike memory, CPU usage is shared. so you can allocate all of your CPU's to the container.
< 3D11 div class="markdown-heading" dir="auto">