diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml new file mode 100644 index 0000000..e23f0dc --- /dev/null +++ b/.github/workflows/docker-build.yml @@ -0,0 +1,52 @@ +name: Push Docker Image to Docker Hub + +on: + push: + branches: + - master + +jobs: + push_to_docker_hub: + name: Push Docker Image to Docker Hub + runs-on: ubuntu-latest + steps: + - name: Checkout code + id: checkout_code + uses: actions/checkout@v3 + + - name: Login to Docker Hub + id: login_docker_hub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKER_HUB_USER_NAME }} + password: ${{ secrets.DOCKER_HUB_PASSWORD }} + + - name: Echo Docker Hub Username + run: echo ${{ secrets.DOCKER_HUB_USER_NAME }} + + - name: Echo GitHub SHA + run: echo $GITHUB_SHA + + - name: Build Docker image + id: build_image + run: | + docker build "$GITHUB_WORKSPACE" -t sickcodes/docker-osx:master --label dockerfile-path="Dockerfile" + + - name: Label Master Docker Image as Latest + id: label_image + run: | + docker tag sickcodes/docker-osx:master sickcodes/docker-osx:latest + + - name: Push Docker image master + id: push_master + run: docker push sickcodes/docker-osx:master + + - name: Push Docker image latest + id: push_latest + run: docker push sickcodes/docker-osx:latest + + - name: Logout from Docker Hub + run: docker logout + + - name: End + run: echo "Docker image pushed to Docker Hub successfully" \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index e8d51f6..f3c117a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -159,13 +159,6 @@ RUN yes | sudo pacman -Syu bc qemu-desktop libvirt dnsmasq virt-manager bridge-u WORKDIR /home/arch/OSX-KVM -# shortname default is catalina, which means :latest is catalina -ARG SHORTNAME=catalina - -RUN make \ - && qemu-img convert BaseSystem.dmg -O qcow2 -p -c BaseSystem.img \ - && rm ./BaseSystem.dmg - # fix invalid signature on old libguestfs ARG SIGLEVEL=Never @@ -235,7 +228,7 @@ RUN grep -v InstallMedia ./Launch.sh > ./Launch-nopicker.sh \ USER arch -ENV USER arch +ENV USER=arch # These are hardcoded serials for non-iMessage related research # Overwritten by using GENERATE_UNIQUE=true @@ -360,7 +353,20 @@ VOLUME ["/tmp/.X11-unix"] # the default serial numbers are already contained in ./OpenCore/OpenCore.qcow2 # And the default serial numbers -CMD sudo touch /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ +# DMCA compliant download process +# If BaseSystem.img does not exist, download ${SHORTNAME} + +# shortname default is below +ENV SHORTNAME=sequoia + +ENV BASESYSTEM_IMAGE=BaseSystem.img + +CMD ! [[ -e "${BASESYSTEM_IMAGE:-BaseSystem.img}" ]] \ + && printf '%s\n' "No BaseSystem.img available, downloading ${SHORTNAME}" \ + && make \ + && qemu-img convert BaseSystem.dmg -O qcow2 -p -c ${BASESYSTEM_IMAGE:-BaseSystem.img} \ + && rm ./BaseSystem.dmg \ + ; sudo touch /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ ; sudo chown -R $(id -u):$(id -g) /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ ; [[ "${NOPICKER}" == true ]] && { \ sed -i '/^.*InstallMedia.*/d' Launch.sh \ diff --git a/Dockerfile.auto b/Dockerfile.auto index 432d01b..b150892 100644 --- a/Dockerfile.auto +++ b/Dockerfile.auto @@ -206,7 +206,20 @@ ENV TERMS_OF_USE=i_agree ENV BOILERPLATE="By using this Dockerfile, you hereby agree that you are a security reseacher or developer and agree to use this Dockerfile to make the world a safer place. Examples include: making your apps safer, finding your mobile phone, compiling security products, etc. You understand that Docker-OSX is an Open Source project, which is released to the public under the GNU Pulic License version 3 and above. You acknowledge that the Open Source project is absolutely unaffiliated with any third party, in any form whatsoever. Any trademarks or intelectual property which happen to be mentioned anywhere in or around the project are owned by their respective owners. By using this Dockerfile, you agree to agree to the EULA of each piece of upstream or downstream software. The following code is released for the sole purpose of security research, under the GNU Public License version 3. If you are concerned about the licensing, please note that this project is not AGPL. A copy of the license is available online: https://github.com/sickcodes/Docker-OSX/blob/master/LICENSE. In order to use the following Dockerfile you must read and understand the terms. Once you have read the terms, use the -e TERMS_OF_USE=i_agree or -e TERMS_OF_USE=i_disagree" -CMD echo "${BOILERPLATE}" \ +# DMCA compliant download process +# If BaseSystem.img does not exist, download ${SHORTNAME} + +# shortname default is catalina, which means :latest is catalina +ENV SHORTNAME=sonoma + +ENV BASESYSTEM_IMAGE=BaseSystem.img + +CMD ! [[ -e "${BASESYSTEM_IMAGE:-BaseSystem.img}" ]] \ + && printf '%s\n' "No BaseSystem.img available, downloading ${SHORTNAME}" \ + && make \ + && qemu-img convert BaseSystem.dmg -O qcow2 -p -c ${BASESYSTEM_IMAGE:-BaseSystem.img} \ + && rm ./BaseSystem.dmg \ + ; echo "${BOILERPLATE}" \ ; [[ "${TERMS_OF_USE}" = i_agree ]] || exit 1 \ ; echo "Disk is being copied between layers... Please wait a minute..." \ ; sudo touch /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ diff --git a/Dockerfile.monterey b/Dockerfile.monterey deleted file mode 100644 index 6d7718d..0000000 --- a/Dockerfile.monterey +++ /dev/null @@ -1,255 +0,0 @@ -#!/usr/bin/docker -# ____ __ ____ ______ __ -# / __ \____ _____/ /_____ _____/ __ \/ ___/ |/ / -# / / / / __ \/ ___/ //_/ _ \/ ___/ / / /\__ \| / -# / /_/ / /_/ / /__/ ,< / __/ / / /_/ /___/ / | -# /_____/\____/\___/_/|_|\___/_/ \____//____/_/|_| [MONTEREY] -# -# Title: Docker-OSX (Mac on Docker) -# Author: Sick.Codes https://twitter.com/sickcodes -# Version: 6.0 -# License: GPLv3+ -# Repository: https://github.com/sickcodes/Docker-OSX -# Website: https://sick.codes -# -# Notes: Uses a self-hosted BaseSystem.img from a USB installer. -# If you want to DIY, use https://github.com/corpnewt/gibMacOS -# Set seed as developer, and install the Install Assistant on Big Sur -# Burn to a USB, and pull out BaseSystem.img -# Or download from https://images.sick.codes/BaseSystem_Monterey.dmg -# - -FROM sickcodes/docker-osx - -LABEL maintainer='https://twitter.com/sickcodes ' - -SHELL ["/bin/bash", "-c"] - -# change disk size here or add during build, e.g. --build-arg VERSION=10.14.5 --build-arg SIZE=50G -ARG SIZE=200G -ARG BASE_SYSTEM='https://images.sick.codes/BaseSystem_Monterey.dmg' - -WORKDIR /home/arch/OSX-KVM - -RUN wget -O BaseSystem.dmg "${BASE_SYSTEM}" \ - && qemu-img convert BaseSystem.dmg -O qcow2 -p -c BaseSystem.img \ - && rm -f BaseSystem.dmg - -RUN qemu-img create -f qcow2 /home/arch/OSX-KVM/mac_hdd_ng.img "${SIZE}" - -WORKDIR /home/arch/OSX-KVM - -#### libguestfs versioning - -# 5.13+ problem resolved by building the qcow2 against 5.12 using libguestfs-1.44.1-6 - -ENV SUPERMIN_KERNEL=/boot/vmlinuz-linux -ENV SUPERMIN_MODULES=/lib/modules/5.12.14-arch1-1 -ENV SUPERMIN_KERNEL_VERSION=5.12.14-arch1-1 -ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12.14.arch1-1-x86_64.pkg.tar.zst -ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst -ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst - -ARG LINUX=true - -# required to use libguestfs inside a docker container, to create bootdisks for docker-osx on-the-fly -RUN if [[ "${LINUX}" == true ]]; then \ - sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm \ - ; sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \ - ; sudo pacman -U "${KERNEL_HEADERS_PACKAGE_URL}" --noconfirm \ - ; sudo pacman -S mkinitcpio --noconfirm \ - ; sudo libguestfs-test-tool \ - ; sudo rm -rf /var/tmp/.guestfs-* \ - ; fi - -#### - - -# optional --build-arg to change branches for testing -ARG BRANCH=master -ARG REPO='https://github.com/sickcodes/Docker-OSX.git' -# RUN git clone --recurse-submodules --depth 1 --branch "${BRANCH}" "${REPO}" -RUN rm -rf ./Docker-OSX \ - && git clone --recurse-submodules --depth 1 --branch "${BRANCH}" "${REPO}" - -RUN touch Launch.sh \ - && chmod +x ./Launch.sh \ - && tee -a Launch.sh <<< '#!/bin/bash' \ - && tee -a Launch.sh <<< 'set -eux' \ - && tee -a Launch.sh <<< 'sudo chown $(id -u):$(id -g) /dev/kvm 2>/dev/null || true' \ - && tee -a Launch.sh <<< 'sudo chown -R $(id -u):$(id -g) /dev/snd 2>/dev/null || true' \ - && tee -a Launch.sh <<< '[[ "${RAM}" = max ]] && export RAM="$(("$(head -n1 /proc/meminfo | tr -dc "[:digit:]") / 1000000"))"' \ - && tee -a Launch.sh <<< '[[ "${RAM}" = half ]] && export RAM="$(("$(head -n1 /proc/meminfo | tr -dc "[:digit:]") / 2000000"))"' \ - && tee -a Launch.sh <<< 'sudo chown -R $(id -u):$(id -g) /dev/snd 2>/dev/null || true' \ - && tee -a Launch.sh <<< 'exec qemu-system-x86_64 -m ${RAM:-2}000 \' \ - && tee -a Launch.sh <<< '-cpu ${CPU:-Penryn},${CPUID_FLAGS:-vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on,+ssse3,+sse4.2,+popcnt,+avx,+aes,+xsave,+xsaveopt,check,}${BOOT_ARGS} \' \ - && tee -a Launch.sh <<< '-machine q35,${KVM-"accel=kvm:tcg"} \' \ - && tee -a Launch.sh <<< '-smp ${CPU_STRING:-${SMP:-4},cores=${CORES:-4}} \' \ - && tee -a Launch.sh <<< '-usb -device usb-kbd -device usb-tablet \' \ - && tee -a Launch.sh <<< '-device isa-applesmc,osk=ourhardworkbythesewordsguardedpleasedontsteal\(c\)AppleComputerInc \' \ - && tee -a Launch.sh <<< '-drive if=pflash,format=raw,readonly=on,file=/home/arch/OSX-KVM/OVMF_CODE.fd \' \ - && tee -a Launch.sh <<< '-drive if=pflash,format=raw,file=/home/arch/OSX-KVM/OVMF_VARS-1024x768.fd \' \ - && tee -a Launch.sh <<< '-smbios type=2 \' \ - && tee -a Launch.sh <<< '-audiodev ${AUDIO_DRIVER:-alsa},id=hda -device ich9-intel-hda -device hda-duplex,audiodev=hda \' \ - && tee -a Launch.sh <<< '-device ich9-ahci,id=sata \' \ - && tee -a Launch.sh <<< '-drive id=OpenCoreBoot,if=none,snapshot=on,format=qcow2,file=${BOOTDISK:-/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2} \' \ - && tee -a Launch.sh <<< '-device ide-hd,bus=sata.2,drive=OpenCoreBoot \' \ - && tee -a Launch.sh <<< '-device ide-hd,bus=sata.3,drive=InstallMedia \' \ - && tee -a Launch.sh <<< '-drive id=InstallMedia,if=none,file=/home/arch/OSX-KVM/BaseSystem.img,format=qcow2 \' \ - && tee -a Launch.sh <<< '-drive id=MacHDD,if=none,file=${IMAGE_PATH:-/home/arch/OSX-KVM/mac_hdd_ng.img},format=${IMAGE_FORMAT:-qcow2} \' \ - && tee -a Launch.sh <<< '-device ide-hd,bus=sata.4,drive=MacHDD \' \ - && tee -a Launch.sh <<< '-netdev user,id=net0,hostfwd=tcp::${INTERNAL_SSH_PORT:-10022}-:22,hostfwd=tcp::${SCREEN_SHARE_PORT:-5900}-:5900,${ADDITIONAL_PORTS} \' \ - && tee -a Launch.sh <<< '-device ${NETWORKING:-vmxnet3},netdev=net0,id=net0,mac=${MAC_ADDRESS:-52:54:00:09:49:17} \' \ - && tee -a Launch.sh <<< '-monitor stdio \' \ - && tee -a Launch.sh <<< '-boot menu=on \' \ - && tee -a Launch.sh <<< '-vga vmware \' \ - && tee -a Launch.sh <<< '${EXTRA:-}' - -# docker exec containerid mv ./Launch-nopicker.sh ./Launch.sh -# This is now a legacy command. -# You can use -e BOOTDISK=/bootdisk with -v ./bootdisk.img:/bootdisk -RUN grep -v InstallMedia ./Launch.sh > ./Launch-nopicker.sh \ - && chmod +x ./Launch-nopicker.sh \ - && sed -i -e s/OpenCore\.qcow2/OpenCore\-nopicker\.qcow2/ ./Launch-nopicker.sh - -USER arch - -ENV USER arch - - -#### libguestfs versioning - -# 5.13+ problem resolved by building the qcow2 against 5.12 using libguestfs-1.44.1-6 - -ENV SUPERMIN_KERNEL=/boot/vmlinuz-linux -ENV SUPERMIN_MODULES=/lib/modules/5.12.14-arch1-1 -ENV SUPERMIN_KERNEL_VERSION=5.12.14-arch1-1 -ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12.14.arch1-1-x86_64.pkg.tar.zst -ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst -ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst - -RUN sudo pacman -Syy \ - && sudo pacman -Rns linux --noconfirm \ - ; sudo pacman -S mkinitcpio --noconfirm \ - && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm \ - && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \ - && rm -rf /var/tmp/.guestfs-* \ - ; libguestfs-test-tool || exit 1 - -#### - -# symlink the old directory, for redundancy -RUN ln -s /home/arch/OSX-KVM/OpenCore /home/arch/OSX-KVM/OpenCore-Catalina || true - -#### - -#### SPECIAL RUNTIME ARGUMENTS BELOW - -# env -e ADDITIONAL_PORTS with a comma -# for example, -e ADDITIONAL_PORTS=hostfwd=tcp::23-:23, -ENV ADDITIONAL_PORTS= - -# add additional QEMU boot arguments -ENV BOOT_ARGS= - -ENV BOOTDISK= - -# edit the CPU that is being emulated -ENV CPU=Penryn -ENV CPUID_FLAGS='vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on,+ssse3,+sse4.2,+popcnt,+avx,+aes,+xsave,+xsaveopt,check,' - -ENV DISPLAY=:0.0 - -# Deprecated -ENV ENV=/env - -# Boolean for generating a bootdisk with new random serials. -ENV GENERATE_UNIQUE=false - -# Boolean for generating a bootdisk with specific serials. -ENV GENERATE_SPECIFIC=false - -ENV IMAGE_PATH=/home/arch/OSX-KVM/mac_hdd_ng.img -ENV IMAGE_FORMAT=qcow2 - -ENV KVM='accel=kvm:tcg' - -ENV MASTER_PLIST_URL="https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist" - -# ENV NETWORKING=e1000-82545em -ENV NETWORKING=vmxnet3 - -# boolean for skipping the disk selection menu at in the boot process -ENV NOPICKER=false - -# dynamic RAM options for runtime -ENV RAM=3 -# ENV RAM=max -# ENV RAM=half - -# The x and y coordinates for resolution. -# Must be used with either -e GENERATE_UNIQUE=true or -e GENERATE_SPECIFIC=true. -ENV WIDTH=1920 -ENV HEIGHT=1080 - -# libguestfs verbose -ENV LIBGUESTFS_DEBUG=1 -ENV LIBGUESTFS_TRACE=1 - -VOLUME ["/tmp/.X11-unix"] - -# check if /image is a disk image or a directory. This allows you to optionally use -v disk.img:/image -# NOPICKER is used to skip the disk selection screen -# GENERATE_UNIQUE is used to generate serial numbers on boot. -# /env is a file that you can generate and save using -v source.sh:/env -# the env file is a file that you can carry to the next container which will supply the serials numbers. -# GENERATE_SPECIFIC is used to either accept the env serial numbers OR you can supply using: - # -e DEVICE_MODEL="iMacPro1,1" \ - # -e SERIAL="C02TW0WAHX87" \ - # -e BOARD_SERIAL="C027251024NJG36UE" \ - # -e UUID="5CCB366D-9118-4C61-A00A-E5BAF3BED451" \ - # -e MAC_ADDRESS="A8:5C:2C:9A:46:2F" \ - -# the output will be /bootdisk. -# /bootdisk is a useful persistent place to store the 15Mb serial number bootdisk. - -# if you don't set any of the above: -# the default serial numbers are already contained in ./OpenCore/OpenCore.qcow2 -# And the default serial numbers - -CMD sudo touch /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ - ; sudo chown -R $(id -u):$(id -g) /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ - ; [[ "${NOPICKER}" == true ]] && { \ - sed -i '/^.*InstallMedia.*/d' Launch.sh \ - && export BOOTDISK="${BOOTDISK:=/home/arch/OSX-KVM/OpenCore/OpenCore-nopicker.qcow2}" \ - ; } \ - || export BOOTDISK="${BOOTDISK:=/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2}" \ - ; [[ "${GENERATE_UNIQUE}" == true ]] && { \ - ./Docker-OSX/osx-serial-generator/generate-unique-machine-values.sh \ - --master-plist-url="${MASTER_PLIST_URL}" \ - --count 1 \ - --tsv ./serial.tsv \ - --bootdisks \ - --width "${WIDTH:-1920}" \ - --height "${HEIGHT:-1080}" \ - --output-bootdisk "${BOOTDISK:=/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2}" \ - --output-env "${ENV:=/env}" \ - || exit 1 ; } \ - ; [[ "${GENERATE_SPECIFIC}" == true ]] && { \ - source "${ENV:=/env}" 2>/dev/null \ - ; ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \ - --master-plist-url="${MASTER_PLIST_URL}" \ - --model "${DEVICE_MODEL}" \ - --serial "${SERIAL}" \ - --board-serial "${BOARD_SERIAL}" \ - --uuid "${UUID}" \ - --mac-address "${MAC_ADDRESS}" \ - --width "${WIDTH:-1920}" \ - --height "${HEIGHT:-1080}" \ - --output-bootdisk "${BOOTDISK:=/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2}" \ - || exit 1 ; } \ - ; ./enable-ssh.sh && /bin/bash -c ./Launch.sh - -# virt-manager mode: eta son -# CMD virsh define <(envsubst < Docker-OSX.xml) && virt-manager || virt-manager -# CMD virsh define <(envsubst < macOS-libvirt-Catalina.xml) && virt-manager || virt-manager diff --git a/Dockerfile.naked b/Dockerfile.naked index 712d059..41f4fef 100644 --- a/Dockerfile.naked +++ b/Dockerfile.naked @@ -166,7 +166,20 @@ ENV HEIGHT=1080 ENV LIBGUESTFS_DEBUG=1 ENV LIBGUESTFS_TRACE=1 -CMD sudo touch /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ +# DMCA compliant download process +# If BaseSystem.img does not exist, download ${SHORTNAME} + +# shortname default is catalina, which means :latest is catalina +ENV SHORTNAME=sonoma + +ENV BASESYSTEM_IMAGE=BaseSystem.img + +CMD ! [[ -e "${BASESYSTEM_IMAGE:-BaseSystem.img}" ]] \ + && printf '%s\n' "No BaseSystem.img available, downloading ${SHORTNAME}" \ + && make \ + && qemu-img convert BaseSystem.dmg -O qcow2 -p -c ${BASESYSTEM_IMAGE:-BaseSystem.img} \ + && rm ./BaseSystem.dmg \ + ; sudo touch /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ ; sudo chown -R $(id -u):$(id -g) /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ ; { [[ "${DISPLAY}" = ':99' ]] || [[ "${HEADLESS}" == true ]] ; } && { \ nohup Xvfb :99 -screen 0 1920x1080x16 \ diff --git a/Dockerfile.naked-auto b/Dockerfile.naked-auto index 44f2866..6e8bddd 100644 --- a/Dockerfile.naked-auto +++ b/Dockerfile.naked-auto @@ -183,7 +183,20 @@ ENV TERMS_OF_USE=i_agree ENV BOILERPLATE="By using this Dockerfile, you hereby agree that you are a security reseacher or developer and agree to use this Dockerfile to make the world a safer place. Examples include: making your apps safer, finding your mobile phone, compiling security products, etc. You understand that Docker-OSX is an Open Source project, which is released to the public under the GNU Pulic License version 3 and above. You acknowledge that the Open Source project is absolutely unaffiliated with any third party, in any form whatsoever. Any trademarks or intelectual property which happen to be mentioned anywhere in or around the project are owned by their respective owners. By using this Dockerfile, you agree to agree to the EULA of each piece of upstream or downstream software. The following code is released for the sole purpose of security research, under the GNU Public License version 3. If you are concerned about the licensing, please note that this project is not AGPL. A copy of the license is available online: https://github.com/sickcodes/Docker-OSX/blob/master/LICENSE. In order to use the following Dockerfile you must read and understand the terms. Once you have read the terms, use the -e TERMS_OF_USE=i_agree or -e TERMS_OF_USE=i_disagree" -CMD echo "${BOILERPLATE}" \ +# DMCA compliant download process +# If BaseSystem.img does not exist, download ${SHORTNAME} + +# shortname default is catalina, which means :latest is catalina +ENV SHORTNAME=sonoma + +ENV BASESYSTEM_IMAGE=BaseSystem.img + +CMD ! [[ -e "${BASESYSTEM_IMAGE:-BaseSystem.img}" ]] \ + && printf '%s\n' "No BaseSystem.img available, downloading ${SHORTNAME}" \ + && make \ + && qemu-img convert BaseSystem.dmg -O qcow2 -p -c ${BASESYSTEM_IMAGE:-BaseSystem.img} \ + && rm ./BaseSystem.dmg \ + ; echo "${BOILERPLATE}" \ ; [[ "${TERMS_OF_USE}" = i_agree ]] || exit 1 \ ; echo "Disk is being copied between layers... Please wait a minute..." \ ; sudo touch /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \ diff --git a/README.md b/README.md index cec86f0..1b5f1d2 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,4 @@ + # Skyscope macOS on PC USB Creator Tool **Version:** 0.4.0 (Alpha) @@ -106,3 +107,1959 @@ Contributions are welcome! Please fork the repository and submit a pull request. ## License (To be decided - likely MIT or GPLv3) +======= +# Docker-OSX · [Follow @sickcodes on Twitter](https://twitter.com/sickcodes) + +![Running Mac OS X in a Docker container](/running-mac-inside-docker-qemu.png?raw=true "OSX KVM DOCKER") + +Run Mac OS X in Docker with near-native performance! X11 Forwarding! iMessage security research! iPhone USB working! macOS in a Docker container! + +Conduct Security Research on macOS using both Linux & Windows! + +# Docker-OSX now has a Discord server & Telegram! + +The Discord is active on #docker-osx and anyone is welcome to come and ask questions, ideas, etc. + +

+ +

+ + +### Click to join the Discord server [https://discord.gg/sickchat](https://discord.gg/sickchat) + +### Click to join the Telegram server [https://t.me/sickcodeschat](https://t.me/sickcodeschat) + +Or reach out via Linkedin if it's private: [https://www.linkedin.com/in/sickcodes](https://www.linkedin.com/in/sickcodes) + +Or via [https://sick.codes/contact/](https://sick.codes/contact/) + +## Author + +This project is maintained by [Sick.Codes](https://sick.codes/). [(Twitter)](https://twitter.com/sickcodes) + +Additional credits can be found here: https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md + +Additionally, comprehensive list of all contributors can be found here: https://github.com/sickcodes/Docker-OSX/graphs/contributors + +Big thanks to [@kholia](https://twitter.com/kholia) for maintaining the upstream project, which Docker-OSX is built on top of: [OSX-KVM](https://github.com/kholia/OSX-KVM). + +Also special thanks to [@thenickdude](https://github.com/thenickdude) who maintains the valuable fork [KVM-OpenCore](https://github.com/thenickdude/KVM-Opencore), which was started by [@Leoyzen](https://github.com/Leoyzen/)! + +Extra special thanks to the OpenCore team over at: https://github.com/acidanthera/OpenCorePkg. Their well-maintained bootloader provides much of the great functionality that Docker-OSX users enjoy :) + +If you like this project, consider contributing here or upstream! + +## Quick Start Docker-OSX + +Video setup tutorial is also available here: https://www.youtube.com/watch?v=wLezYl77Ll8 + +**Windows users:** [click here to see the notes below](#id-like-to-run-docker-osx-on-windows)! + +

+ +

+ +First time here? try [initial setup](#initial-setup), otherwise try the instructions below to use either Catalina or Big Sur. + +## Any questions, ideas, or just want to hang out? +# [https://discord.gg/sickchat](https://discord.gg/sickchat) + +Release names and their version: + +### Catalina (10.15) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +```bash +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e SHORTNAME=catalina \ + sickcodes/docker-osx:latest + +# docker build -t docker-osx . +``` +### Big Sur (11) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +```bash +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e SHORTNAME=big-sur \ + sickcodes/docker-osx:latest + +# docker build -t docker-osx . +``` + +### Monterey (12) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +```bash + +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e GENERATE_UNIQUE=true \ + -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \ + -e SHORTNAME=monterey \ + sickcodes/docker-osx:latest + +# docker build -t docker-osx . +``` + +### Ventura (13) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +```bash + +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e GENERATE_UNIQUE=true \ + -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist' \ + -e SHORTNAME=ventura \ + sickcodes/docker-osx:latest + +# docker build -t docker-osx . +``` + +### Sonoma (14) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +```bash + +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e GENERATE_UNIQUE=true \ + -e CPU='Haswell-noTSX' \ + -e CPUID_FLAGS='kvm=on,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on' \ + -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom-sonoma.plist' \ + -e SHORTNAME=sonoma \ + sickcodes/docker-osx:latest + +# docker build -t docker-osx . +``` + +### Sequoia (15) [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +```bash + +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e GENERATE_UNIQUE=true \ + -e CPU='Haswell-noTSX' \ + -e CPUID_FLAGS='kvm=on,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on' \ + -e MASTER_PLIST_URL='https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom-sonoma.plist' \ + -e SHORTNAME=sequoia \ + sickcodes/docker-osx:latest + +# docker build -t docker-osx . +``` + + + +### Older Systems + +### High Sierra [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +```bash + +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e SHORTNAME=high-sierra \ + sickcodes/docker-osx:latest + +# docker build -t docker-osx . +``` + +### Mojave [![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +```bash + +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e SHORTNAME=mojave \ + sickcodes/docker-osx:latest + +# docker build -t docker-osx . +``` + + + +#### Download the image manually and use it in Docker + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked](https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + + +This is a particularly good way for downloading the container, in case Docker's CDN (or your connection) happens to be slow. + +```bash +wget https://images2.sick.codes/mac_hdd_ng_auto.img + +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -v "${PWD}/mac_hdd_ng_auto.img:/image" \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e GENERATE_UNIQUE=true \ + -e MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/custom/config-nopicker-custom.plist \ + -e SHORTNAME=catalina \ + sickcodes/docker-osx:naked +``` + + + + +# Share directories, sharing files, shared folder, mount folder +The easiest and most secure way is `sshfs` +```bash +# on Linux/Windows +mkdir ~/mnt/osx +sshfs user@localhost:/ -p 50922 ~/mnt/osx +# wait a few seconds, and ~/mnt/osx will have full rootfs mounted over ssh, and in userspace +# automated: sshpass -p sshfs user@localhost:/ -p 50922 ~/mnt/osx +``` + + +# (VFIO) iPhone USB passthrough (VFIO) + +If you have a laptop see the next usbfluxd section. + +If you have a desktop PC, you can use [@Silfalion](https://github.com/Silfalion)'s instructions: [https://github.com/Silfalion/Iphone_docker_osx_passthrough](https://github.com/Silfalion/Iphone_docker_osx_passthrough) + +# (USBFLUXD) iPhone USB -> Network style passthrough OSX-KVM Docker-OSX + +Video setup tutorial for usbfluxd is also available here: https://www.youtube.com/watch?v=kTk5fGjK_PM + +

+ iPhone USB passthrough on macOS virtual machine Linux & Windows +

+ + +This method WORKS on laptop, PC, anything! + +Thank you [@nikias](https://github.com/nikias) for [usbfluxd](https://github.com/corellium/usbfluxd) via [https://github.com/corellium](https://github.com/corellium)! + +**This is done inside Linux.** + +Open 3 terminals on Linux + +Connecting your device over USB on Linux allows you to expose `usbmuxd` on port `5000` using [https://github.com/corellium/usbfluxd](https://github.com/corellium/usbfluxd) to another system on the same network. + +Ensure `usbmuxd`, `socat` and `usbfluxd` are installed. + +`sudo pacman -S libusbmuxd usbmuxd avahi socat` + +Available on the AUR: [https://aur.archlinux.org/packages/usbfluxd/](https://aur.archlinux.org/packages/usbfluxd/) + +`yay usbfluxd` + +Plug in your iPhone or iPad. + +Terminal 1 +```bash +sudo systemctl start usbmuxd +sudo avahi-daemon +``` + +Terminal 2: +```bash +# on host +sudo systemctl restart usbmuxd +sudo socat tcp-listen:5000,fork unix-connect:/var/run/usbmuxd +``` + +Terminal 3: +```bash +sudo usbfluxd -f -n +``` + +### Connect to a host running usbfluxd + +**This is done inside macOS.** + +Install homebrew. + +`172.17.0.1` is usually the Docker bridge IP, which is your PC, but you can use any IP from `ip addr`... + +macOS Terminal: +```zsh +# on the guest +brew install make automake autoconf libtool pkg-config gcc libimobiledevice usbmuxd + +git clone https://github.com/corellium/usbfluxd.git +cd usbfluxd + +./autogen.sh +make +sudo make install +``` + +Accept the USB over TCP connection, and appear as local: + +(you may need to change `172.17.0.1` to the IP address of the host. e.g. check `ip addr`) + +```bash +# on the guest +sudo launchctl start usbmuxd +export PATH=/usr/local/sbin:${PATH} +sudo usbfluxd -f -r 172.17.0.1:5000 +``` + +Close apps such as Xcode and reopen them and your device should appear! + +*If you need to start again on Linux, wipe the current usbfluxd, usbmuxd, and socat:* +```bash +sudo killall usbfluxd +sudo systemctl restart usbmuxd +sudo killall socat +``` + +## Make container FASTER using [https://github.com/sickcodes/osx-optimizer](https://github.com/sickcodes/osx-optimizer) + +SEE commands in [https://github.com/sickcodes/osx-optimizer](https://github.com/sickcodes/osx-optimizer)! + +- Skip the GUI login screen (at your own risk!) +- Disable spotlight indexing on macOS to heavily speed up Virtual Instances. +- Disable heavy login screen wallpaper +- Disable updates (at your own risk!) + +## Increase disk space by moving /var/lib/docker to external drive, block storage, NFS, or any other location conceivable. + +Move /var/lib/docker, following the tutorial below + +- Cheap large physical disk storage instead using your server's disk, or SSD. +- Block Storage, NFS, etc. + +Tutorial here: https://sick.codes/how-to-run-docker-from-block-storage/ + +Only follow the above tutorial if you are happy with wiping all your current Docker images/layers. + +Safe mode: Disable docker temporarily so you can move the Docker folder temporarily. + +- Do NOT do this until you have moved your image out already [https://github.com/dulatello08/Docker-OSX/#quick-start-your-own-image-naked-container-image](https://github.com/dulatello08/Docker-OSX/#quick-start-your-own-image-naked-container-image) + +```bash +killall dockerd +systemctl disable --now docker +systemctl disable --now docker.socket +systemctl stop docker +systemctl stop docker.socket +``` +Now, that Docker daemon is off, move /var/lib/docker somewhere + +Then, symbolicly link /var/lib/docker somewhere: + +```bash +mv /var/lib/docker /run/media/user/some_drive/docker +ln -s /run/media/user/some_drive/docker /var/lib/docker + +# now check if /var/lib/docker is working still +ls /var/lib/docker +``` +If you see folders, then it worked. You can restart Docker, or just reboot if you want to be sure. + +## Important notices: + +**2021-11-14** - Added High Sierra, Mojave + +Pick one of these while **building**, irrelevant when using docker pull: +``` +--build-arg SHORTNAME=high-sierra +--build-arg SHORTNAME=mojave +--build-arg SHORTNAME=catalina +--build-arg SHORTNAME=big-sur +--build-arg SHORTNAME=monterey +--build-arg SHORTNAME=ventura +--build-arg SHORTNAME=sonoma +``` + + +## Technical details + +There are currently multiple images, each with different use cases (explained [below](#container-images)): + +- High Sierra (10.13) +- Mojave (10.14) +- Catalina (10.15) +- Big Sur (11) +- Monterey (12) +- Ventura (13) +- Sonoma (14) +- Auto (pre-made Catalina) +- Naked (use your own .img) +- Naked-Auto (user your own .img and SSH in) + +High Sierra: + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/high-sierra?label=sickcodes%2Fdocker-osx%3Ahigh-sierra](https://img.shields.io/docker/image-size/sickcodes/docker-osx/high-sierra?label=sickcodes%2Fdocker-osx%3Ahigh-sierra)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Mojave: + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/mojave?label=sickcodes%2Fdocker-osx%3Amojave](https://img.shields.io/docker/image-size/sickcodes/docker-osx/mojave?label=sickcodes%2Fdocker-osx%3Amojave)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Catalina: + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest](https://img.shields.io/docker/image-size/sickcodes/docker-osx/latest?label=sickcodes%2Fdocker-osx%3Alatest)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Big-Sur: + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/big-sur?label=sickcodes%2Fdocker-osx%3Abig-sur](https://img.shields.io/docker/image-size/sickcodes/docker-osx/big-sur?label=sickcodes%2Fdocker-osx%3Abig-sur)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Monterey make your own image: + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/monterey?label=sickcodes%2Fdocker-osx%3Amonterey](https://img.shields.io/docker/image-size/sickcodes/docker-osx/monterey?label=sickcodes%2Fdocker-osx%3Amonterey)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Ventura make your own image: + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/ventura?label=sickcodes%2Fdocker-osx%3Aventura](https://img.shields.io/docker/image-size/sickcodes/docker-osx/ventura?label=sickcodes%2Fdocker-osx%3Aventura)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Sonoma make your own image: + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/sonoma?label=sickcodes%2Fdocker-osx%3Asonoma](https://img.shields.io/docker/image-size/sickcodes/docker-osx/sonoma?label=sickcodes%2Fdocker-osx%3Asonoma)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Pre-made **Catalina** system by [Sick.Codes](https://sick.codes): username: `user`, password: `alpine` + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/auto?label=sickcodes%2Fdocker-osx%3Aauto](https://img.shields.io/docker/image-size/sickcodes/docker-osx/auto?label=sickcodes%2Fdocker-osx%3Aauto)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Naked: Bring-your-own-image setup (use any of the above first): + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked](https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked?label=sickcodes%2Fdocker-osx%3Anaked)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +Naked Auto: same as above but with `-e USERNAME` & `-e PASSWORD` and `-e OSX_COMMANDS="put your commands here"` + +[![https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked-auto?label=sickcodes%2Fdocker-osx%3Anaked-auto](https://img.shields.io/docker/image-size/sickcodes/docker-osx/naked-auto?label=sickcodes%2Fdocker-osx%3Anaked-auto)](https://hub.docker.com/r/sickcodes/docker-osx/tags?page=1&ordering=last_updated) + +## Capabilities +- use iPhone OSX KVM on Linux using [usbfluxd](https://github.com/corellium/usbfluxd)! +- macOS Monterey VM on Linux! +- Folder sharing- +- USB passthrough (hotplug too) +- SSH enabled (`localhost:50922`) +- VNC enabled (`localhost:8888`) if using ./vnc version +- iMessage security research via [serial number generator!](https://github.com/sickcodes/osx-serial-generator) +- X11 forwarding is enabled +- runs on top of QEMU + KVM +- supports Big Sur, custom images, Xvfb headless mode +- you can clone your container with `docker commit` + +### Requirements + +- 20GB+++ disk space for bare minimum installation (50GB if using Xcode) +- virtualization should be enabled in your BIOS settings +- a x86_64 kvm-capable host +- at least 50 GBs for `:auto` (half for the base image, half for your runtime image + +### TODO + +- documentation for security researchers +- gpu acceleration +- support for virt-manager + +## Docker + +Images built on top of the contents of this repository are also available on **Docker Hub** for convenience: https://hub.docker.com/r/sickcodes/docker-osx + +A comprehensive list of the available Docker images and their intended purpose can be found in the [Instructions](#instructions). + +## Kubernetes + +Docker-OSX supports Kubernetes. + +Kubernetes Helm Chart & Documentation can be found under the [helm directory](helm/README.md). + +Thanks [cephasara](https://github.com/cephasara) for contributing this major contribution. + +[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/docker-osx)](https://artifacthub.io/packages/search?repo=docker-osx) + +## Support + +### Small questions & issues + +Feel free to open an [issue](https://github.com/sickcodes/Docker-OSX/issues/new/choose), should you come across minor issues with running Docker-OSX or have any questions. + +#### Resolved issues + +Before you open an issue, however, please check the [closed issues](https://github.com/sickcodes/Docker-OSX/issues?q=is%3Aissue+is%3Aclosed) and confirm that you're using the latest version of this repository — your issues may have already been resolved! You might also see your answer in our questions and answers section [below](#more-questions-and-answers). + +### Feature requests and updates + +Follow [@sickcodes](https://twitter.com/sickcodes)! + +### Professional support + +For more sophisticated endeavours, we offer the following support services: + +- Enterprise support, business support, or casual support. +- Custom images, custom scripts, consulting (per hour available!) +- One-on-one conversations with you or your development team. + +In case you're interested, contact [@sickcodes on Twitter](https://twitter.com/sickcodes) or click [here](https://sick.codes/contact). + +## License/Contributing + +Docker-OSX is licensed under the [GPL v3+](LICENSE). Contributions are welcomed and immensely appreciated. You are in fact permitted to use Docker-OSX as a tool to create proprietary software. + +### Other cool Docker/QEMU based projects +- [Run Android in a Docker Container with Dock Droid](https://github.com/sickcodes/dock-droid) +- [Run Android fully native on the host!](https://github.com/sickcodes/droid-native) +- [Run iOS 12 in a Docker container with Docker-eyeOS](https://github.com/sickcodes/Docker-eyeOS) - [https://github.com/sickcodes/Docker-eyeOS](https://github.com/sickcodes/Docker-eyeOS) +- [Run iMessage relayer in Docker with Bluebubbles.app](https://bluebubbles.app/) - [Getting started wiki](https://github.com/BlueBubblesApp/BlueBubbles-Server/wiki/Running-via-Docker) + +## Disclaimer + +If you are serious about Apple Security, and possibly finding 6-figure bug bounties within the Apple Bug Bounty Program, then you're in the right place! Further notes: [Is Hackintosh, OSX-KVM, or Docker-OSX legal?](https://sick.codes/is-hackintosh-osx-kvm-or-docker-osx-legal/) + +Product names, logos, brands and other trademarks referred to within this project are the property of their respective trademark holders. These trademark holders are not affiliated with our repository in any capacity. They do not sponsor or endorse this project in any way. + +# Instructions + +## Container images + +### Already set up or just looking to make a container quickly? Check out our [quick start](#quick-start-docker-osx) or see a bunch more use cases under our [container creation examples](#container-creation-examples) section. + +There are several different Docker-OSX images available that are suitable for different purposes. + +- `sickcodes/docker-osx:latest` - [I just want to try it out.](#quick-start-docker-osx) +- `sickcodes/docker-osx:latest` - [I want to use Docker-OSX to develop/secure apps in Xcode (sign into Xcode, Transporter)](#quick-start-your-own-image-naked-container-image) +- `sickcodes/docker-osx:naked` - [I want to use Docker-OSX for CI/CD-related purposes (sign into Xcode, Transporter)](#building-a-headless-container-from-a-custom-image) + +Create your personal image using `:latest` or `big-sur`. Then, pull the image out the image. Afterwards, you will be able to duplicate that image and import it to the `:naked` container, in order to revert the container to a previous state repeatedly. + +- `sickcodes/docker-osx:auto` - [I'm only interested in using the command line (useful for compiling software or using Homebrew headlessly).](#prebuilt-image-with-arbitrary-command-line-arguments) +- `sickcodes/docker-osx:naked` - [I need iMessage/iCloud for security research.](#generating-serial-numbers) +- `sickcodes/docker-osx:big-sur` - [I want to run Big Sur.](#quick-start-docker-osx) +- `sickcodes/docker-osx:monterey` - [I want to run Monterey.](#quick-start-docker-osx) +- `sickcodes/docker-osx:ventura` - [I want to run Ventura.](#quick-start-docker-osx) +- `sickcodes/docker-osx:sonoma` - [I want to run Sonoma.](#quick-start-docker-osx) + +- `sickcodes/docker-osx:high-sierra` - I want to run High Sierra. +- `sickcodes/docker-osx:mojave` - I want to run Mojave. + +## Initial setup +Before you do anything else, you will need to turn on hardware virtualization in your BIOS. Precisely how will depend on your particular machine (and BIOS), but it should be straightforward. + +Then, you'll need QEMU and some other dependencies on your host: + +```bash +# ARCH +sudo pacman -S qemu libvirt dnsmasq virt-manager bridge-utils flex bison iptables-nft edk2-ovmf + +# UBUNTU DEBIAN +sudo apt install qemu qemu-kvm libvirt-clients libvirt-daemon-system bridge-utils virt-manager libguestfs-tools + +# CENTOS RHEL FEDORA +sudo yum install libvirt qemu-kvm +``` + +Then, enable libvirt and load the KVM kernel module: + +```bash +sudo systemctl enable --now libvirtd +sudo systemctl enable --now virtlogd + +echo 1 | sudo tee /sys/module/kvm/parameters/ignore_msrs + +sudo modprobe kvm +``` + +### I'd like to run Docker-OSX on Windows + +Running Docker-OSX on Windows is possible using WSL2 (Windows 11 + Windows Subsystem for Linux). + +You must have Windows 11 installed with build 22000+ (21H2 or higher). + +First, install WSL on your computer by running this command in an administrator powershell. For more info, look [here](https://docs.microsoft.com/en-us/windows/wsl/install). + +This will install Ubuntu by default. +``` +wsl --install +``` + + You can confirm WSL2 is enabled using `wsl -l -v` in PowerShell. To see other distributions that are available, use `wsl -l -o`. + +If you have previously installed WSL1, upgrade to WSL 2. Check [this link to upgrade from WSL1 to WSL2](https://docs.microsoft.com/en-us/windows/wsl/install#upgrade-version-from-wsl-1-to-wsl-2). + +After WSL installation, go to `C:/Users//.wslconfig` and add `nestedVirtualization=true` to the end of the file (If the file doesn't exist, create it). For more information about the `.wslconfig` file check [this link](https://docs.microsoft.com/en-us/windows/wsl/wsl-config#wslconfig). Verify that you have selected "Show Hidden Files" and "Show File Extensions" in File Explorer options. +The result should be like this: +``` +[wsl2] +nestedVirtualization=true +``` + +Go into your WSL distro (Run `wsl` in powershell) and check if KVM is enabled by using the `kvm-ok` command. The output should look like this: + +``` +INFO: /dev/kvm exists +KVM acceleration can be used +``` + +Use the command `sudo apt -y install bridge-utils cpu-checker libvirt-clients libvirt-daemon qemu qemu-kvm` to install it if it isn't. + +Now download and install [Docker for Windows](https://docs.docker.com/desktop/windows/install/) if it is not already installed. + +After installation, go into Settings and check these 2 boxes: + +``` +General -> "Use the WSL2 based engine"; +Resources -> WSL Integration -> "Enable integration with my default WSL distro", +``` + +Ensure `x11-apps` is installed. Use the command `sudo apt install x11-apps -y` to install it if it isn't. + +Finally, there are 3 ways to get video output: + +- WSLg: This is the simplest and easiest option to use. There may be some issues such as the keyboard not being fully passed through or seeing a second mouse on the desktop - [Issue on WSLg](https://github.com/microsoft/wslg/issues/376) - but this option is recommended. + +To use WSLg's built-in X-11 server, change these two lines in the docker run command to point Docker-OSX to WSLg. + +``` +-e "DISPLAY=${DISPLAY:-:0.0}" \ +-v /mnt/wslg/.X11-unix:/tmp/.X11-unix \ +``` +Or try: + +``` +-e "DISPLAY=${DISPLAY:-:0}" \ +-v /mnt/wslg/.X11-unix:/tmp/.X11-unix \ +``` + +For Ubuntu 20.x on Windows, see [https://github.com/sickcodes/Docker-OSX/discussions/458](https://github.com/sickcodes/Docker-OSX/discussions/458) + +- VNC: See the [VNC section](#building-a-headless-container-which-allows-insecure-vnc-on-localhost-for-local-use-only) for more information. You could also add -vnc argument to qemu. Connect to your mac VM via a VNC Client. [Here is a how to](https://wiki.archlinux.org/title/QEMU#VNC) +- Desktop Environment: This will give you a full desktop linux experience but it will use a bit more of the computer's resources. Here is an example guide, but there are other guides that help set up a desktop environment. [DE Example](https://www.makeuseof.com/tag/linux-desktop-windows-subsystem/) + +## Additional boot instructions for when you are [creating your container](#container-creation-examples) + +- Boot the macOS Base System (Press Enter) + +- Click `Disk Utility` + +- Erase the BIGGEST disk (around 200gb default), DO NOT MODIFY THE SMALLER DISKS. +-- if you can't click `erase`, you may need to reduce the disk size by 1kb + +- (optional) Create a partition using the unused space to house the OS and your files if you want to limit the capacity. (For Xcode 12 partition at least 60gb.) + +- Click `Reinstall macOS` + +- The system may require multiple reboots during installation + +## Troubleshooting + +### Routine checks + +This is a great place to start if you are having trouble getting going, especially if you're not that familiar with Docker just yet. + +Just looking to make a container quickly? Check out our [container creation examples](#container-creation-examples) section. + +More specific/advanced troubleshooting questions and answers may be found in [More Questions and Answers](#more-questions-and-answers). You should also check out the [closed issues](https://github.com/sickcodes/Docker-OSX/issues?q=is%3Aissue+is%3Aclosed). Someone else might have gotten a question like yours answered already even if you can't find it in this document! + +#### Confirm that your CPU supports virtualization + +See [initial setup](#initial-setup). + + + +#### Docker Unknown Server OS error + +```console +docker: unknown server OS: . +See 'docker run --help'. +``` + +This means your docker daemon is not running. + +`pgrep dockerd` should return nothing + +Therefore, you have a few choices. + +`sudo dockerd` for foreground Docker usage. I use this. + +Or + +`sudo systemctl --start dockerd` to start dockerd this now. + +Or + +`sudo systemctl --enable --now dockerd` for start dockerd on every reboot, and now. + + +#### Use more CPU Cores/SMP + +Examples: + +`-e EXTRA='-smp 6,sockets=3,cores=2'` + +`-e EXTRA='-smp 8,sockets=4,cores=2'` + +`-e EXTRA='-smp 16,sockets=8,cores=2'` + +Note, unlike memory, CPU usage is shared. so you can allocate all of your CPU's to the container. + +### Confirm your user is part of the Docker group, KVM group, libvirt group + +#### Add yourself to the Docker group + +If you use `sudo dockerd` or dockerd is controlled by systemd/systemctl, then you must be in the Docker group. +If you are not in the Docker group: + +```bash +sudo usermod -aG docker "${USER}" +``` +and also add yourself to the kvm and libvirt groups if needed: + +```bash +sudo usermod -aG libvirt "${USER}" +sudo usermod -aG kvm "${USER}" +``` + +See also: [initial setup](#initial-setup). + +#### Is the docker daemon enabled? + +```bash +# run ad hoc +sudo dockerd + +# or daemonize it +sudo nohup dockerd & + +# enable it in systemd (it will persist across reboots this way) +sudo systemctl enable --now docker + +# or just start it as your user with systemd instead of enabling it +systemctl start docker +``` + +## More Questions and Answers + +Big thank you to our contributors who have worked out almost every conceivable issue so far! + +[https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md](https://github.com/sickcodes/Docker-OSX/blob/master/CREDITS.md) + + +### Start the same container later (persistent disk) + +Created a container with `docker run` and want to reuse the underlying image again later? + +NB: see [container creation examples](#container-creation-examples) first for how to get to the point where this is applicable. + +This is for when you want to run the SAME container again later. You may need to use `docker commit` to save your container before you can reuse it. Check if your container is persisted with `docker ps --all`. + +If you don't run this you will have a new image every time. + +```bash +# look at your recent containers and copy the CONTAINER ID +docker ps --all + +# docker start the container ID +docker start -ai abc123xyz567 + +# if you have many containers, you can try automate it with filters like this +# docker ps --all --filter "ancestor=sickcodes/docker-osx" +# for locally tagged/built containers +# docker ps --all --filter "ancestor=docker-osx" + +``` + +You can also pull the `.img` file out of the container, which is stored in `/var/lib/docker`, and supply it as a runtime argument to the `:naked` Docker image. + +See also: [here](https://github.com/sickcodes/Docker-OSX/issues/197). + +### I have used Docker-OSX before and want to restart a container that starts automatically + +Containers that use `sickcodes/docker-osx:auto` can be stopped while being started. + +```bash +# find last container +docker ps -a + +# docker start old container with -i for interactive, -a for attach STDIN/STDOUT +docker start -ai -i +``` + +### LibGTK errors "connection refused" + +You may see one or more libgtk-related errors if you do not have everything set up for hardware virtualisation yet. If you have not yet done so, check out the [initial setup](#initial-setup) section and the [routine checks](#routine-checks) section as you may have missed a setup step or may not have all the needed Docker dependencies ready to go. + +See also: [here](https://github.com/sickcodes/Docker-OSX/issues/174). + +#### Permissions denied error + +If you have not yet set up xhost, try the following: + +```bash +echo $DISPLAY + +# ARCH +sudo pacman -S xorg-xhost + +# UBUNTU DEBIAN +sudo apt install x11-xserver-utils + +# CENTOS RHEL FEDORA +sudo yum install xorg-x11-server-utils + +# then run +xhost + + +``` + +### RAM over-allocation +You cannot allocate more RAM than your machine has. The default is 3 Gigabytes: `-e RAM=3`. + +If you are trying to allocate more RAM to the container than you currently have available, you may see an error like the following: `cannot set up guest memory 'pc.ram': Cannot allocate memory`. See also: [here](https://github.com/sickcodes/Docker-OSX/issues/188), [here](https://github.com/sickcodes/Docker-OSX/pull/189). + +For example (below) the `buff/cache` already contains 20 Gigabytes of allocated RAM: + +```console +[user@hostname ~]$ free -mh + total used free shared buff/cache available +Mem: 30Gi 3.5Gi 7.0Gi 728Mi 20Gi 26Gi +Swap: 11Gi 0B 11Gi +``` + +Clear the buffer and the cache: + +```bash +sudo tee /proc/sys/vm/drop_caches <<< 3 +``` + +Now check the RAM again: + +```console +[user@hostname ~]$ free -mh + total used free shared buff/cache available +Mem: 30Gi 3.3Gi 26Gi 697Mi 1.5Gi 26Gi +Swap: 11Gi 0B 11Gi +``` + +### PulseAudio + +#### Use PulseAudio for sound + +Note: [AppleALC](https://github.com/acidanthera/AppleALC), [`alcid`](https://dortania.github.io/OpenCore-Post-Install/universal/audio.html) and [VoodooHDA-OC](https://github.com/chris1111/VoodooHDA-OC) do not have [codec support](https://osy.gitbook.io/hac-mini-guide/details/hda-fix#hda-codec). However, [IORegistryExplorer](https://github.com/vulgo/IORegistryExplorer) does show the controller component working. + +```bash +docker run \ + --device /dev/kvm \ + -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \ + -v "/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket" \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + sickcodes/docker-osx +``` + +#### PulseAudio debugging + +```bash +docker run \ + --device /dev/kvm \ + -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \ + -v "/run/user/$(id -u)/pulse/native:/tmp/pulseaudio.socket" \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e PULSE_SERVER=unix:/tmp/pulseaudio.socket \ + sickcodes/docker-osx pactl list +``` + +#### PulseAudio with WSLg + +```bash +docker run \ + --device /dev/kvm \ + -e AUDIO_DRIVER=pa,server=unix:/tmp/pulseaudio.socket \ + -v /mnt/wslg/runtime-dir/pulse/native:/tmp/pulseaudio.socket \ + -v /mnt/wslg/.X11-unix:/tmp/.X11-unix \ + sickcodes/docker-osx +``` + +### Forward additional ports (nginx hosting example) + +It's possible to forward additional ports depending on your needs. In this example, we'll use Mac OSX to host nginx: + +``` +host:10023 <-> 10023:container:10023 <-> 80:guest +``` + +On the host machine, run: + +```bash +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,' \ + -p 10023:10023 \ + sickcodes/docker-osx:auto +``` + +In a Terminal session running the container, run: + +```bash +/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" + +brew install nginx +sudo sed -i -e 's/8080/80/' /usr/local/etc/nginx/nginx.confcd +# sudo nginx -s stop +sudo nginx +``` + +**nginx should now be reachable on port 10023.** + +Additionally, you can string multiple statements together, for example: + +```bash + -e ADDITIONAL_PORTS='hostfwd=tcp::10023-:80,hostfwd=tcp::10043-:443,' + -p 10023:10023 \ + -p 10043:10043 \ +``` + +### Bridged networking + +You might not need to do anything with the default setup to enable internet connectivity from inside the container. Additionally, `curl` may work even if `ping` doesn't. + +See discussion [here](https://github.com/sickcodes/Docker-OSX/issues/177) and [here](https://github.com/sickcodes/Docker-OSX/issues/72) and [here](https://github.com/sickcodes/Docker-OSX/issues/88). + +### Enable IPv4 forwarding for bridged network connections for remote installations + +This is not required for LOCAL installations. + +Additionally note it may [cause the host to leak your IP, even if you're using a VPN in the container](https://sick.codes/cve-2020-15590/). + +However, if you're trying to connect to an instance of Docker-OSX remotely (e.g. an instance of Docker-OSX hosted in a datacenter), this may improve your performance: + +```bash +# enable for current session +sudo sysctl -w net.ipv4.ip_forward=1 + +# OR +# sudo tee /proc/sys/net/ipv4/ip_forward <<< 1 + +# enable permanently +sudo touch /etc/sysctl.conf +sudo tee -a /etc/sysctl.conf <`. For example, to kill everything, `docker ps | xargs docker kill`.** + +Native QEMU VNC example + +```bash +docker run -i \ + --device /dev/kvm \ + -p 50922:10022 \ + -p 5999:5999 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e EXTRA="-display none -vnc 0.0.0.0:99,password=on" \ + sickcodes/docker-osx:big-sur + +# type `change vnc password myvncusername` into the docker terminal and set a password +# connect to localhost:5999 using VNC +# qemu 6 seems to require a username for vnc now +``` + +**NOT TLS/HTTPS Encrypted at all!** + +Or `ssh -N root@1.1.1.1 -L 5999:127.0.0.1:5999`, where `1.1.1.1` is your remote server IP. + +(Note: if you close port 5999 and use the SSH tunnel, this becomes secure.) + +### Building a headless container to run remotely with secure VNC + +Add the following line: + +`-e EXTRA="-display none -vnc 0.0.0.0:99,password=on"` + +In the Docker terminal, press `enter` until you see `(qemu)`. + +Type `change vnc password someusername` + +Enter a password for your new vnc username^. + +You also need the container IP: `docker inspect | jq -r '.[0].NetworkSettings.IPAddress'` + +Or `ip n` will usually show the container IP first. + +Now VNC connects using the Docker container IP, for example `172.17.0.2:5999` + +Remote VNC over SSH: `ssh -N root@1.1.1.1 -L 5999:172.17.0.2:5999`, where `1.1.1.1` is your remote server IP and `172.17.0.2` is your LAN container IP. + +Now you can direct connect VNC to any container built with this command! + +### I'd like to use SPICE instead of VNC + +Optionally, you can enable the SPICE protocol, which allows use of `remote-viewer` to access your OSX container rather than VNC. + +Note: `-disable-ticketing` will allow unauthenticated access to the VM. See the [spice manual](https://www.spice-space.org/spice-user-manual.html) for help setting up authenticated access ("Ticketing"). + +```bash + docker run \ + --device /dev/kvm \ + -p 3001:3001 \ + -p 50922:10022 \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + -e EXTRA="-monitor telnet::45454,server,nowait -nographic -serial null -spice disable-ticketing,port=3001" \ + mycustomimage +``` + +Then simply do `remote-viewer spice://localhost:3001` and add `--spice-debug` for debugging. + +#### Creating images based on an already configured and set up container +```bash +# You can create an image of an already configured and setup container. +# This allows you to effectively duplicate a system. +# To do this, run the following commands + +# make note of your container id +docker ps --all +docker commit containerid newImageName + +# To run this image do the following +docker run \ + --device /dev/kvm \ + --device /dev/snd \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + newImageName +``` + +```bash +docker pull sickcodes/docker-osx:auto + +# boot directly into a real OS X shell with no display (Xvfb) [HEADLESS] +docker run -it \ + --device /dev/kvm \ + -p 50922:10022 \ + sickcodes/docker-osx:auto + +# username is user +# password is alpine +# Wait 2-3 minutes until you drop into the shell. +``` + +#### Run the original version of Docker-OSX + +```bash + +docker pull sickcodes/docker-osx:latest + +docker run -it \ + --device /dev/kvm \ + --device /dev/snd \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + sickcodes/docker-osx:latest + +# press CTRL + G if your mouse gets stuck +# scroll down to troubleshooting if you have problems +# need more RAM and SSH on localhost -p 50922? +``` + +#### Run but enable SSH in OS X (Original Version)! + +```bash +docker run -it \ + --device /dev/kvm \ + --device /dev/snd \ + -p 50922:10022 \ + -v /tmp/.X11-unix:/tmp/.X11-unix \ + -e "DISPLAY=${DISPLAY:-:0.0}" \ + sickcodes/docker-osx:latest + +# turn on SSH after you've installed OS X in the "Sharing" settings. +ssh user@localhost -p 50922 +``` + +#### Autoboot into OS X after you've installed everything + +Add the extra option `-e NOPICKER=true`. + +Old machines: + +```bash +# find your containerID +docker ps + +# move the no picker script on top of the Launch script +# NEW CONTAINERS +docker exec containerID mv ./Launch-nopicker.sh ./Launch.sh + +# VNC-VERSION-CONTAINER +docker exec containerID mv ./Launch-nopicker.sh ./Launch_custom.sh + +# LEGACY CONTAINERS +docker exec containerID bash -c "grep -v InstallMedia ./Launch.sh > ./Launch-nopicker.sh +chmod +x ./Launch-nopicker.sh +sed -i -e s/OpenCore\.qcow2/OpenCore\-nopicker\.qcow2/ ./Launch-nopicker.sh +" +``` + + + +### The big-sur image starts slowly after installation. Is this expected? + +Automatic updates are still on in the container's settings. You may wish to turn them off. [We have future plans for development around this.](https://github.com/sickcodes/Docker-OSX/issues/227) + +### What is `${DISPLAY:-:0.0}`? + +`$DISPLAY` is the shell variable that refers to your X11 display server. + +`${DISPLAY}` is the same, but allows you to join variables like this: + +- e.g. `${DISPLAY}_${DISPLAY}` would print `:0.0_:0.0` +- e.g. `$DISPLAY_$DISPLAY` would print `:0.0` + +...because `$DISPLAY_` is not `$DISPLAY` + +`${variable:-fallback}` allows you to set a "fallback" variable to be substituted if `$variable` is not set. + +You can also use `${variable:=fallback}` to set that variable (in your current terminal). + +In Docker-OSX, we assume, `:0.0` is your default `$DISPLAY` variable. + +You can see what yours is + +```bash +echo $DISPLAY +``` + +That way, `${DISPLAY:-:0.0}` will use whatever variable your X11 server has set for you, else `:0.0` + +### What is `-v /tmp/.X11-unix:/tmp/.X11-unix`? + +`-v` is a Docker command-line option that lets you pass a volume to the container. + +The directory that we are letting the Docker container use is a X server display socket. + +`/tmp/.X11-unix` + +If we let the Docker container use the same display socket as our own environment, then any applications you run inside the Docker container will show up on your screen too! [https://www.x.org/archive/X11R6.8.0/doc/RELNOTES5.html](https://www.x.org/archive/X11R6.8.0/doc/RELNOTES5.html) + +### ALSA errors on startup or container creation + +You may when initialising or booting into a container see errors from the `(qemu)` console of the following form: +`ALSA lib blahblahblah: (function name) returned error: no such file or directory`. These are more or less expected. As long as you are able to boot into the container and everything is working, no reason to worry about these. + diff --git a/vnc-version/Dockerfile b/vnc-version/Dockerfile index d4ef8b7..42ebe93 100644 --- a/vnc-version/Dockerfile +++ b/vnc-version/Dockerfile @@ -125,4 +125,17 @@ RUN printf '\n\n\n\n%s\n%s\n\n\n\n' '===========VNC_PASSWORD========== ' "$( ${HOME}/.vnc/passwd RUN chmod 600 ~/.vnc/passwd RUN printf '\n\n\n\n%s\n%s\n\n\n\n' '===========VNC_PASSWORD========== ' "$(