• 3 min read

Building a macOS Detection Engineering Lab — Part 2: macOS VMs on Mac Hardware

If you have a Mac (especially Apple Silicon), running macOS VMs is surprisingly easy. Apple actually supports macOS virtualization natively now via the Virtualization.framework. This post covers three options — pick the one that fits your workflow.

macos detection-lab detection-engineering

Option A: Tart (CLI-First, Perfect for Automation)

Tart is my recommendation for an easy macOS lab VM. It’s a CLI tool built on Apple’s Virtualization.framework that’s designed for automation and CI/CD workflows.

Installation

brew install cirruslabs/cli/tart

Create Your First VM

# Pull a pre-built macOS image (fastest way to start)
tart clone ghcr.io/cirruslabs/macos-ventura-base:latest ventura-lab

# Start the VM
tart run ventura-lab

# In another terminal, get the IP and SSH in
ssh admin@$(tart ip ventura-lab)
# Default credentials: admin / admin

Why Tart for Detection Labs

  • Scriptable — Automate VM creation, cloning, and teardown
  • Fast cloning — Create fresh VMs in seconds using APFS clones
  • OCI images — Share VM images via container registries
  • Headless operation — Run VMs without a GUI for CI/CD
  • Snapshots — Built-in snapshot support

Useful Commands

# List VMs
tart list

# Stop a VM
tart stop ventura-lab

# Clone for clean testing (instant with APFS)
tart clone ventura-lab ventura-test

# Delete a VM
tart delete ventura-test

# Create from IPSW (build your own)
tart create --from-ipsw ~/Downloads/UniversalMac_14.0_23A344.ipsw ventura-custom

Option B: UTM (GUI, Beginner-Friendly)

UTM wraps Apple’s Virtualization.framework in a friendly GUI. Great if you prefer clicking over typing.

Installation

Download from getutm.app or:

brew install --cask utm

Create a macOS VM

  1. Get macOS IPSW:

    • Visit ipsw.me and download your desired version
    • Or use: softwareupdate --list-full-installers then download softwareupdate --fetch-full-installer --full-installer-version <version> (installs to /Applications)

  2. Create VM in UTM:

    • Click ”+” → “Virtualize” → “macOS”
    • Select your IPSW file
    • Allocate resources:
      • CPU: 4+ cores
      • RAM: 8GB+ (16GB recommended)
      • Disk: 64GB+
    • Click Create and wait for boot

  3. Complete macOS Setup:

    • Run through the standard macOS setup wizard
    • Create a local account

  4. Enable Remote Login:

    sudo systemsetup -setremotelogin on

UTM Tips

  • Use “Save VM State” for quick resume (like hibernation)
  • Shared directories work via virtio-fs
  • Performance is near-native on Apple Silicon

Post-Install Setup (All Options)

Regardless of which tool you used, configure your VM for lab work:

Enable SSH

sudo systemsetup -setremotelogin on

Disable Sleep

Keep the VM awake for long-running tests:

sudo pmset -a disablesleep 1

Install Homebrew

You’ll want this for installing tools:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Next Steps

Your macOS VM is ready. In the next post, we’ll cover setting up macOS VMs on Proxmox for those running Intel servers.

If you’re sticking with Mac hardware, skip ahead to Part 4 — Collecting macOS Logs.

Next: Part 3 — macOS VMs on Proxmox →