build: Update QEMU base image to v7.29 (#377)

Add error handling for logo replacement in BIOS

.devcontainer.json

@@ -1,6 +0,0 @@
-{
-  "name": "macos",
-  "service": "macos",
-  "forwardPorts": [8006],
-  "dockerComposeFile": "compose.yml"
-}

.devcontainer/010 - macOS Sequoia/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "macOS 15 (Sequoia)",
+  "service": "macos",
+  "containerEnv": {
+    "VERSION": "15"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/030 - macOS Ventura/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "macOS 13 (Ventura)",
+  "service": "macos",
+  "containerEnv": {
+    "VERSION": "13"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/040 - macOS Monterey/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "macOS 12 (Monterey)",
+  "service": "macos",
+  "containerEnv": {
+    "VERSION": "12"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/050 - macOS Big Sur/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "macOS 11 (Big Sur)",
+  "service": "macos",
+  "containerEnv": {
+    "VERSION": "11"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/060 - macOS Catalina/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "macOS 10 (Catalina)",
+  "service": "macos",
+  "containerEnv": {
+    "VERSION": "10"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "../codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.devcontainer/codespaces.yml

@@ -0,0 +1,21 @@
+services:
+  macos:
+    container_name: macos
+    image: ghcr.io/dockur/macos
+    environment:
+      RAM_SIZE: "half"
+      DISK_SIZE: "max"
+      CPU_CORES: "max"
+    devices:
+      - /dev/kvm
+      - /dev/net/tun
+    cap_add:
+      - NET_ADMIN
+    ports:
+      - 8006:8006
+      - 5900:5900/tcp
+      - 5900:5900/udp
+    volumes:
+      - ./macos:/storage
+    restart: on-failure
+    stop_grace_period: 2m

.devcontainer/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "macOS 14 (Sonoma)",
+  "service": "macos",
+  "containerEnv": {
+    "VERSION": "14"
+  },
+  "forwardPorts": [8006],
+  "portsAttributes": {
+    "8006": {
+      "label": "Web",
+      "onAutoForward": "notify"
+    }
+  },
+  "otherPortsAttributes": {
+    "onAutoForward": "ignore"
+  }, 
+  "dockerComposeFile": "codespaces.yml",
+  "initializeCommand": "docker system prune --all --force"
+}

.dockerignore

@@ -1,4 +1,5 @@
 .dockerignore
+.devcontainer
 .git
 .github
 .gitignore

.github/workflows/build.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       -

.github/workflows/check.yml

@@ -7,7 +7,7 @@ jobs:
     name: shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
         env:
@@ -18,3 +18,8 @@ jobs:
           dockerfile: Dockerfile
           ignore: DL3008,DL3018,DL3020,DL3029,DL3059 
           failure-threshold: warning
+      -
+        name: Validate JSON and YML files
+        uses: GrantBirki/json-yaml-validate@v4
+        with:
+          yaml_exclude_regex: ".*\\kubernetes\\.yml$"

.github/workflows/hub.yml

@@ -12,7 +12,9 @@ jobs:
   dockerHubDescription:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+      -
+        name: Checkout repo
+        uses: actions/checkout@v6
       - 
         name: Docker Hub Description
         uses: peter-evans/dockerhub-description@v5

.github/workflows/review.yml

@@ -0,0 +1,66 @@
+on:
+  pull_request:
+
+name: "Review"
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+
+jobs:
+  review:
+    name: review
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Spelling
+        uses: reviewdog/action-misspell@v1
+        with:
+          locale: "US"
+          level: warning
+          pattern: |
+            *.md
+            *.sh
+          reporter: github-pr-review
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Hadolint
+        uses: reviewdog/action-hadolint@v1
+        with:
+          level: warning
+          reporter: github-pr-review
+          hadolint_ignore: DL3008 DL3018 DL3020 DL3029 DL3059
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: YamlLint
+        uses: reviewdog/action-yamllint@v1
+        with:
+          level: warning
+          reporter: github-pr-review
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: ActionLint
+        uses: reviewdog/action-actionlint@v1
+        with:
+          level: warning
+          reporter: github-pr-review
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Shellformat
+        uses: reviewdog/action-shfmt@v1
+        with:
+          level: warning
+          shfmt_flags: "-i 2 -ci -bn"
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Shellcheck
+        uses: reviewdog/action-shellcheck@v1
+        with:
+          level: warning
+          reporter: github-pr-review
+          shellcheck_flags: -x -e SC1091 -e SC2001 -e SC2002 -e SC2034 -e SC2064 -e SC2153 -e SC2317 -e SC2028
+          github_token: ${{ secrets.GITHUB_TOKEN }}

Dockerfile

@@ -12,7 +12,7 @@ RUN apk --update --no-cache add unzip && \
     rm -rf /tmp/* /var/tmp/* /var/cache/apk/*
 
 FROM scratch AS runner
-COPY --from=qemux/qemu:7.23 / /
+COPY --from=qemux/qemu:7.29 / /
 
 ARG VERSION_ARG="0.0"
 ARG VERSION_KVM_OPENCORE="v21"
@@ -49,7 +49,7 @@ EXPOSE 5900 8006
 
 ENV VERSION="14"
 ENV RAM_SIZE="4G"
-ENV CPU_CORES="2"
+ENV CPU_CORES="1"
 ENV DISK_SIZE="64G"
 
 ENTRYPOINT ["/usr/bin/tini", "-s", "/run/entry.sh"]

readme.md

@@ -1,4 +1,4 @@
-<h1 align="center">OSX<br />
+<h1 align="center">macOS<br />
 <div align="center">
 <a href="https://github.com/dockur/macos/"><img src="https://github.com/dockur/macos/raw/master/.github/logo.png" title="Logo" style="max-width:100%;" width="128" /></a>
 </div>
@@ -12,7 +12,7 @@
 
 </div></h1>
 
-OSX (macOS) inside a Docker container.
+MacOS inside a Docker container.
 
 ## Features ✨
 
@@ -49,7 +49,7 @@ services:
 ##### Via Docker CLI:
 
 ```bash
-docker run -it --rm --name macos -e "VERSION=14" -p 8006:8006 --device=/dev/kvm --device=/dev/net/tun --cap-add NET_ADMIN -v "${PWD:-.}/macos:/storage" --stop-timeout 120 dockurr/macos
+docker run -it --rm --name macos -e "VERSION=14" -p 8006:8006 --device=/dev/kvm --device=/dev/net/tun --cap-add NET_ADMIN -v "${PWD:-.}/macos:/storage" --stop-timeout 120 docker.io/dockurr/macos
 ```
 
 ##### Via Kubernetes:
@@ -78,7 +78,13 @@ kubectl apply -f https://raw.githubusercontent.com/dockur/macos/refs/heads/maste
   
   - When prompted where you want to install it, select the disk you created previously.
  
-  - After all files are copied, select your region, language, and account settings.
+  - After all files are copied, select your region, language, and keyboard settings.
+
+  - When the `Migration Assistant` wants to transfer data, select `Not now` (bottom left).
+
+  - On the `Apple ID` screen, select `Set Up Later` (bottom left) and then proceed using `Skip`.
+  
+  - On the `Create a Computer Account` screen, fill in a username and password and `Continue`.
  
   Enjoy your brand new machine, and don't forget to star this repo!
 
@@ -88,7 +94,7 @@ kubectl apply -f https://raw.githubusercontent.com/dockur/macos/refs/heads/maste
 
   ```yaml
   environment:
-    VERSION: "14"
+    VERSION: "15"
   ```
 
   Select from the values below:
@@ -129,7 +135,7 @@ kubectl apply -f https://raw.githubusercontent.com/dockur/macos/refs/heads/maste
 
 ### How do I change the amount of CPU or RAM?
 
-  By default, the container will be allowed to use a maximum of 2 CPU cores and 4 GB of RAM.
+  By default, macOS will be allowed to use a single CPU core and 4 GB of RAM.
 
   If you want to adjust this, you can specify the desired amount using the following environment variables:
 
@@ -139,6 +145,9 @@ kubectl apply -f https://raw.githubusercontent.com/dockur/macos/refs/heads/maste
     CPU_CORES: "4"
   ```
 
+> [!IMPORTANT]  
+> If your system has an AMD processor (instead of Intel), it is not advisable to enable multiple cores before the  installation is completed and you have verified that everything runs stable for a while. Because in many cases it will introduce issues, which are difficult to pinpoint if you do not have experience with its behavior on a single core first.
+
 ### How do I assign an individual IP address to the container?
 
   By default, the container uses bridge networking, which shares the IP address with the host. 

src/boot.sh

@@ -2,7 +2,6 @@
 set -Eeuo pipefail
 
 # Docker environment variables
-: "${FORCE:="N"}"          # Force cores
 : "${SECURE:="off"}"       # Secure boot
 : "${BOOT_MODE:="macos"}"  # Boot mode
 
@@ -46,15 +45,23 @@ DEST="$STORAGE/$DEST"
 
 if [ ! -s "$DEST.rom" ] || [ ! -f "$DEST.rom" ]; then
   [ ! -s "$OVMF/$ROM" ] || [ ! -f "$OVMF/$ROM" ] && error "UEFI boot file ($OVMF/$ROM) not found!" && exit 44
-  cp "$OVMF/$ROM" "$DEST.rom"
+  if [[ "${LOGO:-}" == [Nn]* ]]; then
-  if [[ "${LOGO:-}" != [Nn]* ]]; then
+    cp "$OVMF/$ROM" "$DEST.tmp"
-    /run/utk.bin "$DEST.rom" replace_ffs LogoDXE "/var/www/img/macos.ffs" save "$DEST.rom"
+  else
+    if ! /run/utk.bin "$OVMF/$ROM" replace_ffs LogoDXE "/var/www/img/${PROCESS,,}.ffs" save "$DEST.tmp"; then
+      warn "failed to add custom logo to BIOS!"
+      cp "$OVMF/$ROM" "$DEST.tmp"
     fi
   fi
+  mv "$DEST.tmp" "$DEST.rom"
+  ! setOwner "$DEST.rom" && error "Failed to set the owner for \"$DEST.rom\" !"
+fi
 
 if [ ! -s "$DEST.vars" ] || [ ! -f "$DEST.vars" ]; then
   [ ! -s "$OVMF/$VARS" ] || [ ! -f "$OVMF/$VARS" ]&& error "UEFI vars file ($OVMF/$VARS) not found!" && exit 45
-  cp "$OVMF/$VARS" "$DEST.vars"
+  cp "$OVMF/$VARS" "$DEST.tmp"
+  mv "$DEST.tmp" "$DEST.vars"
+  ! setOwner "$DEST.vars" && error "Failed to set the owner for \"$DEST.vars\" !"
 fi
 
 BOOT_OPTS+=" -drive if=pflash,format=raw,readonly=on,file=$DEST.rom"
@@ -156,6 +163,8 @@ if [ ! -f "$IMG" ]; then
 
 fi
 
+! setOwner "$IMG" && error "Failed to set the owner for \"$IMG\" !"
+
 BOOT_DRIVE_ID="OpenCore"
 
 DISK_OPTS+=" -device virtio-blk-pci,drive=${BOOT_DRIVE_ID},bus=pcie.0,addr=0x5,bootindex=$BOOT_INDEX"
@@ -165,12 +174,32 @@ CPU_VENDOR=$(lscpu | awk '/Vendor ID/{print $3}')
 DEFAULT_FLAGS="vendor=GenuineIntel,vmx=off,vmware-cpuid-freq=on,-pdpe1gb"
 
 if [[ "$CPU_VENDOR" == "AuthenticAMD" || "${KVM:-}" == [Nn]* ]]; then
-  [ -z "${CPU_MODEL:-}" ] && CPU_MODEL="Haswell-noTSX"
+
-  if [[ "${KVM:-}" == [Nn]* ]] || [[ "${ARCH,,}" != "amd64" ]] || [[ "$OSTYPE" =~ ^darwin ]]; then
+  if [ -z "${CPU_MODEL:-}" ]; then
-    DEFAULT_FLAGS+=",-pcid,-tsc-deadline,-invpcid,-xsavec,+ssse3,+sse4.2,+popcnt,+avx,+avx2,+aes,+fma,+bmi1,+bmi2,+smep,+xsave,+xsavec,+xsaveopt,+xgetbv1,+movbe,+rdrand,check"
+
-  else
+    case "${VERSION,,}" in
-    DEFAULT_FLAGS+=",+pcid,+ssse3,+sse4.2,+popcnt,+avx,+avx2,+aes,+fma,+bmi1,+bmi2,+smep,+xsave,+xsavec,+xsaveopt,+xgetbv1,+movbe,+rdrand,check"
+      "ventura" | "13"* )
+        CPU_MODEL="Haswell-noTSX" ;;
+      "monterey" | "12"* )
+        CPU_MODEL="Haswell-noTSX" ;;
+      "bigsur" | "big-sur" | "11"* )
+        CPU_MODEL="Haswell-noTSX" ;;
+      "catalina" | "10"* )
+        CPU_MODEL="Haswell-noTSX" ;;
+      *)
+        CPU_MODEL="Skylake-Client-v4"
+        DEFAULT_FLAGS+=",-spec-ctrl"
+        ;;
+    esac
+
   fi
+
+  if [[ "${KVM:-}" == [Nn]* ]] || [[ "${ARCH,,}" != "amd64" ]] || [[ "$OSTYPE" =~ ^darwin ]]; then
+    DEFAULT_FLAGS+=",-pcid,-tsc-deadline,-invpcid,-xsavec,-xsaves,+ssse3,+sse4.2,+popcnt,+avx,+avx2,+aes,+fma,+bmi1,+bmi2,+smep,+xsave,+xsaveopt,+xgetbv1,+movbe,+rdrand,check"
+  else
+    DEFAULT_FLAGS+=",+pcid,+ssse3,+sse4.2,+popcnt,+avx,+avx2,+aes,+fma,+bmi1,+bmi2,+smep,+xsave,+xsavec,+xsaves,+xsaveopt,+xgetbv1,+movbe,+rdrand,check"
+  fi
+
 fi
 
 if [ -z "${CPU_FLAGS:-}" ]; then
@@ -179,11 +208,6 @@ else
   CPU_FLAGS="$DEFAULT_FLAGS,$CPU_FLAGS"
 fi
 
-if [[ "$CPU_VENDOR" == "AuthenticAMD" && "${CPU_CORES,,}" != "1" && "${FORCE:-}" == [Nn]* && "${KVM:-}" != [Nn]* ]]; then
-  warn "Restricted processor to a single core (instead of $CPU_CORES cores) because an AMD CPU was detected! (Set \"FORCE=Y\" to disable this measure)"
-  CPU_CORES="1"
-fi
-
 SM_BIOS=""
 CLOCKSOURCE="tsc"
 [[ "${ARCH,,}" == "arm64" ]] && CLOCKSOURCE="arch_sys_counter"
@@ -195,14 +219,11 @@ else
   result=$(<"$CLOCK")
   result="${result//[![:print:]]/}"
   case "${result,,}" in
-    "${CLOCKSOURCE,,}" ) ;;
+    "${CLOCKSOURCE,,}" ) 
-    "kvm-clock" )
+      if [[ "$CPU_VENDOR" == "GenuineIntel" && "$CPU_CORES" == "1" && "${KVM:-}" != [Nn]* ]]; then
-      if [[ "$CPU_VENDOR" == "AuthenticAMD" && "${CPU_CORES,,}" != "1" && "${FORCE:-}" == [Nn]* && "${KVM:-}" != [Nn]* ]]; then
+        CPU_CORES="2"
-        warn "Restricted processor to a single core (instead of $CPU_CORES cores) because nested KVM virtualization on an AMD CPU was detected! (Set \"FORCE=Y\" to disable this measure)"
-        CPU_CORES="1"
-      else
-        warn "Nested KVM virtualization detected, this might cause issues running macOS!"
       fi ;;
+    "kvm-clock" ) warn "Nested KVM virtualization detected, this might cause issues running macOS!" ;;
     "hyperv_clocksource_tsc_page" ) info "Nested Hyper-V virtualization detected, this might cause issues running macOS!" ;;
     "hpet" ) warn "unsupported clock source detected: '$result'. Please set host clock source to '$CLOCKSOURCE', otherwise it will cause issues running macOS!" ;;
     *) warn "unexpected clock source detected: '$result'. Please set host clock source to '$CLOCKSOURCE', otherwise it will cause issues running macOS!" ;;

src/entry.sh

@@ -19,7 +19,9 @@ cd /run
 . network.sh    # Initialize network
 . boot.sh       # Configure boot
 . proc.sh       # Initialize processor
+. memory.sh     # Check available memory
 . config.sh     # Configure arguments
+. finish.sh     # Finish initialization
 
 trap - ERR
 

src/install.sh

@@ -155,7 +155,10 @@ install() {
   esac
 
   rm -f "$dest"
-  mkdir -p "$STORAGE"
+
+  if ! makeDir "$STORAGE"; then
+    error "Failed to create directory \"$STORAGE\" !" && return 1
+  fi
 
   find "$STORAGE" -maxdepth 1 -type f \( -iname '*.rom' -or -iname '*.vars' \) -delete
   find "$STORAGE" -maxdepth 1 -type f \( -iname 'data.*' -or -iname 'macos.*' \) -delete
@@ -191,7 +194,9 @@ generateID() {
   UUID=$(cat /proc/sys/kernel/random/uuid 2> /dev/null || uuidgen --random)
   UUID="${UUID^^}"
   UUID="${UUID//[![:print:]]/}"
+
   echo "$UUID" > "$file"
+  ! setOwner "$file" && error "Failed to set the owner for \"$file\" !"
 
   return 0
 }
@@ -208,7 +213,9 @@ generateAddress() {
   # Generate Apple MAC address based on Docker container ID in hostname
   MAC=$(echo "$HOST" | md5sum | sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/00:16:cb:\3:\4:\5/')
   MAC="${MAC^^}" 
+
   echo "$MAC" > "$file"
+  ! setOwner "$file" && error "Failed to set the owner for \"$file\" !"
 
   return 0
 }
@@ -239,6 +246,9 @@ generateSerial() {
   echo "$SN" > "$file"
   echo "$MLB" > "$file2"
 
+  ! setOwner "$file" && error "Failed to set the owner for \"$file\" !"
+  ! setOwner "$file2" && error "Failed to set the owner for \"$file2\" !"
+
   return 0
 }
 
@@ -262,6 +272,7 @@ if [ ! -f "$BASE_IMG" ] || [ ! -s "$BASE_IMG" ]; then
 
   if [ ! -f "$BASE_IMG" ] || [ ! -s "$BASE_IMG" ]; then
     ! install "$VERSION" "$BASE_IMG" && exit 34
+    ! setOwner "$BASE_IMG" && error "Failed to set the owner for \"$BASE_IMG\" !"
   fi
 
 fi