search

cirruslabs / tart

macOS and Linux VMs on Apple Silicon to use in CI and other automations
https://tart.run
Other
3.81k stars 112 forks source link

tart clone duplicates the UUIDs and can lead to undefined behavior of VMs #311

Closed uttie-huntress closed 8 months ago

uttie-huntress commented 1 year ago

Apple's Virtualization.Framework does not support clone out of the box and presently tart clone copies the parent VM directory into the cloned vm.

This poses a problem of having two machines running with duplicate MIDs, which is stated in the documentation to lead to undefined behavior.

The immediate problem this poses is that the generated UUIDs in both machines are the same, and creates a problem for consumers expecting it to the unique.

A secondary problem I have seen is that certain settings (like disabling SIP) on a cloned VM seem to percolate to the parent's VM. (I'd like to test this further to get a consistent repro)

The request is to investigate and fix it in a way that the generated MIDs are unique and don't lead to undefined behavior The Eclectic Light article has a good detail about this investigation

References:

fkorotkov commented 1 year ago

Interesting! We must've missed this warning. But we haven't seen any issues running two such VMs in parallel. The only issue we saw is when two VMs have the same MAC address. That's why we implemented MAC address generation in #45.

I'll try to reach out to Apple folks if they can provide some additional information. So far it seems it's not possible to generate VZMacMachineIdentifier on the fly and one will need to reuse it as described in the Eclectic Light article.

pthexton commented 1 year ago

If a solution to this is ever added, I'd like the option to retain the current behaviour. We use tart for automated testing of our software suite where we make use of an MDM configuration profile sent to the base VM image to facilitate automatic enablement of our software (as opposed to requiring admin user interaction to approve system extensions and full disk access), we don't want to run in to issues where the mobileconfig deployed to the VM may somehow invalidated due to the underlying UUID being changed

fkorotkov commented 8 months ago

I don't think we ever plan to implement this behaviour unless something will break.