How to grant tart-guest-agent access to network volumes (--dir) in a CI environment? #1144
-
|
Hello Tart Team, I am running into a security prompt within a macOS guest VM that is blocking my CI/CD pipeline, and I'm looking for the recommended way to resolve it. Goal: Setup:
Problem:
What I've Tried (Without Success):
My Question: |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 5 replies
-
|
Which VM image are you using? I've tried to reproduce this on Terminal #1: % mkdir ~/build
% echo '#!/bin/zsh\n\necho "Hello, World!"\n' > ~/build/conanbuild.sh
% tart clone ghcr.io/cirruslabs/macos-tahoe-base:latest macos
% tart run --dir ~/build:tag=build macosTerminal #2: % tart exec -it macos zsh -c 'mkdir ~/build'
% tart exec -it macos zsh -c '/sbin/mount_virtiofs build ~/build'
% tart exec -it macos zsh '/Users/admin/build/conanbuild.sh'
Hello, World! |
Beta Was this translation helpful? Give feedback.
-
|
I'm using a self-created image based on macOS Sequoia 15.5. I am using Packer to create the image, and I install the agent using the provisioner script from the official provisioner "file" {
source = "data/tart-guest-agent.plist"
destination = "~/tart-guest-agent.plist"
}
provisioner "shell" {
inline = [
# Install Tart Guest Agent
"source ~/.zshrc",
"brew install cirruslabs/cli/tart-guest-agent",
# Install agent variant of the Tart Guest Agent
"sudo mv ~/tart-guest-agent.plist /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
"sudo chown root:wheel /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
"sudo chmod 0644 /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
]
}When I then follow your reproduction steps, the process hangs. Specifically, this command triggers the prompt: # This command hangs and causes the "access files on a network volume" prompt
tart exec -it my-vm-name zsh '/Users/admin/build/conanbuild.sh' |
Beta Was this translation helpful? Give feedback.
-
|
Can you try with the |
Beta Was this translation helpful? Give feedback.
-
|
Hi @edigaryev, sorry for the late reply. I just tested it again and wasn’t able to reproduce the issue with ghcr.io/cirruslabs/macos-tahoe-base:latest, the security prompt no longer appears. I’m guessing I must have missed some configuration earlier. Do you have any idea what I might have done wrong? |
Beta Was this translation helpful? Give feedback.
-
|
Here are the relevant steps in It's hard for me to tell what was done differently without seeing your templates, but you can compare and try modifying/re-building them and spot the difference this way. |
Beta Was this translation helpful? Give feedback.
-
|
Interesting, I had overlooked the disable-sip.pkr.hcl configuration. With that included, everything works as expected. Thanks for the support! |
Beta Was this translation helpful? Give feedback.
ghcr.io/cirruslabs/macos-tahoe-base:latestis based onvanilla-tahoe.pkr.hcl, with the following templates applied on top of it:base.pkr.hcldisable-sip.pkr.hclHere are the relevant steps in
base.pkr.hclthat install the Tart Guest Agent.It's hard for me to tell what was done differently without seeing your templates, but you can compare and try modifying/re-building them and spot the difference this way.