public_git
/
tart
mirror of https://github.com/cirruslabs/tart.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
tart/feed_rss_updated.xml

1 line
76 KiB
XML
Raw Permalink Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<?xml version="1.0" encoding="UTF-8" ?> <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/"> <channel> <title>Tart Virtualization</title><description>Tart is a virtualization toolset to build, run and manage macOS and Linux virtual machines (VMs) on Apple Silicon. </description><link>https://tart.run/</link><atom:link href="https://tart.run/feed_rss_updated.xml" rel="self" type="application/rss+xml" /> <managingEditor>Cirrus Labs</managingEditor><docs>https://github.com/cirruslabs/tart/</docs><language>en</language> <pubDate>Sun, 12 Apr 2026 02:36:10 -0000</pubDate> <lastBuildDate>Sun, 12 Apr 2026 02:36:10 -0000</lastBuildDate> <ttl>1440</ttl> <generator>MkDocs RSS plugin - v1.17.9</generator> <image> <url>None</url> <title>Tart Virtualization</title> <link>https://tart.run/</link> </image> <item> <title>Changing Tart License</title> <author>Fedor Korotkov</author> <description>&lt;h1 id=&#34;changing-tart-license&#34;&gt;Changing Tart License&lt;a class=&#34;headerlink&#34; href=&#34;#changing-tart-license&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;&lt;strong&gt;TLDR:&lt;/strong&gt; We are transitioning Tart&#39;s licensing from AGPL-3.0 to &lt;a href=&#34;https://fair.io/&#34;&gt;Fair Source 100&lt;/a&gt;. This change will permit unlimited installations on personal computers, but organizations that exceed a certain number of server installations utilizing 100 CPU cores will be required to obtain a paid license.&lt;/p&gt; &lt;h2 id=&#34;background&#34;&gt;Background&lt;a class=&#34;headerlink&#34; href=&#34;#background&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;Exactly a year ago on February 11&lt;sup&gt;th&lt;/sup&gt; 2022 we started working on Tart – a tiny CLI to run macOS virtual machines on Apple Silicon. Three months later we successfully started using Tart in our own production system and decided to share Tart with everyone.&lt;/p&gt; &lt;p&gt;&lt;img src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/TartSocial.png&#34;/&gt;&lt;/p&gt; &lt;p&gt;The goal was to establish a community of users and contributors to transform Tart from a small CLI to a robust tool for various scenarios. &lt;strong&gt;Unfortunately, we were not successful in attracting a significant number of contributors.&lt;/strong&gt; It&#39;s important to note that we did have seven individuals who contributed to the development of Tart to the best of their abilities. However, one of the challenges of contributing to Tart is that the skill set required for a contribution is vastly different from the skill set typically possessed by regular Tart users in their daily work. Specifically, a contributor needs to have knowledge of the Swift programming language, as well as a background in operating systems and network stack. This is the reason why &lt;strong&gt;98.8% of the code and all the major features were contributed by Cirrus Labs engineers.&lt;/strong&gt;&lt;/p&gt; &lt;!-- more --&gt; &lt;p&gt;Tart is experiencing significant success among users and has seen widespread adoption for various applications. The latest macOS Ventura virtual machine image has been downloaded over 27,000 times! We are continually receiving feedback from an increasing number of users who are utilizing Tart in ways we had not initially anticipated. However, with a growing user base comes a rise in requests for new features and enhancements. It can be challenging to justify dedicating our engineering resources to meeting these demands when they do not align with the needs of our company, Cirrus Labs. As a small, self-funded organization, our priority is to provide for our employees and their families along with developing great products.&lt;/p&gt; &lt;p&gt;In addition, the &lt;strong&gt;decision to use AGPL-3.0 as the license for Tart was not thoroughly considered at the time of its release.&lt;/strong&gt; The choice was made because many companies that were commercializing their products had recently switched to the AGPL license. However, AGPL has a reputation for being viral, open to interpretation, and not in line with current standards. Additionally, many organizations have policies against using any AGPL-licensed software in their stacks, which has limited Tart&#39;s potential for wider adoption. See &lt;a href=&#34;https://opensource.google/documentation/reference/using/agpl-policy&#34;&gt;Google&#39;s AGPL policy&lt;/a&gt;, for example.&lt;/p&gt; &lt;p&gt;In order to ensure Tart&#39;s long-term viability and to allow us to allocate engineering resources towards further improving Tart, we plan to transition to a licensing model that includes a nominal fee for companies that reach a substantial level of usage.&lt;/p&gt; &lt;h2 id=&#34;what-is-changing&#34;&gt;What is changing&lt;a class=&#34;headerlink&#34; href=&#34;#what-is-changing&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;In the near future, we are set to launch the first version of Orchard for Tart, a tool that facilitates the coordination of Tart virtual machines on a cluster of Apple Silicon servers. Concurrently, we will also release version 1.0.0 of Tart, which will establish a stable API and offer long-term support under a new Fair Source 100 license.&lt;/p&gt; &lt;p&gt;The Fair Source 100 license for Tart means that once a certain threshold of server installations utilizing 100 CPU cores is exceeded, a paid license will be required. A &#34;server installation&#34; refers to the installation of Tart on a physical device without a physical display connected. For example, a Mac Mini with a HDMI Dummy Plug is considered a server, but a Mac Mini on a desk with a connected physical display is considered a personal computer. &lt;strong&gt;Usage on personal computers and before reaching the 100 CPU cores limit is royalty-free and does not have the viral properties of AGPL.&lt;/strong&gt;&lt;/p&gt; &lt;div class=&#34;admonition note&#34;&gt; &lt;p class=&#34;admonition-title&#34;&gt;Pricing update&lt;/p&gt; &lt;p&gt;This post announced Tart licensing in February 2023 and originally listed monthly prices. Pricing has since changed to yearly billing. See &lt;a href=&#34;../../../../../licensing/#license-tiers&#34;&gt;Licensing and Support&lt;/a&gt; for the latest terms.&lt;/p&gt; &lt;/div&gt; &lt;p&gt;When an organization surpasses the 100 CPU cores limit, they will be required to obtain a &lt;a href=&#34;../../../../../licensing/#license-tiers&#34;&gt;Gold Tier License&lt;/a&gt;, which costs $12,000 per year. Upon reaching a limit of 500 CPU cores, a &lt;a href=&#34;../../../../../licensing/#license-tiers&#34;&gt;Platinum Tier License&lt;/a&gt; ($36,000 per year) will be required, and for organizations that exceed 3000 CPU cores, a custom &lt;a href=&#34;../../../../../licensing/#license-tiers&#34;&gt;Diamond Tier License&lt;/a&gt; ($12 per core per year) will be necessary. &lt;strong&gt;All paid license tiers will include priority feature development and SLAs on support with urgent issues.&lt;/strong&gt;&lt;/p&gt; &lt;h2 id=&#34;have-we-considered-alternatives&#34;&gt;Have we considered alternatives?&lt;a class=&#34;headerlink&#34; href=&#34;#have-we-considered-alternatives&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;We have evaluated other options. Initially, we reached out to some of our largest users and asked them to consider sponsoring the development of features that they were interested in. However, we received no response or were eventually ignored. Another option we considered was using the open core model and developing enterprise-specific features. However, this approach is not addressing concerns related to the viral nature of AGPL for non-enterprise users. Ultimately, we concluded that transitioning to a source-available model with a mandatory paid licensing is fair, as the licensing fees are relatively insignificant for companies that reach a significant level of usage.&lt;/p&gt; &lt;p&gt;If you have any questions or concerns, please feel free to reach out to &lt;a href=&#34;mailto:licensing@cirruslabs.org&#34;&gt;licensing@cirruslabs.org&lt;/a&gt;. If the new licensing model is not suitable for your organization, you are welcome to continue using the AGPL version of Tart, but please ensure it is not used in a non-AGPL environment.&lt;/p&gt;</description> <link>https://tart.run/blog/2023/02/11/changing-tart-license/</link> <pubDate>Fri, 13 Feb 2026 15:46:01 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2023/02/11/changing-tart-license/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2023/02/11/changing-tart-license.png" type="image/png" length="57582" /> </item> <item> <title>Press Release: Cirrus Labs Successfully Enforces Its Fair Source License</title> <author>Fedor Korotkov</author> <description>&lt;h1 id=&#34;press-release-cirrus-labs-successfully-enforces-its-fair-source-license&#34;&gt;Press Release: Cirrus Labs Successfully Enforces Its Fair Source License&lt;a class=&#34;headerlink&#34; href=&#34;#press-release-cirrus-labs-successfully-enforces-its-fair-source-license&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;&lt;strong&gt;New York City, NY – October 27&lt;sup&gt;th&lt;/sup&gt;, 2025 – Cirrus Labs, Inc.&lt;/strong&gt;, a leading provider of platforms for digital transformation, today announced that it has reached a settlement agreement regarding a violation of its Fair Source License.&lt;/p&gt; &lt;!-- more --&gt; &lt;p&gt;Cirrus Labs makes its Tart Virtualization Toolset, a leading virtualization toolset to build, run and manage macOS and Linux virtual machines (VMs) on Apple Silicon, freely available on GitHub under the Fair Source License, a source-available license. Tart is used by tens of thousands of engineers at no charge within its generous free‑use limits. Many large enterprises that need to exceed those limits support continued development through paid licenses. Cirrus Labs also uses Tart to power &lt;a href=&#34;https://cirrus-runners.app/&#34;&gt;Cirrus Runners&lt;/a&gt; — a drop‑in replacement for macOS and Linux runners for GitHub Actions — offered at a fixed monthly price for unlimited usage.&lt;/p&gt; &lt;p&gt;Cirrus Labs discovered that, &lt;strong&gt;despite a prior licensing request that was declined due to a conflict of interest&lt;/strong&gt;, another company used Tart in a manner that exceeded the license’s free‑use limits, in order to create a competing product.&lt;/p&gt; &lt;p&gt;After several months of negotiations, the matter was settled and a settlement payment to Cirrus Labs was agreed upon.&lt;/p&gt; &lt;div class=&#34;admonition quote&#34;&gt; &lt;p class=&#34;admonition-title&#34;&gt;Comment by Fedor Korotkov, CEO of Cirrus Labs&lt;/p&gt; &lt;p&gt;As a company we embrace healthy competition that ultimately benefits the end user. Most of our users have no trouble complying with our license, and even when they need something more than our free use limits, we can almost always grant them a license that fits their needs. &lt;strong&gt;This was an exceptional case.&lt;/strong&gt; We are pleased to have reached this settlement, which validates our source-available licensing strategy and reinforces our commitment to protecting our company and serving our community.&lt;/p&gt; &lt;/div&gt; &lt;p&gt;Cirrus Labs was represented in this matter by &lt;a href=&#34;https://byronraphael.com/attorneys/jordan-raphael/&#34;&gt;Jordan Raphael&lt;/a&gt; of Byron Raphael LLP, a boutique intellectual property law firm, and &lt;a href=&#34;https://www.techlawpartners.com/heather&#34;&gt;Heather Meeker&lt;/a&gt;, a well-known specialist in open source and source available licensing.&lt;/p&gt; &lt;p&gt;The specific financial terms of the settlement and the identity of the counterparty remain confidential.&lt;/p&gt; &lt;p&gt;&lt;strong&gt;About Cirrus Labs:&lt;/strong&gt; Cirrus Labs, Inc. is a bootstrapped developer-infrastructure company founded in 2017. Our offerings among others include Tart and Cirrus Runners, and our software is used by teams at category-leading companies including Atlassian, Figma, Zendesk, Sentry and many more.&lt;/p&gt; &lt;p&gt;Learn more at &lt;a href=&#34;https://tart.run/&#34;&gt;https://tart.run/&lt;/a&gt; and &lt;a href=&#34;https://cirrus-runners.app/&#34;&gt;https://cirrus-runners.app/&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;&lt;strong&gt;Contact:&lt;/strong&gt; &lt;a href=&#34;mailto:hello@cirruslabs.org&#34;&gt;hello@cirruslabs.org&lt;/a&gt;&lt;/p&gt;</description> <link>https://tart.run/blog/2025/10/27/press-release-cirrus-labs-successfully-enforces-its-fair-source-license/</link> <pubDate>Mon, 27 Oct 2025 16:04:35 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2025/10/27/press-release-cirrus-labs-successfully-enforces-its-fair-source-license/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2025/10/27/press-release-cirrus-labs-successfully-enforces-its-fair-source-license.png" type="image/png" length="71218" /> </item> <item> <title>Announcing Orchard orchestration for managing macOS virtual machines at scale</title> <author>Fedor Korotkov</author> <description>&lt;h1 id=&#34;announcing-orchard-orchestration-for-managing-macos-virtual-machines-at-scale&#34;&gt;Announcing Orchard orchestration for managing macOS virtual machines at scale&lt;a class=&#34;headerlink&#34; href=&#34;#announcing-orchard-orchestration-for-managing-macos-virtual-machines-at-scale&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;Today we are happy to announce general availability of Orchard – our new orchestrator to manage Tart virtual machines at scale. In this post we’ll cover the motivation behind creating yet another orchestrator and why we didn’t go with Kubernetes or Nomad integration.&lt;/p&gt; &lt;h2 id=&#34;what-problem-are-we-trying-to-solve&#34;&gt;What problem are we trying to solve?&lt;a class=&#34;headerlink&#34; href=&#34;#what-problem-are-we-trying-to-solve&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;After releasing Tart we pretty quickly started getting requests about managing macOS virtual machines on a cluster of Apple Silicon machines rather than just a single host which only allows a maximum of two virtual machines at a time. By the end of 2022 the requests reached a tipping point, and we started planning.&lt;/p&gt; &lt;!-- more --&gt; &lt;p&gt;First, we established some constraints about the end users and potential workload our solution should handle. Running macOS or Linux virtual machines on Apple Silicon is a very niche use case. These VMs are either used in automation solutions like CI/CD or for managing remote desktop environments. In this case &lt;strong&gt;we are aiming to manage only thousands of virtual machines and not millions&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;Second, &lt;strong&gt;operators of such solutions won’t have experience of operating Kubernetes or Nomad&lt;/strong&gt;. Operators will most likely come with experience of using such systems but not managing them. And again, having built-in things like RBAC and ability to scale to millions were appealing but it seemed like it would be a solution for a few rather than a solution for everybody to use. Additionally Orchard should provide &lt;strong&gt;first class support for accessing virtual machines over SSH/VNC&lt;/strong&gt; and support script execution.&lt;/p&gt; &lt;p&gt;By that time, the idea of building a simple opinionated orchestrator got more and more appealing. Plus we kind of already did it for &lt;a href=&#34;https://cirrus-ci.org/guide/persistent-workers/&#34;&gt;Cirrus CI’s persistent workers&lt;/a&gt; feature.&lt;/p&gt; &lt;h2 id=&#34;technical-constraints&#34;&gt;Technical constraints&lt;a class=&#34;headerlink&#34; href=&#34;#technical-constraints&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;With the UX constraints and expectations in place we started thinking about architecture for the orchestrator that we started calling &lt;strong&gt;Orchard&lt;/strong&gt;.&lt;/p&gt; &lt;script src=&#34;https://unpkg.com/@dotlottie/player-component@latest/dist/dotlottie-player.js&#34;&gt;&lt;/script&gt; &lt;p&gt;&lt;dotlottie-player src=&#34;/assets/animations/Orchard.lottie&#34; mode=&#34;normal&#34; style=&#34;width: 100%; height: 360px; margin: auto; background-color: rgb(5 62 94)&#34; autoplay loop /&gt;&lt;/p&gt; &lt;p&gt;Since Orchard will manage a maximum of a couple thousands virtual machines and not millions we &lt;strong&gt;decided to not think much about horizontal scalability.&lt;/strong&gt; Just a single instance of Orchard controller should be enough if it can restart quickly and persist state between restarts.&lt;/p&gt; &lt;p&gt;&lt;strong&gt;Orchard should be secure by default&lt;/strong&gt;. All the communication between a controller and workers should be secure. All external API requests to Orchard controller should be authorized.&lt;/p&gt; &lt;p&gt;During development it’s crucial to have a quick feedback cycle. &lt;strong&gt;It should be extremely easy to run Orchard in development&lt;/strong&gt;. Configuring a production cluster should be also easy for novice operators.&lt;/p&gt; &lt;h2 id=&#34;high-level-implementation-details&#34;&gt;High-level implementation details&lt;a class=&#34;headerlink&#34; href=&#34;#high-level-implementation-details&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;Cirrus Labs started as a predominantly Kotlin shop with a little Go. But over the years we gradually moved a lot of things to Go. We love the expressibility of Kotlin as a language but the ecosystem for writing system utilities and services is superb in Go.&lt;/p&gt; &lt;p&gt;Orchard is a single Go project that implements both controller server interface and worker client logic in a single repository. This simplifies code sharing and testability of the both components and allows to change them in a single pull request.&lt;/p&gt; &lt;p&gt;Another benefit is that Orchard can be distributed as a single binary. We intend to run Orchard controller on a single host. Data model for the orchestration didn’t look complex as well. These observations lead us to exploring the use of an embedded database. Just imagine! &lt;strong&gt;Orchard can be distributed as a single binary with no external dependencies on any database or runtime!&lt;/strong&gt;&lt;/p&gt; &lt;p&gt;And we did exactly that! Orchard is distributed as a single binary that can be run in “controller” mode on a Linux/macOS host and in “worker” mode on macOS hosts. Orchard controller is using extremely fast &lt;a href=&#34;https://dgraph.io/docs/badger/&#34;&gt;BadgerDB&lt;/a&gt; key-value storage to persist data.&lt;/p&gt; &lt;h2 id=&#34;conclusion&#34;&gt;Conclusion&lt;a class=&#34;headerlink&#34; href=&#34;#conclusion&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;Please give &lt;a href=&#34;https://github.com/cirruslabs/orchard&#34;&gt;Orchard&lt;/a&gt; a try! To run it locally in development mode on any Apple Silicon device please run the following command:&lt;/p&gt; &lt;div class=&#34;highlight&#34;&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;&lt;a id=&#34;__codelineno-0-1&#34; name=&#34;__codelineno-0-1&#34; href=&#34;#__codelineno-0-1&#34;&gt;&lt;/a&gt;brew&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;install&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;cirruslabs/cli/orchard &lt;a id=&#34;__codelineno-0-2&#34; name=&#34;__codelineno-0-2&#34; href=&#34;#__codelineno-0-2&#34;&gt;&lt;/a&gt;orchard&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;dev &lt;/code&gt;&lt;/pre&gt;&lt;/div&gt; &lt;p&gt;This will launch a development cluster with a single worker on your machine. Refer to &lt;a href=&#34;https://github.com/cirruslabs/orchard#creating-virtual-machines&#34;&gt;Orchard documentation&lt;/a&gt; on how to create your first virtual machine and access it.&lt;/p&gt; &lt;p&gt;In a &lt;a href=&#34;../../28/ssh-over-grpc-or-how-orchard-simplifies-accessing-vms-in-private-networks/&#34;&gt;separate blog post&lt;/a&gt; we’ll cover how Orchard implements seamless SSH access over a gRPC connection. Stay tuned and please don’t hesitate to &lt;a href=&#34;https://github.com/cirruslabs/orchard/discussions/landing&#34;&gt;reach out&lt;/a&gt;! &lt;/p&gt;</description> <link>https://tart.run/blog/2023/04/25/announcing-orchard-orchestration-for-managing-macos-virtual-machines-at-scale/</link> <pubDate>Mon, 22 Sep 2025 20:02:39 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2023/04/25/announcing-orchard-orchestration-for-managing-macos-virtual-machines-at-scale/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2023/04/25/announcing-orchard-orchestration-for-managing-macos-virtual-machines-at-scale.png" type="image/png" length="77793" /> </item> <item> <title>SSH over gRPC or how Orchard simplifies accessing VMs in private networks</title> <author>Nikolay Edigaryev</author> <description>&lt;h1 id=&#34;ssh-over-grpc-or-how-orchard-simplifies-accessing-vms-in-private-networks&#34;&gt;SSH over gRPC or how Orchard simplifies accessing VMs in private networks&lt;a class=&#34;headerlink&#34; href=&#34;#ssh-over-grpc-or-how-orchard-simplifies-accessing-vms-in-private-networks&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;We started developing &lt;a href=&#34;https://github.com/cirruslabs/orchard&#34;&gt;Orchard&lt;/a&gt;, an orchestrator for &lt;a href=&#34;https://tart.run/&#34;&gt;Tart&lt;/a&gt;, with the requirement that it should allow users to access virtual machines running on worker nodes in private networks that users might not have access to.&lt;/p&gt; &lt;p&gt;At the same time, we wanted to enable users to access VMs on these remote workers just as easily as they’d access network services on their local Tart VMs.&lt;/p&gt; &lt;p&gt;While these features sound great on paper, they pose a technical problem: how do we connect to the remote workers, let alone VMs running on these workers, if we can’t assume that these workers will be easily reachable? And how do we establish an SSH connection with a VM running on a remote worker through all these hoops?&lt;/p&gt; &lt;!-- more --&gt; &lt;h2 id=&#34;implementing-port-forwarding-grpc-to-the-rescue&#34;&gt;Implementing port forwarding: gRPC to the rescue&lt;a class=&#34;headerlink&#34; href=&#34;#implementing-port-forwarding-grpc-to-the-rescue&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;We need to keep a full-duplex connection with the controller for the port-forwarding to work, and the two obvious protocol options are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;WebSocket API through a new controller’s REST API endpoint&lt;/li&gt; &lt;li&gt;gRPC using &lt;code&gt;Content-Type&lt;/code&gt; differentiation&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;We’ve chosen the gRPC for controller ↔︎ worker connection, simply because it requires less code on our side and it will only be used internally, which means we don’t need to document it as extensively as our REST API. In essence, port forwarding is streaming of bytes of a connection in both ways, so gRPC streams looked like a natural solution. The resulting protocol is dead simple:&lt;/p&gt; &lt;div class=&#34;highlight&#34;&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;&lt;a id=&#34;__codelineno-0-1&#34; name=&#34;__codelineno-0-1&#34; href=&#34;#__codelineno-0-1&#34;&gt;&lt;/a&gt;&lt;span class=&#34;kd&#34;&gt;service&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;Controller&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;{&lt;/span&gt; &lt;a id=&#34;__codelineno-0-2&#34; name=&#34;__codelineno-0-2&#34; href=&#34;#__codelineno-0-2&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;rpc&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;Watch&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;google.protobuf.Empty&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;returns&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;stream&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;WatchInstruction&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;);&lt;/span&gt; &lt;a id=&#34;__codelineno-0-3&#34; name=&#34;__codelineno-0-3&#34; href=&#34;#__codelineno-0-3&#34;&gt;&lt;/a&gt; &lt;a id=&#34;__codelineno-0-4&#34; name=&#34;__codelineno-0-4&#34; href=&#34;#__codelineno-0-4&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;rpc&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;PortForward&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;stream&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;PortForwardData&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;returns&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;stream&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;PortForwardData&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;);&lt;/span&gt; &lt;a id=&#34;__codelineno-0-5&#34; name=&#34;__codelineno-0-5&#34; href=&#34;#__codelineno-0-5&#34;&gt;&lt;/a&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt; &lt;a id=&#34;__codelineno-0-6&#34; name=&#34;__codelineno-0-6&#34; href=&#34;#__codelineno-0-6&#34;&gt;&lt;/a&gt; &lt;a id=&#34;__codelineno-0-7&#34; name=&#34;__codelineno-0-7&#34; href=&#34;#__codelineno-0-7&#34;&gt;&lt;/a&gt;&lt;span class=&#34;kd&#34;&gt;message&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;nc&#34;&gt;WatchInstruction&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;{&lt;/span&gt; &lt;a id=&#34;__codelineno-0-8&#34; name=&#34;__codelineno-0-8&#34; href=&#34;#__codelineno-0-8&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kd&#34;&gt;message&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;nc&#34;&gt;PortForward&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;{&lt;/span&gt; &lt;a id=&#34;__codelineno-0-9&#34; name=&#34;__codelineno-0-9&#34; href=&#34;#__codelineno-0-9&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kt&#34;&gt;string&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;na&#34;&gt;session&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt; &lt;a id=&#34;__codelineno-0-10&#34; name=&#34;__codelineno-0-10&#34; href=&#34;#__codelineno-0-10&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kt&#34;&gt;string&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;na&#34;&gt;vm_uid&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;2&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt; &lt;a id=&#34;__codelineno-0-11&#34; name=&#34;__codelineno-0-11&#34; href=&#34;#__codelineno-0-11&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kt&#34;&gt;uint32&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;na&#34;&gt;vm_port&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;3&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt; &lt;a id=&#34;__codelineno-0-12&#34; name=&#34;__codelineno-0-12&#34; href=&#34;#__codelineno-0-12&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt; &lt;a id=&#34;__codelineno-0-13&#34; name=&#34;__codelineno-0-13&#34; href=&#34;#__codelineno-0-13&#34;&gt;&lt;/a&gt; &lt;a id=&#34;__codelineno-0-14&#34; name=&#34;__codelineno-0-14&#34; href=&#34;#__codelineno-0-14&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;oneof&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;action&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;{&lt;/span&gt; &lt;a id=&#34;__codelineno-0-15&#34; name=&#34;__codelineno-0-15&#34; href=&#34;#__codelineno-0-15&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;PortForward&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;na&#34;&gt;port_forward_action&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt; &lt;a id=&#34;__codelineno-0-16&#34; name=&#34;__codelineno-0-16&#34; href=&#34;#__codelineno-0-16&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt; &lt;a id=&#34;__codelineno-0-17&#34; name=&#34;__codelineno-0-17&#34; href=&#34;#__codelineno-0-17&#34;&gt;&lt;/a&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt; &lt;a id=&#34;__codelineno-0-18&#34; name=&#34;__codelineno-0-18&#34; href=&#34;#__codelineno-0-18&#34;&gt;&lt;/a&gt; &lt;a id=&#34;__codelineno-0-19&#34; name=&#34;__codelineno-0-19&#34; href=&#34;#__codelineno-0-19&#34;&gt;&lt;/a&gt;&lt;span class=&#34;kd&#34;&gt;message&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;nc&#34;&gt;PortForwardData&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;{&lt;/span&gt; &lt;a id=&#34;__codelineno-0-20&#34; name=&#34;__codelineno-0-20&#34; href=&#34;#__codelineno-0-20&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kt&#34;&gt;bytes&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;na&#34;&gt;data&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt; &lt;a id=&#34;__codelineno-0-21&#34; name=&#34;__codelineno-0-21&#34; href=&#34;#__codelineno-0-21&#34;&gt;&lt;/a&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt; &lt;/code&gt;&lt;/pre&gt;&lt;/div&gt; &lt;p&gt;On bootstrap, each Orchard worker establishes a &lt;code&gt;Watch()&lt;/code&gt; RPC stream and waits for the &lt;code&gt;PortForward&lt;/code&gt; instruction from the controller indefinitely. This long-running session might be used not just for port-forwarding, but for notifying the workers about changed resources, which results in workers picking up your VM for execution instantly.&lt;/p&gt; &lt;p&gt;Once &lt;code&gt;PortForward&lt;/code&gt; instruction is received, the worker connects to the specified VM and port locally and opens a new &lt;code&gt;PortForward()&lt;/code&gt; RPC stream with the controller, carrying the unique &lt;code&gt;session&lt;/code&gt; identifier in the gRPC metadata to help distinguish several port forwarding requests.&lt;/p&gt; &lt;p&gt;We’re using a pretty ingenious &lt;a href=&#34;https://github.com/mitchellh/go-grpc-net-conn&#34;&gt;Golang package that turns any gRPC stream into a &lt;code&gt;net.Conn&lt;/code&gt;&lt;/a&gt;. This allows us to abstract from the gRPC details and simply proxy two &lt;code&gt;net.Conns&lt;/code&gt;, thus providing the port forwarding functionality.&lt;/p&gt; &lt;p&gt;We’ve also initially considered using &lt;a href=&#34;https://github.com/hashicorp/yamux&#34;&gt;Yamux&lt;/a&gt; to only keep a single connection with each worker, however, that involves the burden of dealing with flow control and potential implementation bugs associated with it, so we’ve decided to simply open an additional connection for each port forwarding session and let the OS deal with it.&lt;/p&gt; &lt;h2 id=&#34;building-on-top-of-the-port-forwarding&#34;&gt;Building on top of the port-forwarding&lt;a class=&#34;headerlink&#34; href=&#34;#building-on-top-of-the-port-forwarding&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;First of all, we’ve made the new port-forwarding functionality available for integrations via the Orchard’s REST API:&lt;/p&gt; &lt;p&gt;&lt;img alt=&#34;OpenAPI documentation for Orchard&#39;s port-forwarding endpoint&#34; src=&#34;../../../../../assets/images/orchard-port-forwarding-api.png&#34; /&gt;&lt;/p&gt; &lt;p&gt;All you need is to use a WebSocket client when accessing this endpoint to make it work.&lt;/p&gt; &lt;p&gt;Secondly, we’ve exposed three commands in the Orchard CLI that all use this endpoint:&lt;/p&gt; &lt;h3 id=&#34;orchard-port-forward&#34;&gt;&lt;code&gt;orchard port-forward&lt;/code&gt;&lt;a class=&#34;headerlink&#34; href=&#34;#orchard-port-forward&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h3&gt; &lt;p&gt;Opens a TCP port locally and forwards everything sent to it to the specified VM (and vice versa).&lt;/p&gt; &lt;p&gt;For example, &lt;code&gt;orchard port-forward vm sonoma-builder 2222:22&lt;/code&gt; will forward traffic from the local TCP port &lt;code&gt;2222&lt;/code&gt; to the &lt;code&gt;ventura-builder&lt;/code&gt; VM’s TCP port &lt;code&gt;22&lt;/code&gt;.&lt;/p&gt; &lt;h3 id=&#34;orchard-ssh&#34;&gt;&lt;code&gt;orchard ssh&lt;/code&gt;&lt;a class=&#34;headerlink&#34; href=&#34;#orchard-ssh&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h3&gt; &lt;p&gt;Connects to the specified VM on the default SSH port &lt;code&gt;22&lt;/code&gt;, optionally only launching a command (if specified), similarly to what the official OpenSSH client does.&lt;/p&gt; &lt;p&gt;For example, &lt;code&gt;orchard ssh vm sonoma-builder&lt;/code&gt; will open an interactive session with the &lt;code&gt;ventura-builder&lt;/code&gt; VM.&lt;/p&gt; &lt;p&gt;You can also send local scripts for execution by utilizing redirection:&lt;/p&gt; &lt;div class=&#34;highlight&#34;&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;&lt;a id=&#34;__codelineno-1-1&#34; name=&#34;__codelineno-1-1&#34; href=&#34;#__codelineno-1-1&#34;&gt;&lt;/a&gt;orchard&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;ssh&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;vm&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;sonoma-builder&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;sh -s&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&amp;lt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;script.sh &lt;/code&gt;&lt;/pre&gt;&lt;/div&gt; &lt;h3 id=&#34;orchard-vnc&#34;&gt;&lt;code&gt;orchard vnc&lt;/code&gt;&lt;a class=&#34;headerlink&#34; href=&#34;#orchard-vnc&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h3&gt; &lt;p&gt;Establishes a port forwarding to the specified VM’s default VNC port &lt;code&gt;5900&lt;/code&gt; and opens the default macOS Screen Sharing app.&lt;/p&gt; &lt;p&gt;For example, &lt;code&gt;orchard vnc vm sonoma-builder&lt;/code&gt; will establish a port-forwarding to the &lt;code&gt;ventura-builder&lt;/code&gt; VM&#39;s port &lt;code&gt;5900&lt;/code&gt; under the hood and launch macOS Screen Sharing app.&lt;/p&gt; &lt;p&gt;Note that the SSH and VNC commands expect the VM resource to specify credentials in it’s definition (can be done via &lt;code&gt;orchard create vm&lt;/code&gt;), and will otherwise fall back to the credentials specified by &lt;code&gt;--username&lt;/code&gt; and &lt;code&gt;--password&lt;/code&gt;, or if none specified — to de-facto standard of &lt;code&gt;admin:admin&lt;/code&gt; credentials.&lt;/p&gt; &lt;h2 id=&#34;conclusion&#34;&gt;Conclusion&lt;a class=&#34;headerlink&#34; href=&#34;#conclusion&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;Overall, the technology described in this article somewhat resembles what &lt;a href=&#34;https://cirrus-ci.org/blog/2021/08/06/introducing-cirrus-terminal-a-simple-way-to-get-ssh-like-access-to-your-tasks/&#34;&gt;we previously did for Cirrus Terminal&lt;/a&gt;. The only difference is that in Cirrus Terminal we carry terminal-specific characters, and in Orchard — we carry bytes for an arbitrary TCP connection.&lt;/p&gt; &lt;p&gt;We really hope this feature will be useful for many, just as the Cirrus Terminal, and that it will remove the pain of scaling Tart beyond a single machine.&lt;/p&gt; &lt;p&gt;You can give &lt;a href=&#34;https://github.com/cirruslabs/orchard&#34;&gt;Orchard&lt;/a&gt; a try by running it locally in development mode on any Apple Silicon device:&lt;/p&gt; &lt;div class=&#34;highlight&#34;&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;&lt;a id=&#34;__codelineno-2-1&#34; name=&#34;__codelineno-2-1&#34; href=&#34;#__codelineno-2-1&#34;&gt;&lt;/a&gt;brew&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;install&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;cirruslabs/cli/orchard &lt;a id=&#34;__codelineno-2-2&#34; name=&#34;__codelineno-2-2&#34; href=&#34;#__codelineno-2-2&#34;&gt;&lt;/a&gt;orchard&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;dev &lt;/code&gt;&lt;/pre&gt;&lt;/div&gt; &lt;p&gt;This will launch a development cluster with a single worker on your machine. Refer to &lt;a href=&#34;https://github.com/cirruslabs/orchard#creating-virtual-machines&#34;&gt;Orchard documentation&lt;/a&gt; on how to create your first virtual machine and access it.&lt;/p&gt; &lt;p&gt;Stay tuned and don’t hesitate to send us your feedback either &lt;a href=&#34;https://github.com/cirruslabs/orchard&#34;&gt;on GitHub&lt;/a&gt; or &lt;a href=&#34;https://twitter.com/cirrus_labs&#34;&gt;Twitter&lt;/a&gt;!&lt;/p&gt;</description> <link>https://tart.run/blog/2023/04/28/ssh-over-grpc-or-how-orchard-simplifies-accessing-vms-in-private-networks/</link> <pubDate>Mon, 22 Sep 2025 20:02:39 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2023/04/28/ssh-over-grpc-or-how-orchard-simplifies-accessing-vms-in-private-networks/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2023/04/28/ssh-over-grpc-or-how-orchard-simplifies-accessing-vms-in-private-networks.png" type="image/png" length="79111" /> </item> <item> <title>Tart 2.0.0 and community updates</title> <author>Fedor Korotkov</author> <description>&lt;h1 id=&#34;tart-200-and-community-updates&#34;&gt;Tart 2.0.0 and community updates&lt;a class=&#34;headerlink&#34; href=&#34;#tart-200-and-community-updates&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;Today we&#39;d like to share some news and updates around the Tart ecosystem since the Tart 1.0.0 release back in February.&lt;/p&gt; &lt;!-- more --&gt; &lt;h2 id=&#34;community-growth&#34;&gt;Community Growth&lt;a class=&#34;headerlink&#34; href=&#34;#community-growth&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;In the last 7 months Tart community almost tripled and growth is continuing to accelerate. Tart just crossed 25,000 installations, dozens of companies that we know of are using Tart in their daily workflows. If your company is not in the list please consider &lt;a href=&#34;https://github.com/cirruslabs/tart/blob/main/Resources/Users/HowToAddYourself.md&#34;&gt;joining&lt;/a&gt;!&lt;/p&gt; &lt;div class=&#34;grid cards&#34;&gt; &lt;ul&gt; &lt;li&gt;&lt;img alt=&#34;&#34; height=&#34;65&#34; src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/Users/Krisp.png&#34; /&gt;&lt;/li&gt; &lt;li&gt;&lt;img alt=&#34;&#34; height=&#34;65&#34; src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/Users/Mullvad.png&#34; /&gt;&lt;/li&gt; &lt;li&gt;&lt;img alt=&#34;&#34; height=&#34;65&#34; src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/Users/ahrefs.png&#34; /&gt;&lt;/li&gt; &lt;li&gt;&lt;img alt=&#34;&#34; height=&#34;65&#34; src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/Users/Suran.png&#34; /&gt;&lt;/li&gt; &lt;li&gt;&lt;img alt=&#34;&#34; height=&#34;65&#34; src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/Users/Symflower.png&#34; /&gt;&lt;/li&gt; &lt;li&gt;&lt;img alt=&#34;&#34; height=&#34;65&#34; src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/Users/Transloadit.png&#34; /&gt;&lt;/li&gt; &lt;li&gt;&lt;img alt=&#34;&#34; height=&#34;65&#34; src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/Users/PITSGlobalDataRecoveryServices.png&#34; /&gt;&lt;/li&gt; &lt;li&gt;&lt;img alt=&#34;&#34; height=&#34;65&#34; src=&#34;https://github.com/cirruslabs/tart/raw/main/Resources/Users/Uphold.png&#34; /&gt;&lt;/li&gt; &lt;/ul&gt; &lt;/div&gt; &lt;p&gt;We are also very pleased by how the community responded to &lt;a href=&#34;../../../02/11/changing-tart-license/&#34;&gt;the license change&lt;/a&gt;. We now have a number of companies running Tart at scale under the new license. Revenue from the licensing allowed us to allocate time to continue improving Tart which brings us to the section below.&lt;/p&gt; &lt;h2 id=&#34;recent-updates-and-whats-changing-in-tart-200&#34;&gt;Recent updates and what&#39;s changing in Tart 2.0.0&lt;a class=&#34;headerlink&#34; href=&#34;#recent-updates-and-whats-changing-in-tart-200&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;In the last 7 months we&#39;ve had 12 feature releases that brought a lot of features requested by the community. Here are just a few of them to highlight:&lt;/p&gt; &lt;p&gt;-&lt;a href=&#34;../../../../../integrations/gitlab-runner/&#34;&gt;Custom GitLab Runner Executor&lt;/a&gt;. -&lt;a href=&#34;../../../04/25/announcing-orchard-orchestration-for-managing-macos-virtual-machines-at-scale/&#34;&gt;Cluster Management via Orchard&lt;/a&gt;. -Numerous compatibility improvements for all kinds of OCI-registries. -Sonoma Support (see details &lt;a href=&#34;#macos-sonoma-updates&#34;&gt;below&lt;/a&gt;).&lt;/p&gt; &lt;p&gt;But one of the most requested features/complaints was around pulling huge Tart images from remote OCI-compatible registries. With an ideal network conditions &lt;code&gt;tart pull&lt;/code&gt; worked pretty good but in case of any network issues it was required to restart the pull from scratch. Additionally, some registries are notably slow streaming a single blob but can stream multiple blobs in parallel. Finally, the initial format of storing Tart VMs was very naive: disk image is compressed via a single stream which is chunked up into blobs that are serially uploaded to a registry. A single compression stream means that Tart can also only decompress blobs serially.&lt;/p&gt; &lt;p&gt;Given these three observations above we came up with an improved format of storing Tart VM disk images. In Tart 2.0.0 disk images are chunked up first and compressed independently into blobs, when pushed, each blob has attached annotations of expected uncompressed size and a checksum. This way when Tart 2.0.0 is pulling an image pushed by Tart 2.0.0 each blob can be pulled, uncompressed and written at the right offset independently. Having checksums along expected uncompressed blob size also allowed to support resumable pulls. Upon a failure Tart 2.0.0 will compare checksums of chunks and will continue pulling only missing blobs.&lt;/p&gt; &lt;p&gt;Overall in our experiments we saw a 10% improvement in compressed size of the images and &lt;strong&gt;4 times faster pulls&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;In order to try the new image format please upgrade Tart and try to pull any of &lt;a href=&#34;https://github.com/orgs/cirruslabs/packages?tab=packages&amp;amp;q=macos-sonoma&#34;&gt;the Sonoma images&lt;/a&gt;:&lt;/p&gt; &lt;div class=&#34;highlight&#34;&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;&lt;a id=&#34;__codelineno-0-1&#34; name=&#34;__codelineno-0-1&#34; href=&#34;#__codelineno-0-1&#34;&gt;&lt;/a&gt;brew&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;upgrade&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;cirruslabs/cli/tart &lt;a id=&#34;__codelineno-0-2&#34; name=&#34;__codelineno-0-2&#34; href=&#34;#__codelineno-0-2&#34;&gt;&lt;/a&gt;tart&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;pull&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;ghcr.io/cirruslabs/macos-sonoma-base:latest &lt;/code&gt;&lt;/pre&gt;&lt;/div&gt; &lt;h2 id=&#34;macos-sonoma-updates&#34;&gt;macOS Sonoma Updates&lt;a class=&#34;headerlink&#34; href=&#34;#macos-sonoma-updates&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;Tart VMs now can be run in a &#34;suspendable&#34; mode which will enable VM snapshotting instead of the standard shutdown. VMs with an existing snapshot will &lt;code&gt;run&lt;/code&gt; from the same state as they got snapshotted. Please check demo down below:&lt;/p&gt; &lt;div&gt; &lt;blockquote class=&#34;twitter-tweet&#34; data-theme=&#34;dark&#34;&gt; &lt;p lang=&#34;en&#34; dir=&#34;ltr&#34;&gt; Tart 1.8.0 brings macOS Sonoma updates! 🍏 Now you can suspend and resume your virtual machines for even faster startup times. Check out the demo below 👇 &lt;a href=&#34;https://t.co/RoRFT8Nwst&#34;&gt;pic.twitter.com/RoRFT8Nwst&lt;/a&gt; &lt;/p&gt;&amp;mdash; Cirrus Labs (@cirrus_labs) &lt;a href=&#34;https://twitter.com/cirrus_labs/status/1677308360385765382?ref_src=twsrc%5Etfw&#34;&gt;July 7, 2023&lt;/a&gt; &lt;/blockquote&gt; &lt;script src=&#34;https://platform.twitter.com/widgets.js&#34; charset=&#34;utf-8&#34;&gt;&lt;/script&gt; &lt;/div&gt; &lt;p&gt;There are two caveats to the &#34;suspendable&#34; mode support:&lt;/p&gt; &lt;ol&gt; &lt;li&gt;Both host and guest should be running macOS Sonoma.&lt;/li&gt; &lt;li&gt;Snapshots are locally encrypted and can&#39;t be shared between physical hosts. Therefore &lt;code&gt;tart push&lt;/code&gt; won&#39;t push the corresponding snapshotted state of the VM.&lt;/li&gt; &lt;/ol&gt; &lt;p&gt;Try the &#34;suspendable&#34; mode for yourself by passing &lt;code&gt;--suspendable&lt;/code&gt; flag to a &lt;code&gt;tart run&lt;/code&gt; command:&lt;/p&gt; &lt;div class=&#34;highlight&#34;&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;&lt;a id=&#34;__codelineno-1-1&#34; name=&#34;__codelineno-1-1&#34; href=&#34;#__codelineno-1-1&#34;&gt;&lt;/a&gt;tart&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;clone&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;ghcr.io/cirruslabs/macos-sonoma-base:latest&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;sonoma-base &lt;a id=&#34;__codelineno-1-2&#34; name=&#34;__codelineno-1-2&#34; href=&#34;#__codelineno-1-2&#34;&gt;&lt;/a&gt;tart&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;run&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;--suspendable&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;sonoma-base &lt;/code&gt;&lt;/pre&gt;&lt;/div&gt; &lt;h2 id=&#34;conclusion&#34;&gt;Conclusion&lt;a class=&#34;headerlink&#34; href=&#34;#conclusion&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;We are very excited about this major release of Tart. Please give it a try and let us know how it went!&lt;/p&gt; &lt;p&gt;Stay tuned for new updates and announcements! There are a few coming up very shortly...&lt;/p&gt;</description> <link>https://tart.run/blog/2023/09/20/tart-200-and-community-updates/</link> <pubDate>Mon, 22 Sep 2025 20:02:39 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2023/09/20/tart-200-and-community-updates/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2023/09/20/tart-200-and-community-updates.png" type="image/png" length="61095" /> </item> <item> <title>Tart is now available on AWS Marketplace</title> <author>Fedor Korotkov</author> <description>&lt;h1 id=&#34;tart-is-now-available-on-aws-marketplace&#34;&gt;Tart is now available on AWS Marketplace&lt;a class=&#34;headerlink&#34; href=&#34;#tart-is-now-available-on-aws-marketplace&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;Announcing &lt;a href=&#34;https://aws.amazon.com/marketplace/pp/prodview-qczco34wlkdws&#34;&gt;official AMIs for EC2 Mac Instances&lt;/a&gt; with preconfigured Tart installation that is optimized to work within AWS infrastructure.&lt;/p&gt; &lt;p&gt;EC2 Mac Instances is a gem of engineering powered by AWS Nitro devices. Just imagine there is a physical Mac Mini with a plugged in Nitro device that can push the physical power button!&lt;/p&gt; &lt;p&gt;&lt;img alt=&#34;EC2 M2 Pro&#34; src=&#34;../../../../images/ec2-mac2-m2pro.png&#34; /&gt;&lt;/p&gt; &lt;p&gt;This clever synergy between Apple Hardware and Nitro System allows seamless integration with VPC networking and booting macOS from an EBS volume.&lt;/p&gt; &lt;p&gt;In this blog post we’ll see how a virtualization solution like Tart can compliment and elevate experience with EC2 Mac Instances.&lt;/p&gt; &lt;!-- more --&gt; &lt;p&gt;Let’s start from the basics, what EC2 Mac Instances allow to do compared to physical Mac Minis seating in offices of many companies around the world?&lt;/p&gt; &lt;p&gt;First and foremost, EC2 Mac Instances sit inside AWS data centers and can leverage all the goodies of VPC networking within your company&#39;s existing infrastructure. No need to connect your Macs in the office through a VPN and deal with networking and security.&lt;/p&gt; &lt;p&gt;Additionally, EC2 Mac Instances are booting from EBS volumes which means it is possible to always have reproducible instances and apply all the best practices of Infrastructure-as-Code. Managing a fleet of physical Macs is a pain and it&#39;s very hard to make them configured in a reproducible and stable way. With booting from identical EBS volumes your team is always sure about the identical initial state of the fleet.&lt;/p&gt; &lt;h2 id=&#34;compromises-of-ec2-mac-instances&#34;&gt;Compromises of EC2 Mac Instances&lt;a class=&#34;headerlink&#34; href=&#34;#compromises-of-ec2-mac-instances&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;The flexibility of EBS volumes for macOS comes with some compromises that virtualization solutions like Tart can help with. The initial boot from an EBS volume takes some time and not instant. macOS itself is pretty heavy and a Nitro device needs to download tens of gigabytes that macOS requires in order to boot. This means that &lt;strong&gt;resetting a EC2 Mac Instance to a clean state is not instant and usually takes a couple of minutes&lt;/strong&gt; when you can’t utilize the precious resources for your workloads.&lt;/p&gt; &lt;p&gt;It is much easier to tailor such EBS volumes with tools like Packer but there is still a &lt;strong&gt;friction to test newly created EBS volumes&lt;/strong&gt; since one needs to start and run a EC2 Mac Instance and it’s not possible to test things locally. Similarly it is even harder to test beta versions of macOS that require manual interaction with a running instance.&lt;/p&gt; &lt;h2 id=&#34;solution&#34;&gt;Solution&lt;a class=&#34;headerlink&#34; href=&#34;#solution&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;Tart can help with all the compromises! Tart virtual machines (VMs) have nearly native performance thanks to utilizing native &lt;code&gt;Virtualization.Framework&lt;/code&gt; that was developed along the first Apple Silicon chip. &lt;strong&gt;Tart VMs can be copied/disposed instantly and booting a fresh Tart VM takes only several seconds&lt;/strong&gt;. It is also possible to run two different Tart VMs in parallel that can have completely different versions of macOS and packages. For example, it is possible to have the latest stable macOS with the release version of Xcode along with the next version of macOS with the latest beta of Xcode.&lt;/p&gt; &lt;p&gt;Creation of Tart VMs can be automated with &lt;a href=&#34;https://github.com/cirruslabs/packer-plugin-tart&#34;&gt;a Packer plugin&lt;/a&gt; the same way as creation of EC2 AMIs with one caveat that &lt;strong&gt;Tart Packer Plugin works locally so you can test the same virtual machine locally as you would run it in the cloud&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;Lightweight nature of Tart VMs with a focus on an easy-to-integrate Tart CLI compliments any macOS automation and helps to reduce the feedback cycle and improves reproducibility of macOS environments even further.&lt;/p&gt; &lt;h2 id=&#34;conclusion&#34;&gt;Conclusion&lt;a class=&#34;headerlink&#34; href=&#34;#conclusion&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;We are excited to bring &lt;a href=&#34;https://aws.amazon.com/marketplace/pp/prodview-qczco34wlkdws&#34;&gt;official AMIs that include Tart installation optimized to work within AWS&lt;/a&gt;. In the coming weeks when macOS Sonoma will become available on AWS we’ll release another update specifically targeting EC2 Mac Instances. This update will simplify access to local SSDs of Mac Instances that are slightly faster than EBS volumes. Stay tuned and don’t hesitate to ask any &lt;a href=&#34;https://tart.run/licensing/&#34;&gt;questions&lt;/a&gt;.&lt;/p&gt;</description> <link>https://tart.run/blog/2023/10/06/tart-is-now-available-on-aws-marketplace/</link> <pubDate>Mon, 22 Sep 2025 20:02:39 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2023/10/06/tart-is-now-available-on-aws-marketplace/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2023/10/06/tart-is-now-available-on-aws-marketplace.png" type="image/png" length="67557" /> </item> <item> <title>New dashboard with insights into performance of Cirrus Runners</title> <author>Fedor Korotkov</author> <description>&lt;h1 id=&#34;new-dashboard-with-insights-into-performance-of-cirrus-runners&#34;&gt;New dashboard with insights into performance of Cirrus Runners&lt;a class=&#34;headerlink&#34; href=&#34;#new-dashboard-with-insights-into-performance-of-cirrus-runners&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;This month we are celebrating one year since launching Cirrus Runners — managed Apple Silicon infrastructure for your GitHub Actions. During the last 12 months we ran millions of workflows for our customers and now ready to share some insights into price performance of them for our customers.&lt;/p&gt; &lt;p&gt;One of the key difference with Cirrus Runners is how they are getting billed for. Customers purchase Cirrus Runners via monthly subscription that costs $150 per each Cirrus Runner. Each runner can be used 24 hours a day 7 days a week to run GitHub Actions workflows for an organization. If there are more outstanding jobs than available runners then they are queued and executed as soon as there is a free runner. This is different from how GitHub-managed GitHub Actions are billed for — you pay for each minute of execution time.&lt;/p&gt; &lt;p&gt;The benefit of a fixed price is that you can run as many jobs as you want without worrying about the cost. The downside is that you need to make sure that you are using your runners efficiently. This is where the new dashboard comes in handy.&lt;/p&gt; &lt;!-- more --&gt; &lt;p&gt;But first, &lt;strong&gt;let&#39;s see theoretically the lowest price per minute&lt;/strong&gt; of a Cirrus Runners. If you run 24 hours a day 7 days a week then you will get 43,200 minutes of execution time per month. This means that the price per minute is $0.0035 if your runners utilization is 100%. But even if your engineering teams is located in a single time zone and works 8 hours a day 5 days a week then you will get 9,600 minutes of execution time per month which comes down to $0.015 per-minute. This is still more than 10 times cheaper than recently announced Apple Silicon GitHub-manged runners that cost $0.16 per minute.&lt;/p&gt; &lt;p&gt;Now lets take a look at the new Cirrus Runners dashboard of a real customers that run their workflows on Cirrus Runners and &lt;strong&gt;practically pushing the price performance pretty close to the theoretical minimum&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;&lt;img alt=&#34;Cirrus Runners Dashboard&#34; src=&#34;../../../../images/runners-price-performance-2.png&#34; /&gt;&lt;/p&gt; &lt;p&gt;As you can see above Cirrus Runners Dashboard focuses on 4 core metrics:&lt;/p&gt; &lt;ol&gt; &lt;li&gt;&lt;strong&gt;Minutes Used&lt;/strong&gt; — overall amount of minutes that Cirrus Runners were executing jobs.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;Workflow Runs&lt;/strong&gt; — absolute number of workflow runs that were executed on Cirrus Runners.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;Queue Size&lt;/strong&gt; — number of jobs that were queued and waiting for a free Cirrus Runner.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;Queue Time&lt;/strong&gt; — average time that jobs were waiting in the queue.&lt;/li&gt; &lt;/ol&gt; &lt;p&gt;In this particular example price performance of Cirrus Runners is $0.006 per minute which is 2 times more than the theoretical minimum and &lt;strong&gt;26 times better than GitHub-managed Apple Silicon runners&lt;/strong&gt;. But this is a extreme example, looking at queue time and queue size we can see that the downside of such great price performance is that jobs are waiting in the queue on average around 5 minutes.&lt;/p&gt; &lt;p&gt;Here is another example of Cirrus Runners Dashboard for a different customer that has a slightly higher price performance of $0.017 per minute but at the same time doesn&#39;t experience queue time at all. &lt;strong&gt;Note that $0.017 is still 10 times cheaper than GitHub-managed Apple Silicon runners&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;&lt;img alt=&#34;Cirrus Runners Dashboard&#34; src=&#34;../../../../images/runners-price-performance-3.png&#34; /&gt;&lt;/p&gt; &lt;h2 id=&#34;conclusion&#34;&gt;Conclusion&lt;a class=&#34;headerlink&#34; href=&#34;#conclusion&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;Having a fixed price for Cirrus Runners is a great way to save money on your CI/CD infrastructure and just in general have predictable budged. But it requires keeping the balance between price per minute and queue time. Cirrus Runners Dashboard helps you to keep an eye on this balance and make sure that you are getting the most out of your Cirrus Runners.&lt;/p&gt;</description> <link>https://tart.run/blog/2023/11/03/new-dashboard-with-insights-into-performance-of-cirrus-runners/</link> <pubDate>Mon, 22 Sep 2025 20:02:39 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2023/11/03/new-dashboard-with-insights-into-performance-of-cirrus-runners/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2023/11/03/new-dashboard-with-insights-into-performance-of-cirrus-runners.png" type="image/png" length="70247" /> </item> <item> <title>Bridging the gaps with the Tart Guest Agent</title> <author>Nikolay Edigaryev</author> <description>&lt;h1 id=&#34;bridging-the-gaps-with-the-tart-guest-agent&#34;&gt;Bridging the gaps with the Tart Guest Agent&lt;a class=&#34;headerlink&#34; href=&#34;#bridging-the-gaps-with-the-tart-guest-agent&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;We&#39;re introducing a new improvement for the Tart usability experience: a &lt;a href=&#34;https://github.com/cirruslabs/tart-guest-agent&#34;&gt;Tart Guest Agent&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;This agent provides automatic disk resizing, seamless clipboard sharing for macOS guests (a &lt;a href=&#34;https://github.com/cirruslabs/tart/issues/14&#34;&gt;long-awaited&lt;/a&gt; feature), and the ability to run commands, without SSH and networking, using the new &lt;code&gt;tart exec&lt;/code&gt; command.&lt;/p&gt; &lt;p&gt;As of recently, we include this agent in all non-vanilla Cirrus Labs images, so you likely won&#39;t need to do anything to benefit from these usability improvements.&lt;/p&gt; &lt;p&gt;Read on to learn why we chose to implement the agent from scratch in Golang, and which features we plan to add next.&lt;/p&gt; &lt;!-- more --&gt; &lt;h2 id=&#34;existing-solutions&#34;&gt;Existing solutions&lt;a class=&#34;headerlink&#34; href=&#34;#existing-solutions&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;Tart uses the Virtualization.Framework, and the latter implemented a SPICE client some time ago, however, one piece was missing: the agent that runs inside the guest.&lt;/p&gt; &lt;p&gt;The original &lt;a href=&#34;https://gitlab.freedesktop.org/spice/linux/vd_agent&#34;&gt;SPICE &lt;code&gt;vdagent&lt;/code&gt; implementation&lt;/a&gt; only supports Linux. While &lt;a href=&#34;https://github.com/utmapp/vd_agent&#34;&gt;a fork&lt;/a&gt; from the UTM project adds macOS support, the long-term viability of maintaining this fork without upstreaming changes is uncertain.&lt;/p&gt; &lt;p&gt;Moreover, if we were to add some extra functionality (as we did), there would be more than one agent binary to ship and install, which complicates maintenance and makes it harder to explain to users why we need a bunch of agent binaries.&lt;/p&gt; &lt;p&gt;In the end, we decided to go with our own solution, one that would easily accomodate future ideas.&lt;/p&gt; &lt;h2 id=&#34;rolling-our-own-agent&#34;&gt;Rolling our own agent&lt;a class=&#34;headerlink&#34; href=&#34;#rolling-our-own-agent&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;After carefully inspecting the &lt;a href=&#34;https://www.spice-space.org/agent-protocol.html&#34;&gt;&lt;code&gt;vdagent&lt;/code&gt; protocol&lt;/a&gt; we&#39;ve realized that the clipboard sharing is actually a small subset of the whole protocol, making it relatively simple to implement.&lt;/p&gt; &lt;p&gt;Thanks to Golang, we were able to implement the protocol much faster than we could have with a lower-level language like C (with all due respect), which requires manual memory management and complex event loops.&lt;/p&gt; &lt;p&gt;As for the command execution via &lt;code&gt;tart exec&lt;/code&gt;, we&#39;ve decided to go with gRPC with a rather simple protocol:&lt;/p&gt; &lt;p&gt;&lt;img alt=&#34;An visualization of gRPC protocol used by the Tart Guest Agent&#34; src=&#34;../../../../images/tart-guest-agent-grpc-protocol.png&#34; /&gt;&lt;/p&gt; &lt;p&gt;For each &lt;code&gt;tart exec&lt;/code&gt; invocation a new gRPC &lt;code&gt;Exec&lt;/code&gt; bidirectional stream is established with the agent running inside a VM. After the gRPC stream is established, &lt;code&gt;tart exec&lt;/code&gt; sends a command to execute to the guest and streams the I/O. Once the command terminates, &lt;code&gt;tart exec&lt;/code&gt; collects the process exit code and quits with exactly that exit code.&lt;/p&gt; &lt;p&gt;Using gRPC simplifies &lt;code&gt;tart exec&lt;/code&gt; implementation because of code generation and forms a nice bridge between the host and the guest which allows us to easily expand the protocol later down the road when we decide to introduce new features.&lt;/p&gt; &lt;p&gt;Thanks to &lt;a href=&#34;https://github.com/grpc/grpc-swift&#34;&gt;gRPC Swift&lt;/a&gt;, which is built on top of &lt;a href=&#34;https://github.com/apple/swift-nio&#34;&gt;SwiftNIO&lt;/a&gt;, we get &lt;a href=&#34;https://docs.swift.org/swift-book/documentation/the-swift-programming-language/concurrency/&#34;&gt;&lt;code&gt;async/await&lt;/code&gt;&lt;/a&gt; support for free, further simplifying the &lt;code&gt;tart exec&lt;/code&gt; logic.&lt;/p&gt; &lt;p&gt;As for the Tart Guest Agent, the final result is a Golang binary that &lt;a href=&#34;https://github.com/cirruslabs/tart-guest-agent?tab=readme-ov-file#guest-agent-for-tart-vms&#34;&gt;can be customized&lt;/a&gt; depending on the execution context:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;launchd global daemon — runs as a privileged user (&lt;code&gt;root&lt;/code&gt;), has no clipboard access&lt;ul&gt; &lt;li&gt;&lt;code&gt;--resize-disk&lt;/code&gt; — resizes the disk when there&#39;s a free space at the end of a disk (assuming that one previously ran &lt;code&gt;tart set --disk-size&lt;/code&gt;)&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;li&gt;launchd global agent — runs as a normal user (&lt;code&gt;admin&lt;/code&gt;), has clipboard access&lt;ul&gt; &lt;li&gt;&lt;code&gt;--run-vdagent&lt;/code&gt; — clipboard sharing&lt;/li&gt; &lt;li&gt;&lt;code&gt;--run-rpc&lt;/code&gt; — &lt;code&gt;tart exec&lt;/code&gt; and new functionality in the future&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;/ul&gt; &lt;p&gt;We’ve also introduced &lt;code&gt;--run-daemon&lt;/code&gt; (which implies &lt;code&gt;--resize-disk&lt;/code&gt;) and &lt;code&gt;--run-agent&lt;/code&gt; (which implies both &lt;code&gt;--run-vdagent&lt;/code&gt; and &lt;code&gt;--run-rpc&lt;/code&gt;) to help run the most appropriate functionality based on the given context.&lt;/p&gt; &lt;h2 id=&#34;future-plans&#34;&gt;Future plans&lt;a class=&#34;headerlink&#34; href=&#34;#future-plans&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;First, we&#39;d like to thank our paid clients, without whom this feature wouldn&#39;t have been possible.&lt;/p&gt; &lt;p&gt;&lt;a href=&#34;../../../../../licensing/&#34;&gt;Become one now&lt;/a&gt; and enjoy higher allowances for Tart VMs and Orchard workers—while helping ensure that our roadmap aligns with your company&#39;s needs.&lt;/p&gt; &lt;p&gt;In the near future we plan to implement:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Linux support — to provide seamless experience for Linux guests too&lt;/li&gt; &lt;li&gt;a new &lt;code&gt;tart ip&lt;/code&gt; resolver — to provide a more robust IP retrieval facility for Linux guests, which often struggle to populate the host&#39;s ARP table with their network activity&lt;/li&gt; &lt;li&gt;&lt;code&gt;tart cp&lt;/code&gt; command — to copy files from/to guest VMs&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Stay tuned, and feel free to send us feedback on &lt;a href=&#34;https://github.com/cirruslabs/tart&#34;&gt;GitHub&lt;/a&gt; and &lt;a href=&#34;https://x.com/cirrus_labs&#34;&gt;Twitter&lt;/a&gt;!&lt;/p&gt;</description> <link>https://tart.run/blog/2025/06/01/bridging-the-gaps-with-the-tart-guest-agent/</link> <pubDate>Sun, 01 Jun 2025 23:54:45 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2025/06/01/bridging-the-gaps-with-the-tart-guest-agent/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2025/06/01/bridging-the-gaps-with-the-tart-guest-agent.png" type="image/png" length="66038" /> </item> <item> <title>Jumping through the hoops: SSH jump host functionality in Orchard</title> <author>Nikolay Edigaryev</author> <description>&lt;h1 id=&#34;jumping-through-the-hoops-ssh-jump-host-functionality-in-orchard&#34;&gt;Jumping through the hoops: SSH jump host functionality in Orchard&lt;a class=&#34;headerlink&#34; href=&#34;#jumping-through-the-hoops-ssh-jump-host-functionality-in-orchard&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h1&gt; &lt;p&gt;Almost a year ago, when we started building &lt;a href=&#34;https://github.com/cirruslabs/orchard&#34;&gt;Orchard&lt;/a&gt;, an orchestration system for Tart, we quickly realized that most worker machines will be in a private network, and that VMs will be only reachable from the worker machines themselves. Thus, one of our goals became to simplify accessing the compute resources in a cluster through a centralized controller host.&lt;/p&gt; &lt;p&gt;This effort resulted in commands like &lt;code&gt;orchard port-forward&lt;/code&gt; and &lt;code&gt;orchard ssh&lt;/code&gt;, which were later improved to support connecting not just to the VMs, but to the worker machines themselves.&lt;/p&gt; &lt;p&gt;Today, we’re making an even further step in this effort: with a trivial configuration, an Orchard controller can act as an SSH jump host to allow connecting to the VMs using just the &lt;code&gt;ssh&lt;/code&gt; command like &lt;code&gt;ssh -J &amp;lt;service account name&amp;gt;@orchard-controller.example.com &amp;lt;VM name&amp;gt;&lt;/code&gt;!&lt;/p&gt; &lt;!-- more --&gt; &lt;h2 id=&#34;implementation&#34;&gt;Implementation&lt;a class=&#34;headerlink&#34; href=&#34;#implementation&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;In a typical cluster there’s one controller, to which workers connect by calling various REST API endpoints to synchronize the worker &amp;amp; VMs state. Each worker also maintains a persistent bi-directional gRPC connection with the controller, with the goal of improving the overall reactivity and making the port-forwarding work.&lt;/p&gt; &lt;p&gt;The gRPC service definition that the controller offers is pretty minimalistic:&lt;/p&gt; &lt;div class=&#34;highlight&#34;&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;&lt;a id=&#34;__codelineno-0-1&#34; name=&#34;__codelineno-0-1&#34; href=&#34;#__codelineno-0-1&#34;&gt;&lt;/a&gt;&lt;span class=&#34;kd&#34;&gt;service&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;Controller&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;{&lt;/span&gt; &lt;a id=&#34;__codelineno-0-2&#34; name=&#34;__codelineno-0-2&#34; href=&#34;#__codelineno-0-2&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;rpc&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;Watch&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;google.protobuf.Empty&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;returns&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;stream&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;WatchInstruction&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;);&lt;/span&gt; &lt;a id=&#34;__codelineno-0-3&#34; name=&#34;__codelineno-0-3&#34; href=&#34;#__codelineno-0-3&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;rpc&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;PortForward&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;stream&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;PortForwardData&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;k&#34;&gt;returns&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;stream&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;PortForwardData&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;);&lt;/span&gt; &lt;a id=&#34;__codelineno-0-4&#34; name=&#34;__codelineno-0-4&#34; href=&#34;#__codelineno-0-4&#34;&gt;&lt;/a&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt; &lt;/code&gt;&lt;/pre&gt;&lt;/div&gt; &lt;p&gt;Each watch instruction corresponds a single action to be done by the worker, which can either be a request for establishing a port-forwarding stream or a request for VMs re-syncing:&lt;/p&gt; &lt;div class=&#34;highlight&#34;&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;&lt;a id=&#34;__codelineno-1-1&#34; name=&#34;__codelineno-1-1&#34; href=&#34;#__codelineno-1-1&#34;&gt;&lt;/a&gt;&lt;span class=&#34;k&#34;&gt;oneof&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;action&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;{&lt;/span&gt; &lt;a id=&#34;__codelineno-1-2&#34; name=&#34;__codelineno-1-2&#34; href=&#34;#__codelineno-1-2&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;PortForward&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;na&#34;&gt;port_forward_action&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt; &lt;a id=&#34;__codelineno-1-3&#34; name=&#34;__codelineno-1-3&#34; href=&#34;#__codelineno-1-3&#34;&gt;&lt;/a&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;n&#34;&gt;SyncVMs&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;na&#34;&gt;sync_vms_action&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;2&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt; &lt;a id=&#34;__codelineno-1-4&#34; name=&#34;__codelineno-1-4&#34; href=&#34;#__codelineno-1-4&#34;&gt;&lt;/a&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt; &lt;/code&gt;&lt;/pre&gt;&lt;/div&gt; &lt;p&gt;Now, when the user invokes &lt;code&gt;orchard port-forward&lt;/code&gt; or &lt;code&gt;orchard ssh&lt;/code&gt;, controller effectively becomes a rendezvous point by accepting the WebSocket connection from the user, and then asking the worker associated with the requested VM to establish a port-forwarding stream, and finally proxying the two streams together.&lt;/p&gt; &lt;p&gt;&lt;img alt=&#34;An illustration showing the Orchard controller and worker proxying the SSH connection&#34; src=&#34;../../../../images/jumping-through-the-hoops.png&#34; /&gt;&lt;/p&gt; &lt;p&gt;SSH protocol works the same way, multiplexing multiple channels in a single transport connection, where each channel can be upgraded either to an interactive session (that’s what you get when you &lt;code&gt;ssh&lt;/code&gt; to the server) or X11 channel (for X11 forwarding using &lt;code&gt;-X&lt;/code&gt;), direct or forward TCP/IP channels (these are used for local and remote port-forwarding when using &lt;code&gt;-L&lt;/code&gt; and &lt;code&gt;-R&lt;/code&gt; options correspondingly) and so on.&lt;/p&gt; &lt;p&gt;In fact, &lt;code&gt;ssh -J&lt;/code&gt; jump host functionality also uses the direct TCP/IP channel, which is &lt;a href=&#34;https://datatracker.ietf.org/doc/html/rfc4254#section-7.2&#34;&gt;just a single port-forwarding request&lt;/a&gt; that needs to be implemented. We’ve used &lt;a href=&#34;https://pkg.go.dev/golang.org/x/crypto/ssh&#34;&gt;Golang&#39;s SSH library&lt;/a&gt; as the most mature choice for this task, and it’s been pleasant to work with so far.&lt;/p&gt; &lt;p&gt;The support for &lt;code&gt;ssh -J&lt;/code&gt; has landed in Orchard version 0.19.0. To configure the SSH jump host, simply add the &lt;code&gt;--listen-ssh&lt;/code&gt; command-line argument to your &lt;code&gt;orchard controller run&lt;/code&gt; invocation.&lt;/p&gt; &lt;p&gt;Once running, you can connect to any VM in the cluster using the &lt;code&gt;ssh -J &amp;lt;service account name&amp;gt;@orchard-controller.example.com &amp;lt;VM name&amp;gt;&lt;/code&gt;. The password for the jump host is the corresponding service account’s token.&lt;/p&gt; &lt;h2 id=&#34;future-plans&#34;&gt;Future plans&lt;a class=&#34;headerlink&#34; href=&#34;#future-plans&#34; title=&#34;Permanent link&#34;&gt;&amp;para;&lt;/a&gt;&lt;/h2&gt; &lt;p&gt;First of all, we’d like to thank our paid clients, without which this feature wouldn’t be possible. &lt;a href=&#34;../../../../../licensing/&#34;&gt;Become one now&lt;/a&gt; and get the benefit of higher Tart VMs and Orchard workers allowances and making sure that the roadmap for Tart and Orchard is aligned with your company&#39;s needs.&lt;/p&gt; &lt;p&gt;In the near future we plan to implement a mechanism similar to &lt;code&gt;authorized_keys&lt;/code&gt; file that will allow attaching public SSH keys to the Orchard controller’s service accounts, and thus avoid the need to type the passwords.&lt;/p&gt; &lt;p&gt;Stay tuned and don’t hesitate to send us your feedback on &lt;a href=&#34;https://github.com/cirruslabs/orchard&#34;&gt;GitHub&lt;/a&gt; and &lt;a href=&#34;https://x.com/cirrus_labs&#34;&gt;Twitter&lt;/a&gt;!&lt;/p&gt;</description> <link>https://tart.run/blog/2024/06/20/jumping-through-the-hoops-ssh-jump-host-functionality-in-orchard/</link> <pubDate>Thu, 20 Jun 2024 22:39:41 +0000</pubDate> <source url="https://tart.run/feed_rss_updated.xml">Tart Virtualization</source><guid isPermaLink="true">https://tart.run/blog/2024/06/20/jumping-through-the-hoops-ssh-jump-host-functionality-in-orchard/</guid> <enclosure url="https://tart.run/assets/images/social/blog/2024/06/20/jumping-through-the-hoops-ssh-jump-host-functionality-in-orchard.png" type="image/png" length="70009" /> </item> </channel> </rss>
Reference in New Issue View Git Blame Copy Permalink