Install:

brew install cirruslabs/cli/tart

Verify:

tart --version

Useful Concepts

Tart is essentially:

Docker-like image management for VMs
Built on Apple's Virtualization.framework
Supports macOS and Linux guests
Stores VMs under ~/.tart
Supports OCI registries (GHCR, etc.)
Fast cloning makes VM "snapshots" mostly unnecessary

Mostly used commands

tart list

tart clone clean-base <name>

tart run <name>

tart ip <name>

ssh admin@$(tart ip <name>)

tart stop <name>

tart delete <name>

tart export <name> <name>.tvm

tart prune

Common VM Images

macOS

ghcr.io/cirruslabs/macos-golden-gate-base:latest
ghcr.io/cirruslabs/macos-tahoe-base:latest

Downloading Images

Clone from Registry

tart clone ghcr.io/cirruslabs/macos-golden-gate-base:latest <name>

Pull Only

tart pull ghcr.io/cirruslabs/macos-golden-gate-base:latest

VM Lifecycle

Start

tart run <name>

Headless

tart run --no-graphics <name>

Stop

tart stop <name>

Suspend

tart suspend <name>

Resume

tart run <name>

Listing and Inspecting VMs

List Local VMs

tart list

Get VM Details

tart get <name>

Get IP Address

tart ip <name>

SSH Access

Official images:

Username: admin
Password: admin

Connect:

ssh admin@$(tart ip <name>)

Creating VMs

Create New macOS VM

Latest IPSW:

tart create --from-ipsw latest mymac

Specific IPSW:

tart create \
  --from-ipsw ~/Downloads/Restore.ipsw \
  mymac

Modifying VM Configuration

Increase Disk Size

tart set <name> --disk-size 100

Set RAM

tart set <name> --memory 16384

Set CPU Count

tart set <name> --cpu 8

Change Display Resolution

tart set <name> --display 2560x1440

Sharing Folders Between Host and VM

Mount Host Directory

Host:

~/Projects/Investigation

Guest:

/Volumes/My Shared Files/Investigation

Run VM:

tart run \
  --dir Investigation:~/Projects/Investigation \
  <name>

Multiple Shared Directories

tart run \
  --dir Cases:~/Cases \
  --dir Malware:~/Malware \
  --dir Tools:~/DFIR \
  <name>

Snapshots and Reverting

Important

Tart does NOT provide traditional VMware/VirtualBox snapshots.

Instead use:

Golden Image
        ↓
Clone
        ↓
Work
        ↓
Delete

Create Golden Image

tart clone golden-gate clean-base

Create Analysis VM

tart clone clean-base <name>-001

Run:

tart run <name>-001

Revert VM

Delete:

tart delete <name>-001

Create fresh clone:

tart clone clean-base <name>-001

Create Point-In-Time Snapshot

After software installation/tweaks:

tart clone <name>-001 <name>-001-post-install

Roll back at any time:

tart delete <name>-001
tart clone <name>-001-post-install <name>-001

Backup and Restore

Export VM

tart export golden-gate golden-gate.tvm

Import VM

tart import golden-gate.tvm

OCI Registry Workflow

Login

tart login ghcr.io

Push

tart push golden-gate ghcr.io/<user>/golden-gate:latest

Pull

tart pull ghcr.io/<user>/golden-gate:latest

Clone Directly

tart clone \
  ghcr.io/<user>/golden-gate:latest \
  golden-gate

Useful Storage Locations

VM Storage

~/.tart/vms

OCI Cache

~/.tart/cache

Disk Usage

du -sh ~/.tart

Cleanup

Remove Unused Data

tart prune

Delete VM

tart delete <name>

Delete Multiple VMs

tart list | grep <name>

tart delete <name>-001
tart delete <name>-002
tart delete <name>-003

unrooted/TartVM.md