Another, probably atypical use case: running of apps in a collection of linux vms make with packer and controlled with ansible. you could call this "reasonable" security or paranoia. os x does not have adequate app/gui isolation with virtualization, but it does protect the virtual machines. within the VMs, im using firejail with xpra for the rest of the app and gui isolation. the main reason im not running qubes-os is the lack of nested virtualization. nesting, and performance are why im not running virtualbox, despite virtualboxes advantages in scriptability. the reason im not running linux as the host os is the need to support and work with mac users.
one of these VMs runs keepassx. i use it for passwords for other VMs. the vnc server is open to the world (by default), with only a tiny password to protect it! the rest of the world calls this a vulnerability. how long does it take an old laptop to brute force 8 characters? so instead im using a script with ssh and xdotool to auto type between VMs. this is silly, and only works with linux, only with an ssh server running, and will stop working when wayland takes over. please use unix domain sockets that are writable to only by the user running that vmware instance. or, better, make something like "vboxmanage controlvm" for vmrun.
speaking of the vnc server, i shouldn't have had to read the source code to packer to find out you can restrict vnc to localhost with a flag in the .vmx file. but, that still doesn't protect it from other users on the mac. why do you hide documentation like that? if you dont want us scripting vmware, just tell us and ill stop :smileysilly:
also on scripting, ever use vagrant with the vmware plugin? it nags you while you run it. i think some more effort to documenting (or providing for) automation would help this. instead, i do all my vagrant runs with virtualbox. it may be slower, but i can type vagrant up, and walk away knowing that some stupid nag isnt going to interrupt it.
one of the VMs is a malicious device canary. something i think all mac users should have. currently, it only works for usb devices, but it works well. i keep it updated and snapshotted, and revert to snapshot after every use. but, to properly fill this role, it would need a proper usb filter, and if possible, iommu (vt-d) support (can that work through end points of a bus?) also, being able to mask or pass through other ports, such as thunderbolt, would be good here.
i noticed the ability to change how much ram a running VM has doesnt exist for any hypervisor on os x. is that just not possible? something to bug apple about?
between virtualboxes usb filter, which i recently found out about, and vboxmanage controlvm, ill probably switch to virtualbox for windows and osx guests, and stick with vmware for linux where performance and nesting are needed.
playing video games in fusion is obviously safer than on the host. my windows vm has a tree of snapshots for different purposes, this being one. good job making that feasible. any plans to integrate intels work on xengt, or nvidia grid to desktop virtualization?
heres a funny idea. why not just port workstation to os x? it feels like mac users get a cut down version of whats available for linux and windows.
lately, mostly because of the scripting limitations, ive been seriously concidering dual booting my mac to linux and just keeping the os x partition for os x stuff.
