feat: add VZVmnetNetworkDeviceAttachment support on macOS 26+
#4394
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This comment was marked as outdated.
This comment was marked as outdated.
AkihiroSuda
reviewed
Nov 22, 2025
Member
Any advantage using them? |
Contributor
Author
As far as the API is concerned, customization that is not supported by vzNAT should be possible. |
norio-nomura
force-pushed
the
use-vz-vmnet-network-device-attachment
branch
from
07eebec to
270556e
Compare
This comment was marked as outdated.
This comment was marked as outdated.
norio-nomura
force-pushed
the
use-vz-vmnet-network-device-attachment
branch
2 times, most recently
from
81d4cc6 to
57553f8
Compare
norio-nomura
force-pushed
the
use-vz-vmnet-network-device-attachment
branch
4 times, most recently
from
433432d to
adf5456
Compare
This comment was marked as resolved.
This comment was marked as resolved.
norio-nomura
force-pushed
the
use-vz-vmnet-network-device-attachment
branch
from
adf5456 to
aa15ed7
Compare
Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]>
norio-nomura
force-pushed
the
use-vz-vmnet-network-device-attachment
branch
7 times, most recently
from
d560fae to
4cd78ff
Compare
It provides `VmnetNetwork` serialization to VMs.
`limactl vz-vmnet` takes flags:
- `--unregister-mach-service`: unregister Mach service from `launchd`
- There is no need to register manually because the VZ driver registers as appropriate.
- `--mach-service=<service name>`: launched as Mach server by `launchd` via `io.lima-vm.vz.vmnet.plist`
- Launched on demand to connection from VZ driver by `launchd`.
- Receives a request payload from VZ driver with fields:
- `Network`: name of the network ("shared", "host", etc)
- `Configuration`: `[]bytes@ representing `VzNetworkConfig` in JSON.
- Validates clients are the same executable (cdhash) by using xpc_peer_requirement API.
- Create `VmnetNetwork` from provided `Configuration` if cached one does not exist.
- Replies to VZ driver with fields:
- `Configuration`: If `VmnetNetwork` is cached, it may be created by different configuration.
- `Serialization`: newly created or cached.
- Monitors changes of networks
- When the interface created by `VmnetNetwork` disappears from host, remove them from cache.
- If all `VmnetNetwork` are removed, `limactl vz-vmnet` exits.
VZ driver (hostagent) does:
- Read `.vz` VzVmnetConfig from `networks.yaml`
- Use them on `- vz: <network>` fields; "shared" and "host" network are predefined.
- Register `limactl vz-vmnet` to `launchd` if not registered.
- Request serialization to the Mach service "io.lima-vm.vz.vmnet".
- Create `VmnetNetwork` by provided serialization, then use them.
Additional changes:
- Because shutdown takes longer on using `VmnetNetwork`:
- Extend VZ driver's shutdown timeout from 5 seconds to 15 seconds
- Add `ExitTimeOut` key with 20 seconds to autostart `io.lima-vm.autostart.INSTANCE.plist`
- `lima.yaml`: `- vzShared` and `- vzHost` are renamed to `- vz: shared` and `- vz: host`
Signed-off-by: Norio Nomura <[email protected]>
norio-nomura
force-pushed
the
use-vz-vmnet-network-device-attachment
branch
from
4cd78ff to
8cc5f26
Compare
Contributor
Author
|
Updated PR description. |
Contributor
Author
|
Most of the functions I wanted at the start of this PR have been realized. |
AkihiroSuda
reviewed
Dec 17, 2025
| sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect | ||
| ) | ||
|
|
||
| replace github.com/Code-Hex/vz/v3 => github.com/norio-nomura/vz/v3 v3.7.2-0.20251217001012-3b512d7782b0 |
Member
There was a problem hiding this comment.
Let's keep this PR draft until the Code-Hex/vz PR gets merged and released
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
VZVmnetNetworkDeviceAttachmentsupport on macOS 26+Depends on Code-Hex/vz#205
About what can be done and the restrictions with this API:
vmnetwithout root privilegeVMNET_SHARED_MODE, andVMNET_HOST_MODEvzNAT, the "bridge10x" interface is created on the hostVMNET_BRIDGED_MODEvmnet_network_refwith multiple processes, it must be the same executable file.VZVmnetNetworkDeviceAttachmentinstead ofvmnet_network_create.CDHashis probably used to determine "same executable file". TN3126: Inside Code Signing: Hashescodesignwith "Developer ID", where the hash of the executable file changes, does not interfere with the sharing ofvmnet_network_ref.CDHashdoes not change before and after redoingcodesignwith "Developer ID".codesignusing the same "Developer ID", ifCDHashis changed due to source code changes, etc.,vmnet_network_refcannot be shared.vmnet_network_refis owned by the process that createdvmnet_network_ref, not the process that started the network based on the sharedvmnet_network_ref.vmnet_network_refis done in the form ofxpc_object_t.xpc_object_toutside the XPC API, but to avoid relying on private information, use the XPC API for sharing.This PR allows
VMNET_SHARED_MODEandVMNET_HOST_MODEto be used under these conditions.Functions to be added
networks.yamllima.yamllimactl vz-vmnet- vz: *is started, so only unregistering is visible from the user.launchdas appropriate at the request of the VZ driver.CDHashas itself. It uses xpc_peer_requirement.vmnet_network_refand provides serialization data to VZ driver.vmnet_network_ref.vmnet_network_refto be retained is gone, the Mach service process will terminate.Additional changes
VmnetNetwork:ExitTimeOutkey with 20 seconds to autostartio.lima-vm.autostart.INSTANCE.plistBenchmark:
iperf3between VMs on the same networkMacBook Pro 14 inch, 2023
CPU: Apple M2 Pro
Memory: 16GB
macOS Tahoe 26.2
socket_vmnet
vz: shared