How to grant tart-guest-agent access to network volumes (--dir) in a CI environment?

[DominikMoreira]

Hello Tart Team,

I am running into a security prompt within a macOS guest VM that is blocking my CI/CD pipeline, and I'm looking for the recommended way to resolve it.

Goal:
I want to execute a shell script located in a shared directory from my host via tart exec in a fully automated (non-interactive) Jenkins environment.

Setup:

1. Command to start VM: I start the VM with a shared directory using --dir:

   tart run my-vm-image --dir=/path/on/host/to/workspace:tag=build

2. Mount sources in VM: I then mount the volume via mount_virtiofs:

   mount_virtiofs sources ~/build

3. Command to execute script: Inside my Jenkins pipeline, I run:

   tart exec my-vm-image zsh -c '/Users/Name/build/conanbuild.sh'

Problem:
When tart exec runs the command, the tart-guest-agent inside the guest triggers a macOS security prompt, which hangs the build:

"tart-guest-agent" would like to access files on a network volume.

What I've Tried (Without Success):

1. Started the VM interactively.
2. Given Full Disk Access to tart-guest-agent.
3. Also given Full Disk Access to /bin/zsh for good measure.

My Question:
Is there a way, to non-interactively grant the tart-guest-agent permission to access network volumes (specifically, the --dir shared folders) or missed I something when creating the image?

[edigaryev]

Which VM image are you using?

I've tried to reproduce this on ghcr.io/cirruslabs/macos-tahoe-base:latest to no avail.

Terminal #1:

% mkdir ~/build
% echo '#!/bin/zsh\n\necho "Hello, World!"\n' > ~/build/conanbuild.sh
% tart clone ghcr.io/cirruslabs/macos-tahoe-base:latest macos 
% tart run --dir ~/build:tag=build macos

Terminal #2:

% tart exec -it macos zsh -c 'mkdir ~/build'
% tart exec -it macos zsh -c '/sbin/mount_virtiofs build ~/build'
% tart exec -it macos zsh '/Users/admin/build/conanbuild.sh'
Hello, World!

[DominikMoreira]

I'm using a self-created image based on macOS Sequoia 15.5. I am using Packer to create the image, and I install the agent using the provisioner script from the official macos-image-templates repository. I install the tart-guest-agent with the plist file from here: https://github.com/cirruslabs/macos-image-templates/blob/main/data/tart-guest-agent.plist. Here is the relevant part of my Packer configuration:

  provisioner "file" {
    source      = "data/tart-guest-agent.plist"
    destination = "~/tart-guest-agent.plist"
  }
 
  provisioner "shell" {
    inline = [
      # Install Tart Guest Agent
      "source ~/.zshrc",
      "brew install cirruslabs/cli/tart-guest-agent",
      
      # Install agent variant of the Tart Guest Agent
      "sudo mv ~/tart-guest-agent.plist /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
      "sudo chown root:wheel /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
      "sudo chmod 0644 /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
    ]
  }

When I then follow your reproduction steps, the process hangs. Specifically, this command triggers the prompt:

# This command hangs and causes the "access files on a network volume" prompt
tart exec -it my-vm-name zsh '/Users/admin/build/conanbuild.sh'

[edigaryev]

Can you try with the ghcr.io/cirruslabs/macos-tahoe-base:latest image instead?

[DominikMoreira]

Hi @edigaryev, sorry for the late reply. I just tested it again and wasn’t able to reproduce the issue with ghcr.io/cirruslabs/macos-tahoe-base:latest, the security prompt no longer appears.

I’m guessing I must have missed some configuration earlier. Do you have any idea what I might have done wrong?

[edigaryev]

ghcr.io/cirruslabs/macos-tahoe-base:latest is based onvanilla-tahoe.pkr.hcl, with the following templates applied on top of it:

• base.pkr.hcl
• disable-sip.pkr.hcl

Here are the relevant steps in base.pkr.hcl that install the Tart Guest Agent.

It's hard for me to tell what was done differently without seeing your templates, but you can compare and try modifying/re-building them and spot the difference this way.

[DominikMoreira]

Interesting, I had overlooked the disable-sip.pkr.hcl configuration. With that included, everything works as expected. Thanks for the support!