macOS Best Effort

macOS Best Effort

WorkerBee is developed primarily for Linux local container workflows. macOS can run the normal Podman or Docker-backed app validation path, but direct containerd profile work is Linux-focused.

Recommended Scope

Supported best-effort macOS workflows:

• Source install with Python 3.11 or newer.
• Docker Desktop or Podman machine runtime.
• WorkerBee MCP on loopback.
• Local HTTPS ingress on *.workerbee.localhost.
• CA export and user trust install through the macOS security command.

Not recommended on macOS:

• Direct containerd k1s profiles.
• Host-network container assumptions.
• LAN DNS port 53 binding without extra OS setup.

Source Install

With Homebrew:

brew install python@3.11 git curl jq openssl
python3.11 -m venv .venv
. .venv/bin/activate
python -m pip install -U pip
python -m pip install -e ".[dev]"
workerbee doctor

With Nix:

nix develop
python -m pip install -e ".[dev]"
workerbee doctor

Runtime

Use Docker Desktop or Podman machine. Confirm the runtime before starting MCP:

docker info
# or
podman info
workerbee doctor

If Podman machine networking behaves differently from Linux host networking, prefer Docker Desktop for first validation.

CA Trust

Export the CA:

workerbee ingress ca --output workerbee-ca.crt

Install into the user's login keychain:

workerbee trust install --target system

WorkerBee's macOS trust support uses the platform security command. If your organization manages certificates through MDM, follow local policy and use the exported CA file.

LAN Testing

LAN ingress can work when the runtime publishes ports to the macOS host:

workerbee mcp restart --ingress-exposure lan
workerbee mcp status

WorkerBee DNS forwarding is best effort on macOS. Many real devices require DNS port 53, which may conflict with system services or require elevated configuration. If DNS forwarding is unreliable, use the sslip.io domain that WorkerBee prints in LAN mode or configure DNS on a router or local resolver for the test window.