Support for VZFileHandleNetworkDeviceAttachment & VZVmnetNetworkDeviceAttachment

[ctison]

It would be awesome to support:

• VZVmnetNetworkDeviceAttachment (macOS 26.0+)
• VZFileHandleNetworkDeviceAttachment (macOS 11.0+)

Supporting these would enable advanced network architectures, such as running a Linux routing VM with:

• A VZFileHandleNetworkDeviceAttachment, allowing packets to be read and written from the host, and routed through a VPN. This is especially useful when LAN connections are blocked (Docker Desktop uses a similar approach with VPNKit¹).
• A VZVmnetNetworkDeviceAttachment, which can also be mounted on other VMs to allow them to access the internet via the Linux routing VM.

This would enable cleaner solutions compared to existing workarounds:

• https://amodm.com/blog/2024/07/03/running-a-linux-router-on-macos

Note: #7380 did some work for VZVmnetNetworkDeviceAttachment.

Footnotes

1. https://docs.docker.com/desktop/features/networking/#vpn-passthrough ↩

[nirs]

For VZVmnetNetworkDeviceAttachment (macOS 26.0+) we can integrate with vmnet-broker.

How it works:

• User select vment shared network or vment host network
• VM launcher acquire a network from the broker via VmnetBroker Swift library and create a vment_network_create_with_serialization
• The network will be available while the VM launcher process is running
• No additional code is needed, the broker manage network lifetime.
• example: https://github.com/nirs/vmnet-broker/blob/e536fe3f391c3aa53cd0a1382badad74b3e2b5c7/swift/Sources/test/main.swift#L230

Note: the broker is not released yet.

For VZFileHandleNetworkDeviceAttachment (macOS 11.0+) we can integrate with vmnet-helper.

How it works:

• User select vment shared network or vment host network
• The VM launcher process creates a socketpair:
  • one end is passed to VZVmnetNetworkDeviceAttachment
  • other end is passed to vmnet-helper child process
  • the helper starts the vmnet interface and forwards packets between vmnet and the file descriptor
• When the VM is stopped, terminate the vmnet-helper process
• Require
  • sudo configuration or com.apple.vm.networking entitlement on macOS 15 or earlier
  • com.apple.security.virtualization entitlement on macOS 26 or later
• works also for QEMU via -netdev digram: https://github.com/nirs/vmnet-helper/blob/b76a29eb542d3ce4df18c4ebef6b1498174a02e5/example#L179
• example: https://github.com/nirs/vmnet-helper/blob/b76a29eb542d3ce4df18c4ebef6b1498174a02e5/example#L179