I made Virby, a Nix-darwin module for configuring a fast and secure vfkit-based VM for building linux packages on macOS. The main advantages it has over the standard `linux-builder` darwin module are:
1. Improved Performance: using vfkit, the VM can boot from a cold start at around 7 seconds, compared to the ~16 seconds it takes linux-builder, which uses QEMU. Build times for the `nixpkgs#hello` derivation take Virby ~8 seconds, but I have yet to benchmark linux-builder's performance on this.
2. Improved Security: the VM configures (by default) a `builder` user accound with minimal permissions (non-root, service account). The SSH keys are generated at runtime (no publicly known host key) and does not accept remote connections, as it binds to the host's loopback interface (127.0.0.1).
The nix-darwin module provides options to configure the VM/service, including:
- memory
- cpu cores
- host port
- disk size
- rosetta support: enable rosetta in the VM, allowing x86_64-linux builds
- on-demand mode: launchd listens on the host port for incoming SSH connections, and when one is received, the vm-runner application boots the VM and proxies the SSH connection. After a configurable period of idle time, the VM shuts down.
- debug logging: enable debug logging for the daemon and VM processes.
