From abce04d6fe0ea170330e0661227479fe9179ca4a Mon Sep 17 00:00:00 2001
From: sickcodes <info@sick.codes>
Date: Sat, 27 Nov 2021 18:39:27 +0000
Subject: [PATCH 1/6] Create naked container from scratch to make smaller

---
 Dockerfile.naked | 218 ++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 197 insertions(+), 21 deletions(-)

diff --git a/Dockerfile.naked b/Dockerfile.naked
index fe9c5a7..df757ad 100644
--- a/Dockerfile.naked
+++ b/Dockerfile.naked
@@ -30,22 +30,22 @@
 #       docker run -it --device /dev/kvm -p 50922:10022 -v ${PWD}/mac_hdd_ng.img:/image -e "DISPLAY=${DISPLAY:-:0.0}" -v /tmp/.X11-unix:/tmp/.X11-unix docker-osx:naked
 # 
 
-FROM sickcodes/docker-osx:latest
+FROM archlinux:base-devel
+LABEL maintainer='https://twitter.com/sickcodes <https://sick.codes>'
 
-MAINTAINER 'https://twitter.com/sickcodes' <https://sick.codes>
+SHELL ["/bin/bash", "-c"]
 
-USER root
-
-WORKDIR /root
-
-RUN rm -f /home/arch/OSX-KVM/mac_hdd_ng.img
+# change disk size here or add during build, e.g. --build-arg VERSION=10.14.5 --build-arg SIZE=50G
+ARG SIZE=200G
 
 # OPTIONAL: Arch Linux server mirrors for super fast builds
 # set RANKMIRRORS to any value other that nothing, e.g. -e RANKMIRRORS=true
 ARG RANKMIRRORS
 ARG MIRROR_COUNTRY=US
 ARG MIRROR_COUNT=10
-RUN if [[ "${RANKMIRRORS}" ]]; then { pacman -Sy wget --noconfirm || pacman -Syu wget --noconfirm ; } \
+
+RUN if [[ "${RANKMIRRORS}" ]]; then \
+        { pacman -Sy wget --noconfirm || pacman -Syu wget --noconfirm ; } \
         ; wget -O ./rankmirrors "https://raw.githubusercontent.com/sickcodes/Docker-OSX/master/rankmirrors" \
         ; wget -O- "https://www.archlinux.org/mirrorlist/?country=${MIRROR_COUNTRY:-US}&protocol=https&use_mirror_status=on" \
         | sed -e 's/^#Server/Server/' -e '/^#/d' \
@@ -57,11 +57,40 @@ RUN if [[ "${RANKMIRRORS}" ]]; then { pacman -Sy wget --noconfirm || pacman -Syu
         && cat /etc/pacman.d/mirrorlist \
     ; fi
 
+# This fails on hub.docker.com, useful for debugging in cloud
+# RUN [[ $(egrep -c '(svm|vmx)' /proc/cpuinfo) -gt 0 ]] || { echo KVM not possible on this host && exit 1; }
+
+# RUN tee -a /etc/pacman.conf <<< '[community-testing]' \
+#     && tee -a /etc/pacman.conf <<< 'Include = /etc/pacman.d/mirrorlist'
+
+RUN pacman -Syu git zip vim nano alsa-utils openssh --noconfirm \
+    && ln -s /bin/vim /bin/vi \
+    && useradd arch -p arch \
+    && tee -a /etc/sudoers <<< 'arch ALL=(ALL) NOPASSWD: ALL' \
+    && mkdir /home/arch \
+    && chown arch:arch /home/arch \
+    && yes | sudo pacman -Scc
+
+# allow ssh to container
+RUN mkdir -m 700 /root/.ssh \
+    && touch /root/.ssh/authorized_keys \
+    && chmod 644 /root/.ssh/authorized_keys \
+    && tee -a /etc/ssh/sshd_config <<< 'AllowTcpForwarding yes' \
+    && tee -a /etc/ssh/sshd_config <<< 'PermitTunnel yes' \
+    && tee -a /etc/ssh/sshd_config <<< 'X11Forwarding yes' \
+    && tee -a /etc/ssh/sshd_config <<< 'PasswordAuthentication yes' \
+    && tee -a /etc/ssh/sshd_config <<< 'PermitRootLogin yes' \
+    && tee -a /etc/ssh/sshd_config <<< 'PubkeyAuthentication yes' \
+    && tee -a /etc/ssh/sshd_config <<< 'HostKey /etc/ssh/ssh_host_rsa_key' \
+    && tee -a /etc/ssh/sshd_config <<< 'HostKey /etc/ssh/ssh_host_ecdsa_key' \
+    && tee -a /etc/ssh/sshd_config <<< 'HostKey /etc/ssh/ssh_host_ed25519_key'
+
 # For taking screenshots of the Xfvb screen, useful during development.
 ARG SCROT
 
+# the following code only runs if --build-arg SCROT=true is used
 RUN pacman -Syu xorg-server-xvfb wget xterm xorg-xhost xorg-xrandr sshpass --noconfirm \
-    && if [[ "${SCROT}" ]]; then \
+    && if [[ "${SCROT}" == true ]]; then \
         pacman -Syu scrot base-devel --noconfirm \
         && git clone --recurse-submodules --depth 1 https://github.com/stolk/imcat.git \
         && cd imcat \
@@ -81,6 +110,95 @@ USER arch
 
 ENV USER arch
 
+# download OSX-KVM
+# RUN git clone --recurse-submodules --depth 1 https://github.com/kholia/OSX-KVM.git /home/arch/OSX-KVM
+RUN git clone --recurse-submodules --depth 1 https://github.com/kholia/OSX-KVM.git /home/arch/OSX-KVM
+
+WORKDIR /home/arch/OSX-KVM
+
+RUN touch enable-ssh.sh \
+    && chmod +x ./enable-ssh.sh \
+    && tee -a enable-ssh.sh <<< '[[ -f /etc/ssh/ssh_host_rsa_key ]] || \' \
+    && tee -a enable-ssh.sh <<< '[[ -f /etc/ssh/ssh_host_ed25519_key ]] || \' \
+    && tee -a enable-ssh.sh <<< '[[ -f /etc/ssh/ssh_host_ed25519_key ]] || \' \
+    && tee -a enable-ssh.sh <<< 'sudo /usr/bin/ssh-keygen -A' \
+    && tee -a enable-ssh.sh <<< 'nohup sudo /usr/bin/sshd -D &'
+
+# QEMU CONFIGURATOR
+# set optional ram at runtime -e RAM=16
+# set optional cores at runtime -e SMP=4 -e CORES=2
+# add any additional commands in QEMU cli format -e EXTRA="-usb -device usb-host,hostbus=1,hostaddr=8"
+
+# default env vars, RUNTIME ONLY, not for editing in build time.
+
+# RUN yes | sudo pacman -Syu qemu libvirt dnsmasq virt-manager bridge-utils edk2-ovmf netctl libvirt-dbus --overwrite --noconfirm
+
+RUN yes | sudo pacman -Syu bc qemu libvirt dnsmasq virt-manager bridge-utils openresolv jack ebtables edk2-ovmf netctl libvirt-dbus wget --overwrite --noconfirm \
+    && yes | sudo pacman -Scc
+
+WORKDIR /home/arch/OSX-KVM
+
+ARG LINUX=true
+
+# required to use libguestfs inside a docker container, to create bootdisks for docker-osx on-the-fly
+RUN if [[ "${LINUX}" == true ]]; then \
+        sudo pacman -Syu linux libguestfs --noconfirm \
+        && yes | sudo pacman -Scc \
+    ; fi
+
+# optional --build-arg to change branches for testing
+ARG BRANCH=master
+ARG REPO='https://github.com/sickcodes/Docker-OSX.git'
+# RUN git clone --recurse-submodules --depth 1 --branch "${BRANCH}" "${REPO}"
+RUN git clone --recurse-submodules --depth 1 --branch "${BRANCH}" "${REPO}"
+
+RUN touch Launch.sh \
+    && chmod +x ./Launch.sh \
+    && tee -a Launch.sh <<< '#!/bin/bash' \
+    && tee -a Launch.sh <<< 'set -eux' \
+    && tee -a Launch.sh <<< 'sudo chown    $(id -u):$(id -g) /dev/kvm 2>/dev/null || true' \
+    && tee -a Launch.sh <<< 'sudo chown -R $(id -u):$(id -g) /dev/snd 2>/dev/null || true' \
+    && tee -a Launch.sh <<< '[[ "${RAM}" = max ]] && export RAM="$(("$(head -n1 /proc/meminfo | tr -dc "[:digit:]") / 1000000"))"' \
+    && tee -a Launch.sh <<< '[[ "${RAM}" = half ]] && export RAM="$(("$(head -n1 /proc/meminfo | tr -dc "[:digit:]") / 2000000"))"' \
+    && tee -a Launch.sh <<< 'sudo chown -R $(id -u):$(id -g) /dev/snd 2>/dev/null || true' \
+    && tee -a Launch.sh <<< 'exec qemu-system-x86_64 -m ${RAM:-2}000 \' \
+    && tee -a Launch.sh <<< '-cpu ${CPU:-Penryn},${CPUID_FLAGS:-vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on,+ssse3,+sse4.2,+popcnt,+avx,+aes,+xsave,+xsaveopt,check,}${BOOT_ARGS} \' \
+    && tee -a Launch.sh <<< '-machine q35,${KVM-"accel=kvm:tcg"} \' \
+    && tee -a Launch.sh <<< '-smp ${CPU_STRING:-${SMP:-4},cores=${CORES:-4}} \' \
+    && tee -a Launch.sh <<< '-usb -device usb-kbd -device usb-tablet \' \
+    && tee -a Launch.sh <<< '-device isa-applesmc,osk=ourhardworkbythesewordsguardedpleasedontsteal\(c\)AppleComputerInc \' \
+    && tee -a Launch.sh <<< '-drive if=pflash,format=raw,readonly=on,file=/home/arch/OSX-KVM/OVMF_CODE.fd \' \
+    && tee -a Launch.sh <<< '-drive if=pflash,format=raw,file=/home/arch/OSX-KVM/OVMF_VARS-1024x768.fd \' \
+    && tee -a Launch.sh <<< '-smbios type=2 \' \
+    && tee -a Launch.sh <<< '-audiodev ${AUDIO_DRIVER:-alsa},id=hda -device ich9-intel-hda -device hda-duplex,audiodev=hda \' \
+    && tee -a Launch.sh <<< '-device ich9-ahci,id=sata \' \
+    && tee -a Launch.sh <<< '-drive id=OpenCoreBoot,if=none,snapshot=on,format=qcow2,file=${BOOTDISK:-/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2} \' \
+    && tee -a Launch.sh <<< '-device ide-hd,bus=sata.2,drive=OpenCoreBoot \' \
+    && tee -a Launch.sh <<< '-device ide-hd,bus=sata.3,drive=InstallMedia \' \
+    && tee -a Launch.sh <<< '-drive id=InstallMedia,if=none,file=/home/arch/OSX-KVM/BaseSystem.img,format=raw \' \
+    && tee -a Launch.sh <<< '-drive id=MacHDD,if=none,file=${IMAGE_PATH:-/home/arch/OSX-KVM/mac_hdd_ng.img},format=${IMAGE_FORMAT:-qcow2} \' \
+    && tee -a Launch.sh <<< '-device ide-hd,bus=sata.4,drive=MacHDD \' \
+    && tee -a Launch.sh <<< '-netdev user,id=net0,hostfwd=tcp::${INTERNAL_SSH_PORT:-10022}-:22,hostfwd=tcp::${SCREEN_SHARE_PORT:-5900}-:5900,${ADDITIONAL_PORTS} \' \
+    && tee -a Launch.sh <<< '-device ${NETWORKING:-vmxnet3},netdev=net0,id=net0,mac=${MAC_ADDRESS:-52:54:00:09:49:17} \' \
+    && tee -a Launch.sh <<< '-monitor stdio \' \
+    && tee -a Launch.sh <<< '-boot menu=on \' \
+    && tee -a Launch.sh <<< '-vga vmware \' \
+    && tee -a Launch.sh <<< '${EXTRA:-}'
+
+# docker exec containerid mv ./Launch-nopicker.sh ./Launch.sh
+# This is now a legacy command.
+# You can use -e BOOTDISK=/bootdisk with -v ./bootdisk.img:/bootdisk
+
+### LEGACY CODE
+RUN grep -v InstallMedia ./Launch.sh > ./Launch-nopicker.sh \
+    && chmod +x ./Launch-nopicker.sh \
+    && sed -i -e s/OpenCore\.qcow2/OpenCore\-nopicker\.qcow2/ ./Launch-nopicker.sh
+###
+
+USER arch
+
+ENV USER arch
+
 #### libguestfs versioning
 
 # 5.13+ problem resolved by building the qcow2 against 5.12 using libguestfs-1.44.1-6
@@ -98,10 +216,53 @@ RUN sudo pacman -Syy \
     && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm \
     && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \
     && rm -rf /var/tmp/.guestfs-* \
+    && yes | sudo pacman -Scc \
     ; libguestfs-test-tool || exit 1
 
 ####
 
+# These are hardcoded serials for non-iMessage related research
+# Overwritten by using GENERATE_UNIQUE=true
+# Upstream removed nopicker, so we are adding it back in, at build time
+# Once again, this is just for the Docker build so there is a default nopicker image there
+
+# libguestfs verbose
+ENV LIBGUESTFS_DEBUG=1
+ENV LIBGUESTFS_TRACE=1
+
+ARG STOCK_DEVICE_MODEL=iMacPro1,1
+ARG STOCK_SERIAL=C02TM2ZBHX87
+ARG STOCK_BOARD_SERIAL=C02717306J9JG361M
+ARG STOCK_UUID=007076A6-F2A2-4461-BBE5-BAD019F8025A
+ARG STOCK_MAC_ADDRESS=00:0A:27:00:00:00
+ARG STOCK_WIDTH=1920
+ARG STOCK_HEIGHT=1080
+ARG STOCK_MASTER_PLIST_URL=https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-custom.plist
+ARG STOCK_MASTER_PLIST_URL_NOPICKER=https://raw.githubusercontent.com/sickcodes/osx-serial-generator/master/config-nopicker-custom.plist
+ARG STOCK_BOOTDISK=/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2
+ARG STOCK_BOOTDISK_NOPICKER=/home/arch/OSX-KVM/OpenCore/OpenCore-nopicker.qcow2
+
+# RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
+#     --master-plist-url="${STOCK_MASTER_PLIST_URL}" \
+#     --model "${STOCK_DEVICE_MODEL}" \
+#     --serial "${STOCK_SERIAL}" \
+#     --board-serial "${STOCK_BOARD_SERIAL}" \
+#     --uuid "${STOCK_UUID}" \
+#     --mac-address "${STOCK_MAC_ADDRESS}" \
+#     --width "${STOCK_WIDTH}" \
+#     --height "${STOCK_HEIGHT}" \
+#     --output-bootdisk "${STOCK_BOOTDISK}" || exit 1
+
+# RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
+#     --master-plist-url="${STOCK_MASTER_PLIST_URL_NOPICKER}" \
+#     --model "${STOCK_DEVICE_MODEL}" \
+#     --serial "${STOCK_SERIAL}" \
+#     --board-serial "${STOCK_BOARD_SERIAL}" \
+#     --uuid "${STOCK_UUID}" \
+#     --mac-address "${STOCK_MAC_ADDRESS}" \
+#     --width "${STOCK_WIDTH}" \
+#     --height "${STOCK_HEIGHT}" \
+#     --output-bootdisk "${STOCK_BOOTDISK_NOPICKER}" || exit 1
 
 WORKDIR /home/arch/OSX-KVM
 
@@ -115,15 +276,13 @@ RUN mkdir -p ~/.ssh \
     && tee -a ~/.ssh/config <<< '    StrictHostKeyChecking no' \
     && tee -a ~/.ssh/config <<< '    UserKnownHostsFile=/dev/null'
 
-####
-
-# symlink the old directory, for redundancy
+### symlink the old directory as upstream has renamed a directory. Symlinking purely for backwards compatability!
 RUN ln -s /home/arch/OSX-KVM/OpenCore /home/arch/OSX-KVM/OpenCore-Catalina || true
-
 ####
 
 #### SPECIAL RUNTIME ARGUMENTS BELOW
-
+# env -e ADDITIONAL_PORTS with a comma
+# for example, -e ADDITIONAL_PORTS=hostfwd=tcp::23-:23,
 ENV ADDITIONAL_PORTS=
 
 # add additional QEMU boot arguments
@@ -131,13 +290,13 @@ ENV BOOT_ARGS=
 
 ENV BOOTDISK=
 
-# edit the CPU that is beign emulated
+# edit the CPU that is being emulated
 ENV CPU=Penryn
+ENV CPUID_FLAGS='vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on,+ssse3,+sse4.2,+popcnt,+avx,+aes,+xsave,+xsaveopt,check,'
 
-ENV DISPLAY=:99
-
-ENV HEADLESS=false
+ENV DISPLAY=:0.0
 
+# Deprecated
 ENV ENV=/env
 
 # Boolean for generating a bootdisk with new random serials.
@@ -168,9 +327,26 @@ ENV RAM=3
 ENV WIDTH=1920
 ENV HEIGHT=1080
 
-# libguestfs verbose
-ENV LIBGUESTFS_DEBUG=1
-ENV LIBGUESTFS_TRACE=1
+VOLUME ["/tmp/.X11-unix"]
+
+# check if /image is a disk image or a directory. This allows you to optionally use -v disk.img:/image
+# NOPICKER is used to skip the disk selection screen
+# GENERATE_UNIQUE is used to generate serial numbers on boot.
+# /env is a file that you can generate and save using -v source.sh:/env
+# the env file is a file that you can carry to the next container which will supply the serials numbers.
+# GENERATE_SPECIFIC is used to either accept the env serial numbers OR you can supply using:
+    # -e DEVICE_MODEL="iMacPro1,1" \
+    # -e SERIAL="C02TW0WAHX87" \
+    # -e BOARD_SERIAL="C027251024NJG36UE" \
+    # -e UUID="5CCB366D-9118-4C61-A00A-E5BAF3BED451" \
+    # -e MAC_ADDRESS="A8:5C:2C:9A:46:2F" \
+
+# the output will be /bootdisk.
+# /bootdisk is a useful persistent place to store the 15Mb serial number bootdisk.
+
+# if you don't set any of the above:
+# the default serial numbers are already contained in ./OpenCore/OpenCore.qcow2
+# And the default serial numbers
 
 CMD sudo touch /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \
     ; sudo chown -R $(id -u):$(id -g) /dev/kvm /dev/snd "${IMAGE_PATH}" "${BOOTDISK}" "${ENV}" 2>/dev/null || true \

From bc79a1fffb44c37efe6534e6c1c3b9265bbe8f62 Mon Sep 17 00:00:00 2001
From: sickcodes <info@sick.codes>
Date: Mon, 29 Nov 2021 04:15:44 +0000
Subject: [PATCH 2/6] Shrink the Docker containers, significantly.

---
 Dockerfile       | 11 +++++++----
 Dockerfile.naked | 10 +++++++---
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index f57989a..9aa8bc1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -145,7 +145,7 @@ WORKDIR /home/arch/OSX-KVM
 
 # RUN wget https://raw.githubusercontent.com/kholia/OSX-KVM/master/fetch-macOS-v2.py
 
-ARG SHORTNAME
+ARG SHORTNAME=catalina
 
 RUN make
 
@@ -226,7 +226,8 @@ RUN sudo pacman -Syy \
     && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm \
     && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \
     && rm -rf /var/tmp/.guestfs-* \
-    ; libguestfs-test-tool || exit 1
+    ; libguestfs-test-tool || exit 1 \
+    ; rm -rf /var/tmp/.guestfs-*
 
 ####
 
@@ -260,7 +261,8 @@ RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
     --mac-address "${STOCK_MAC_ADDRESS}" \
     --width "${STOCK_WIDTH}" \
     --height "${STOCK_HEIGHT}" \
-    --output-bootdisk "${STOCK_BOOTDISK}" || exit 1
+    --output-bootdisk "${STOCK_BOOTDISK}" || exit 1 \
+    ; rm -rf /var/tmp/.guestfs-*
 
 RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
     --master-plist-url="${STOCK_MASTER_PLIST_URL_NOPICKER}" \
@@ -271,7 +273,8 @@ RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
     --mac-address "${STOCK_MAC_ADDRESS}" \
     --width "${STOCK_WIDTH}" \
     --height "${STOCK_HEIGHT}" \
-    --output-bootdisk "${STOCK_BOOTDISK_NOPICKER}" || exit 1
+    --output-bootdisk "${STOCK_BOOTDISK_NOPICKER}" || exit 1 \
+    ; rm -rf /var/tmp/.guestfs-*
 
 ### symlink the old directory as upstream has renamed a directory. Symlinking purely for backwards compatability!
 RUN ln -s /home/arch/OSX-KVM/OpenCore /home/arch/OSX-KVM/OpenCore-Catalina || true
diff --git a/Dockerfile.naked b/Dockerfile.naked
index df757ad..f7425f9 100644
--- a/Dockerfile.naked
+++ b/Dockerfile.naked
@@ -217,7 +217,8 @@ RUN sudo pacman -Syy \
     && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \
     && rm -rf /var/tmp/.guestfs-* \
     && yes | sudo pacman -Scc \
-    ; libguestfs-test-tool || exit 1
+    ; libguestfs-test-tool || exit 1 \
+    && rm -rf /var/tmp/.guestfs-*
 
 ####
 
@@ -251,7 +252,8 @@ ARG STOCK_BOOTDISK_NOPICKER=/home/arch/OSX-KVM/OpenCore/OpenCore-nopicker.qcow2
 #     --mac-address "${STOCK_MAC_ADDRESS}" \
 #     --width "${STOCK_WIDTH}" \
 #     --height "${STOCK_HEIGHT}" \
-#     --output-bootdisk "${STOCK_BOOTDISK}" || exit 1
+#     --output-bootdisk "${STOCK_BOOTDISK}" || exit 1 \
+#     ; rm -rf /var/tmp/.guestfs-*
 
 # RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
 #     --master-plist-url="${STOCK_MASTER_PLIST_URL_NOPICKER}" \
@@ -262,7 +264,9 @@ ARG STOCK_BOOTDISK_NOPICKER=/home/arch/OSX-KVM/OpenCore/OpenCore-nopicker.qcow2
 #     --mac-address "${STOCK_MAC_ADDRESS}" \
 #     --width "${STOCK_WIDTH}" \
 #     --height "${STOCK_HEIGHT}" \
-#     --output-bootdisk "${STOCK_BOOTDISK_NOPICKER}" || exit 1
+#     --output-bootdisk "${STOCK_BOOTDISK_NOPICKER}" || exit 1 \
+#     ; rm -rf /var/tmp/.guestfs-*
+
 
 WORKDIR /home/arch/OSX-KVM
 

From e55e55229da4c15dce0523e317819cf491880a35 Mon Sep 17 00:00:00 2001
From: sickcodes <info@sick.codes>
Date: Mon, 29 Nov 2021 04:34:20 +0000
Subject: [PATCH 3/6] Use qcow for BaseSystem.img instead because it sheds 2G
 off image size. Add back in stock OpenCore bootdisks; size negligible after
 removing cache.

---
 Dockerfile       | 11 +++++++++--
 Dockerfile.naked | 44 ++++++++++++++++++++++----------------------
 2 files changed, 31 insertions(+), 24 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9aa8bc1..26d52e9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -147,7 +147,9 @@ WORKDIR /home/arch/OSX-KVM
 
 ARG SHORTNAME=catalina
 
-RUN make
+RUN make \
+    && qemu-img convert BaseSystem.dmg -O qcow2 -p -c BaseSystem.img \
+    && rm ./BaseSystem.dmg
 
 ARG LINUX=true
 
@@ -182,7 +184,7 @@ RUN touch Launch.sh \
     && tee -a Launch.sh <<< '-smbios type=2 \' \
     && tee -a Launch.sh <<< '-audiodev ${AUDIO_DRIVER:-alsa},id=hda -device ich9-intel-hda -device hda-duplex,audiodev=hda \' \
     && tee -a Launch.sh <<< '-device ich9-ahci,id=sata \' \
-    && tee -a Launch.sh <<< '-drive id=OpenCoreBoot,if=none,snapshot=on,format=qcow2,file=${BOOTDISK:-/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2} \' \
+    && tee -a Launch.sh <<< '-drive id=OpenCoreBoot,if=none,snapshot=on,format=${BASESYSTEM_FORMAT},file=${BOOTDISK:-/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2} \' \
     && tee -a Launch.sh <<< '-device ide-hd,bus=sata.2,drive=OpenCoreBoot \' \
     && tee -a Launch.sh <<< '-device ide-hd,bus=sata.3,drive=InstallMedia \' \
     && tee -a Launch.sh <<< '-drive id=InstallMedia,if=none,file=/home/arch/OSX-KVM/BaseSystem.img,format=raw \' \
@@ -285,6 +287,11 @@ RUN ln -s /home/arch/OSX-KVM/OpenCore /home/arch/OSX-KVM/OpenCore-Catalina || tr
 # for example, -e ADDITIONAL_PORTS=hostfwd=tcp::23-:23,
 ENV ADDITIONAL_PORTS=
 
+# since the Makefile uses raw, and raw uses the full disk amount
+# we want to use a compressed qcow2
+# ENV BASESYSTEM_FORMAT=raw
+ENV BASESYSTEM_FORMAT=qcow2
+
 # add additional QEMU boot arguments
 ENV BOOT_ARGS=
 
diff --git a/Dockerfile.naked b/Dockerfile.naked
index f7425f9..28e605f 100644
--- a/Dockerfile.naked
+++ b/Dockerfile.naked
@@ -243,29 +243,29 @@ ARG STOCK_MASTER_PLIST_URL_NOPICKER=https://raw.githubusercontent.com/sickcodes/
 ARG STOCK_BOOTDISK=/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2
 ARG STOCK_BOOTDISK_NOPICKER=/home/arch/OSX-KVM/OpenCore/OpenCore-nopicker.qcow2
 
-# RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
-#     --master-plist-url="${STOCK_MASTER_PLIST_URL}" \
-#     --model "${STOCK_DEVICE_MODEL}" \
-#     --serial "${STOCK_SERIAL}" \
-#     --board-serial "${STOCK_BOARD_SERIAL}" \
-#     --uuid "${STOCK_UUID}" \
-#     --mac-address "${STOCK_MAC_ADDRESS}" \
-#     --width "${STOCK_WIDTH}" \
-#     --height "${STOCK_HEIGHT}" \
-#     --output-bootdisk "${STOCK_BOOTDISK}" || exit 1 \
-#     ; rm -rf /var/tmp/.guestfs-*
+RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
+    --master-plist-url="${STOCK_MASTER_PLIST_URL}" \
+    --model "${STOCK_DEVICE_MODEL}" \
+    --serial "${STOCK_SERIAL}" \
+    --board-serial "${STOCK_BOARD_SERIAL}" \
+    --uuid "${STOCK_UUID}" \
+    --mac-address "${STOCK_MAC_ADDRESS}" \
+    --width "${STOCK_WIDTH}" \
+    --height "${STOCK_HEIGHT}" \
+    --output-bootdisk "${STOCK_BOOTDISK}" || exit 1 \
+    ; rm -rf /var/tmp/.guestfs-*
 
-# RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
-#     --master-plist-url="${STOCK_MASTER_PLIST_URL_NOPICKER}" \
-#     --model "${STOCK_DEVICE_MODEL}" \
-#     --serial "${STOCK_SERIAL}" \
-#     --board-serial "${STOCK_BOARD_SERIAL}" \
-#     --uuid "${STOCK_UUID}" \
-#     --mac-address "${STOCK_MAC_ADDRESS}" \
-#     --width "${STOCK_WIDTH}" \
-#     --height "${STOCK_HEIGHT}" \
-#     --output-bootdisk "${STOCK_BOOTDISK_NOPICKER}" || exit 1 \
-#     ; rm -rf /var/tmp/.guestfs-*
+RUN ./Docker-OSX/osx-serial-generator/generate-specific-bootdisk.sh \
+    --master-plist-url="${STOCK_MASTER_PLIST_URL_NOPICKER}" \
+    --model "${STOCK_DEVICE_MODEL}" \
+    --serial "${STOCK_SERIAL}" \
+    --board-serial "${STOCK_BOARD_SERIAL}" \
+    --uuid "${STOCK_UUID}" \
+    --mac-address "${STOCK_MAC_ADDRESS}" \
+    --width "${STOCK_WIDTH}" \
+    --height "${STOCK_HEIGHT}" \
+    --output-bootdisk "${STOCK_BOOTDISK_NOPICKER}" || exit 1 \
+    ; rm -rf /var/tmp/.guestfs-*
 
 
 WORKDIR /home/arch/OSX-KVM

From 4805b9169b268a282a386e5e1b4fcd4be6c7c137 Mon Sep 17 00:00:00 2001
From: sickcodes <info@sick.codes>
Date: Mon, 29 Nov 2021 04:41:24 +0000
Subject: [PATCH 4/6] Add Monterey recovery disk to `:naked`; it is backwards
 compatible (APFS), however Catalina's recovery image is useless on Monterey
 images.

---
 Dockerfile       | 4 ++--
 Dockerfile.naked | 9 ++++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 26d52e9..6d50a67 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -184,10 +184,10 @@ RUN touch Launch.sh \
     && tee -a Launch.sh <<< '-smbios type=2 \' \
     && tee -a Launch.sh <<< '-audiodev ${AUDIO_DRIVER:-alsa},id=hda -device ich9-intel-hda -device hda-duplex,audiodev=hda \' \
     && tee -a Launch.sh <<< '-device ich9-ahci,id=sata \' \
-    && tee -a Launch.sh <<< '-drive id=OpenCoreBoot,if=none,snapshot=on,format=${BASESYSTEM_FORMAT},file=${BOOTDISK:-/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2} \' \
+    && tee -a Launch.sh <<< '-drive id=OpenCoreBoot,if=none,snapshot=on,format=qcow2,file=${BOOTDISK:-/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2} \' \
     && tee -a Launch.sh <<< '-device ide-hd,bus=sata.2,drive=OpenCoreBoot \' \
     && tee -a Launch.sh <<< '-device ide-hd,bus=sata.3,drive=InstallMedia \' \
-    && tee -a Launch.sh <<< '-drive id=InstallMedia,if=none,file=/home/arch/OSX-KVM/BaseSystem.img,format=raw \' \
+    && tee -a Launch.sh <<< '-drive id=InstallMedia,if=none,file=/home/arch/OSX-KVM/BaseSystem.img,format=${BASESYSTEM_FORMAT} \' \
     && tee -a Launch.sh <<< '-drive id=MacHDD,if=none,file=${IMAGE_PATH:-/home/arch/OSX-KVM/mac_hdd_ng.img},format=${IMAGE_FORMAT:-qcow2} \' \
     && tee -a Launch.sh <<< '-device ide-hd,bus=sata.4,drive=MacHDD \' \
     && tee -a Launch.sh <<< '-netdev user,id=net0,hostfwd=tcp::${INTERNAL_SSH_PORT:-10022}-:22,hostfwd=tcp::${SCREEN_SHARE_PORT:-5900}-:5900,${ADDITIONAL_PORTS} \' \
diff --git a/Dockerfile.naked b/Dockerfile.naked
index 28e605f..469976f 100644
--- a/Dockerfile.naked
+++ b/Dockerfile.naked
@@ -138,6 +138,13 @@ RUN yes | sudo pacman -Syu bc qemu libvirt dnsmasq virt-manager bridge-utils ope
 
 WORKDIR /home/arch/OSX-KVM
 
+# we still want a recovery disk, monterey is backwards compatible (APFS), however, the Catalina and below are not (HFS+).
+ARG SHORTNAME=monterey
+
+RUN make \
+    && qemu-img convert BaseSystem.dmg -O qcow2 -p -c BaseSystem.img \
+    && rm ./BaseSystem.dmg
+
 ARG LINUX=true
 
 # required to use libguestfs inside a docker container, to create bootdisks for docker-osx on-the-fly
@@ -175,7 +182,7 @@ RUN touch Launch.sh \
     && tee -a Launch.sh <<< '-drive id=OpenCoreBoot,if=none,snapshot=on,format=qcow2,file=${BOOTDISK:-/home/arch/OSX-KVM/OpenCore/OpenCore.qcow2} \' \
     && tee -a Launch.sh <<< '-device ide-hd,bus=sata.2,drive=OpenCoreBoot \' \
     && tee -a Launch.sh <<< '-device ide-hd,bus=sata.3,drive=InstallMedia \' \
-    && tee -a Launch.sh <<< '-drive id=InstallMedia,if=none,file=/home/arch/OSX-KVM/BaseSystem.img,format=raw \' \
+    && tee -a Launch.sh <<< '-drive id=InstallMedia,if=none,file=/home/arch/OSX-KVM/BaseSystem.img,format=${BASESYSTEM_FORMAT} \' \
     && tee -a Launch.sh <<< '-drive id=MacHDD,if=none,file=${IMAGE_PATH:-/home/arch/OSX-KVM/mac_hdd_ng.img},format=${IMAGE_FORMAT:-qcow2} \' \
     && tee -a Launch.sh <<< '-device ide-hd,bus=sata.4,drive=MacHDD \' \
     && tee -a Launch.sh <<< '-netdev user,id=net0,hostfwd=tcp::${INTERNAL_SSH_PORT:-10022}-:22,hostfwd=tcp::${SCREEN_SHARE_PORT:-5900}-:5900,${ADDITIONAL_PORTS} \' \

From c9b33ddb62698d8735474dafd774e232c0e15081 Mon Sep 17 00:00:00 2001
From: sickcodes <info@sick.codes>
Date: Mon, 29 Nov 2021 06:21:14 +0000
Subject: [PATCH 5/6] Rare issue regarding signatures from the arch archives.

---
 Dockerfile            | 12 ++++++++----
 Dockerfile.auto       | 12 +++++++++---
 Dockerfile.naked      |  9 ++++++---
 Dockerfile.naked-auto | 11 ++++++++---
 4 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 6d50a67..7a376e2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -222,14 +222,18 @@ ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12
 ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst
 ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst
 
+# fixe ad hoc errors from using the arch museum to get libguestfs
+RUN tee -a /etc/pacman.conf <<< "RemoteFileSigLevel = Optional"
+
 RUN sudo pacman -Syy \
     && sudo pacman -Rns linux --noconfirm \
     ; sudo pacman -S mkinitcpio --noconfirm \
-    && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm \
-    && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \
+    && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm || exit 1 \
+    && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm || exit 1 \
     && rm -rf /var/tmp/.guestfs-* \
-    ; libguestfs-test-tool || exit 1 \
-    ; rm -rf /var/tmp/.guestfs-*
+    && yes | sudo pacman -Scc \
+    && libguestfs-test-tool || exit 1 \
+    && rm -rf /var/tmp/.guestfs-*
 
 ####
 
diff --git a/Dockerfile.auto b/Dockerfile.auto
index f9ee9b9..5c7c6bd 100644
--- a/Dockerfile.auto
+++ b/Dockerfile.auto
@@ -104,16 +104,22 @@ ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12
 ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst
 ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst
 
+# fixe ad hoc errors from using the arch museum to get libguestfs
+RUN tee -a /etc/pacman.conf <<< "RemoteFileSigLevel = Optional"
+
 RUN sudo pacman -Syy \
     && sudo pacman -Rns linux --noconfirm \
     ; sudo pacman -S mkinitcpio --noconfirm \
-    && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm \
-    && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \
+    && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm || exit 1 \
+    && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm || exit 1 \
     && rm -rf /var/tmp/.guestfs-* \
-    ; libguestfs-test-tool || exit 1
+    && yes | sudo pacman -Scc \
+    && libguestfs-test-tool || exit 1 \
+    && rm -rf /var/tmp/.guestfs-*
 
 ####
 
+
 WORKDIR /home/arch/OSX-KVM
 
 RUN mkdir -p ~/.ssh \
diff --git a/Dockerfile.naked b/Dockerfile.naked
index 469976f..0c318b5 100644
--- a/Dockerfile.naked
+++ b/Dockerfile.naked
@@ -217,14 +217,17 @@ ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12
 ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst
 ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst
 
+# fixe ad hoc errors from using the arch museum to get libguestfs
+RUN tee -a /etc/pacman.conf <<< "RemoteFileSigLevel = Optional"
+
 RUN sudo pacman -Syy \
     && sudo pacman -Rns linux --noconfirm \
     ; sudo pacman -S mkinitcpio --noconfirm \
-    && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm \
-    && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \
+    && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm || exit 1 \
+    && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm || exit 1 \
     && rm -rf /var/tmp/.guestfs-* \
     && yes | sudo pacman -Scc \
-    ; libguestfs-test-tool || exit 1 \
+    && libguestfs-test-tool || exit 1 \
     && rm -rf /var/tmp/.guestfs-*
 
 ####
diff --git a/Dockerfile.naked-auto b/Dockerfile.naked-auto
index 13edc0a..aef3482 100644
--- a/Dockerfile.naked-auto
+++ b/Dockerfile.naked-auto
@@ -84,13 +84,18 @@ ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12
 ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst
 ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst
 
+# fixe ad hoc errors from using the arch museum to get libguestfs
+RUN tee -a /etc/pacman.conf <<< "RemoteFileSigLevel = Optional"
+
 RUN sudo pacman -Syy \
     && sudo pacman -Rns linux --noconfirm \
     ; sudo pacman -S mkinitcpio --noconfirm \
-    && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm \
-    && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm \
+    && sudo pacman -U "${KERNEL_PACKAGE_URL}" --noconfirm || exit 1 \
+    && sudo pacman -U "${LIBGUESTFS_PACKAGE_URL}" --noconfirm || exit 1 \
     && rm -rf /var/tmp/.guestfs-* \
-    ; libguestfs-test-tool || exit 1
+    && yes | sudo pacman -Scc \
+    && libguestfs-test-tool || exit 1 \
+    && rm -rf /var/tmp/.guestfs-*
 
 ####
 

From 2d79f0607917859fa504a7143e7f1157be983cae Mon Sep 17 00:00:00 2001
From: sickcodes <info@sick.codes>
Date: Mon, 29 Nov 2021 07:19:48 +0000
Subject: [PATCH 6/6] `RUN sudo sed -i -e
 's/^\#RemoteFileSigLevel/RemoteFileSigLevel/g' /etc/pacman.conf`

---
 Dockerfile            | 4 ++--
 Dockerfile.auto       | 4 ++--
 Dockerfile.naked      | 4 ++--
 Dockerfile.naked-auto | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 7a376e2..a8fe617 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -222,8 +222,8 @@ ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12
 ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst
 ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst
 
-# fixe ad hoc errors from using the arch museum to get libguestfs
-RUN tee -a /etc/pacman.conf <<< "RemoteFileSigLevel = Optional"
+# fix ad hoc errors from using the arch museum to get libguestfs
+RUN sudo sed -i -e 's/^\#RemoteFileSigLevel/RemoteFileSigLevel/g' /etc/pacman.conf
 
 RUN sudo pacman -Syy \
     && sudo pacman -Rns linux --noconfirm \
diff --git a/Dockerfile.auto b/Dockerfile.auto
index 5c7c6bd..aae6e2f 100644
--- a/Dockerfile.auto
+++ b/Dockerfile.auto
@@ -104,8 +104,8 @@ ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12
 ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst
 ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst
 
-# fixe ad hoc errors from using the arch museum to get libguestfs
-RUN tee -a /etc/pacman.conf <<< "RemoteFileSigLevel = Optional"
+# fix ad hoc errors from using the arch museum to get libguestfs
+RUN sudo sed -i -e 's/^\#RemoteFileSigLevel/RemoteFileSigLevel/g' /etc/pacman.conf
 
 RUN sudo pacman -Syy \
     && sudo pacman -Rns linux --noconfirm \
diff --git a/Dockerfile.naked b/Dockerfile.naked
index 0c318b5..3d5e2ef 100644
--- a/Dockerfile.naked
+++ b/Dockerfile.naked
@@ -217,8 +217,8 @@ ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12
 ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst
 ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst
 
-# fixe ad hoc errors from using the arch museum to get libguestfs
-RUN tee -a /etc/pacman.conf <<< "RemoteFileSigLevel = Optional"
+# fix ad hoc errors from using the arch museum to get libguestfs
+RUN sudo sed -i -e 's/^\#RemoteFileSigLevel/RemoteFileSigLevel/g' /etc/pacman.conf
 
 RUN sudo pacman -Syy \
     && sudo pacman -Rns linux --noconfirm \
diff --git a/Dockerfile.naked-auto b/Dockerfile.naked-auto
index aef3482..43dfdc5 100644
--- a/Dockerfile.naked-auto
+++ b/Dockerfile.naked-auto
@@ -84,8 +84,8 @@ ENV KERNEL_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-5.12
 ENV KERNEL_HEADERS_PACKAGE_URL=https://archive.archlinux.org/packages/l/linux/linux-headers-5.12.14.arch1-1-x86_64.pkg.tar.zst
 ENV LIBGUESTFS_PACKAGE_URL=https://archive.archlinux.org/packages/l/libguestfs/libguestfs-1.44.1-6-x86_64.pkg.tar.zst
 
-# fixe ad hoc errors from using the arch museum to get libguestfs
-RUN tee -a /etc/pacman.conf <<< "RemoteFileSigLevel = Optional"
+# fix ad hoc errors from using the arch museum to get libguestfs
+RUN sudo sed -i -e 's/^\#RemoteFileSigLevel/RemoteFileSigLevel/g' /etc/pacman.conf
 
 RUN sudo pacman -Syy \
     && sudo pacman -Rns linux --noconfirm \