MacVisor vs. Lima

Native GUI library, settings, dashboard, snapshot list, and display windows, plus the mvz CLI.

No GUI app. limactl and YAML files, with an experimental limactl menu terminal interface (2.3). VMs are headless unless you turn a display on.

macOS 14, 15, 26 and 27 from Apple's installers, your own IPSW or a registry image such as Tart's, with accelerated graphics, and set up for you on macOS 27 (account, SSH and the MacVisor Agent). Apple allows two macOS VMs at a time.

Experimental, on the VZ driver only, from Apple's IPSW (templates for macOS 15, 26 and 27). The Mac must run the guest's macOS version or newer. Lima 2.3 can skip the first-login Setup Assistant; no automatic port forwarding.

Any ARM64 distribution: a signed catalogue of cloud images (Ubuntu, Debian, Fedora, Rocky, Alma, openSUSE, Alpine and more) set up by cloud-init, a registry image, or any ARM64 ISO. Rosetta runs x86-64 Linux programs, and a TPM 2.0 is there if you turn it on (27.2.1).

The core use: templates for Ubuntu (the default), Debian, Fedora, Rocky, AlmaLinux, Alpine, Arch, openSUSE, Oracle Linux and others, set up by cloud-init, as ARM64 or x86-64 guests.

Windows 11 on ARM, installed unattended from Microsoft's ISO with your account, Remote Desktop, optional SSH, the MacVisor Agent and sound. UEFI Secure Boot and a TPM 2.0 sealed to the Mac's Secure Enclave, so BitLocker unlocks from the TPM; mvz tpm export and import move it to another Mac (27.2.1). Tested on macOS 27.2. No GPU acceleration or TPM attestation.

Experimental since 2.2: Windows 11 and Server 2025 on the QEMU driver only, from an ISO you download, with TPM emulation through swtpm. Plain mode only (no mounts or automatic port forwards), and the docs warn a Windows 11 boot may occasionally fail.

FreeBSD 15.1 and 16.0-CURRENT from FreeBSD's cloud images, with your SSH keys, the MacVisor Agent and snapshots. Console and SSH only, with no desktop, shared folders or clipboard.

Experimental: FreeBSD 15 and 16-CURRENT on the QEMU driver, with no guest agent, so no automatic port forwarding. Host folders mount from FreeBSD 15.1.

FreeBSD- and Linux-based firewalls and routers, and appliances such as Home Assistant OS, booted as they are from their ARM64 images, with USB passthrough for Zigbee and Z-Wave radios.

Not documented. Lima is built around cloud-init images and its guest agent; booting a router or Home Assistant OS image as it is isn't a described workflow, and there is no USB passthrough.

No: Apple Silicon (ARM64) guests only; x86-64 programs run inside Linux guests through Rosetta.

Whole x86-64 VMs through QEMU emulation (slow), or x86-64 programs in an ARM64 VZ guest through Rosetta (fast). RISC-V, s390x, ppc64le and armv7l are experimental.

Apple Silicon Macs on macOS 27.

macOS on Apple Silicon and Intel, and Linux; Windows and NetBSD hosts are listed as untested.

A signed catalogue of vendor cloud images (Linux and FreeBSD), your own raw, ASIF or qcow2 image, or a VM image from any OCI registry, Tart's included (27.2.1). cloud-init sets up your account, SSH keys, container runtime and home folder share from the New VM form or mvz create.

Templates name each distribution's cloud images, and cloud-init sets up your user, SSH, mounts and containerd. Templates can build on others with base: and come from GitHub URLs (experimental).

Docker, Podman, containerd or k3s, opt-in when you create the VM. The Docker or Podman socket and the k3s kubeconfig reach the Mac with no network setup.

Lima's origin: rootless containerd and nerdctl by default, templates for Docker, Podman, k3s and kubeadm Kubernetes, and the VM under Colima, Rancher Desktop, Finch and Podman Desktop.

Clipboard, file transfer, port forwards, guest addresses and a clean shutdown over a virtual socket, with no network needed; VirtioFS shared folders, ISOs attached to a running VM, and Rosetta for Linux.

Guest ports forwarded to the Mac's localhost automatically (TCP and UDP), your home folder mounted read-only by default (virtiofs on VZ, 9p on QEMU), limactl shell, limactl copy and SSH, and Rosetta on VZ.

The mvz CLI covers nearly everything the app does, from creating VMs to snapshots, backups, registry images, TPMs, networks, firewall rules and the MCP server, with --json output and documented exit codes.

limactl runs the whole life cycle from YAML (create, start, stop, edit, clone, copy, disks, networks), with JSON output and a JSON schema for lima.yaml. Used in GitHub Actions to test on other distributions.

Live (with memory) and disk-only snapshots of running VMs for every guest, near-free on APFS, plus automatic snapshots hourly, daily or weekly (27.2.1); suspend and resume; and shut down or suspend at logout, your choice.

limactl snapshot is experimental and depends on the driver: QEMU snapshots running VMs, krunkit only stopped ones, and VZ, the default on macOS, has none. No suspend.

Templates and instant linked clones that store only their own changes; every cloud-image VM is a linked clone of its image. From 27.2.1, templates pull from OCI registries and VMs push to them.

YAML templates make fresh instances, and limactl clone makes a copy-on-write copy of a stopped instance. No VM templates or linked clones.

Several storage locations on internal, external or network volumes; a running VM moves between them in one step (suspend, move, resume).

Instances live under ~/.lima (or LIMA_HOME): one location, no migration between volumes. limactl disk adds data disks, and 2.3 attaches host block devices to VZ guests.

macOS guests get accelerated graphics on the Mac's GPU. Linux and Windows guests have no GPU acceleration, so no 3D; Windows takes the window's exact size as you resize it, on MacVisor's own display device. One display per VM.

Headless by default. The experimental krunkit driver gives Linux guests Vulkan on the Mac's GPU through Venus, for work such as local models; VZ and QEMU guests have no GPU acceleration documented.

NAT, bridged (also to a VLAN), and named shared and host-only networks, with up to four adapters per VM; every VM answers as <vm>.mvz.

User-mode NAT by default, vzNAT for VZ guests, and named shared, host and bridged networks through socket_vmnet (built and installed as root, with a sudoers file); user-v2 links VMs. limactl network create adds named networks.

Creates 802.1Q VLAN interfaces on the Mac (tags 1-4094) for VMs to bridge to, or for a shared network to use as its uplink.

No VLAN interfaces; a bridged network uses an interface the Mac already has.

Per-network DHCP with MAC-to-IPv4 reservations, by hand or made for cloud-init VMs automatically (within macOS 27's network limits).

Shared and host networks set a gateway, netmask and DHCP range; there are no address reservations, and vzNAT's range can't be set.

TCP and UDP forwards on shared networks, reachable from other devices, plus per-VM forwards through the MacVisor Agent; Linux VMs forward their listening ports to the Mac automatically.

Guest ports forwarded to the Mac's localhost automatically, per VM (TCP and UDP), with portForwards rules in YAML; no forwards on a named network.

Allow and deny rules per network (protocol, address range, port), enforced by the Mac's packet filter outside the guest, even with the app closed. IPv4 only.

No firewall rules. Lima 2.3 can block a VZ guest from the Mac's loopback services (networkOpts.hostLoopback).

Per-network switches for DHCP, DNS, NAT44, NAT66 and IPv6 router advertisements, plus the subnet, IPv6 prefix, MTU and uplink.

A gateway, netmask and DHCP range per managed network; no switches for DNS, NAT or IPv6 router advertisements.

A built-in MCP server (Tech Preview), set up in one click for Claude Code, Codex, Cursor and other agents. They use only the VMs you open to them, to run commands, read, write and copy files, take snapshots and roll back, or see the screen. Local only, with every call logged.

limactl mcp (experimental, since 2.0) gives an agent file tools (list, read, write, replace, glob, search) and shell commands in one running VM, on its mounted project. It doesn't start, stop or snapshot VMs.

Per VM: Off (the default), View (state, screenshots, reading files) or Control (power, commands, files, snapshots, keyboard and mouse), set in VM Settings or with mvz set. Agents can't open a VM themselves, delete your snapshots, read stored passwords, or delete a VM you protected.

One instance per MCP server, named when it starts; the agent works in that VM and its mounts. No View or Control levels, approval prompts or audit log are documented.

AI sandboxes (Tech Preview): coding agents such as Claude Code and Codex run in a disposable Linux or macOS VM with a copy of your project, API keys kept on the Mac and allow-listed internet; you review the diff before it lands.

limactl shell --sync copies a project into a VM with no host mounts, runs the agent, and asks before applying its changes, with a diff view; 2.3 adds excludes. API keys go into the VM, and there is no network allow list.

Runs unattended with the app closed: VMs start at login, and High Availability restarts one that crashes. From 27.2.1, a watchdog, health checks and hooks restart VMs that stop responding.

limactl autostart starts a VM at login, or at boot with no user logged in through a LaunchDaemon (2.2), and launchd restarts it if its host agent exits. No guest health checks, watchdog or hooks.

Built in from 27.2.1: daily, weekly or on demand, to another drive or a network share, running VMs included, checked by SHA-256 and restorable on any Mac.

No backup feature. Copy the instance folder yourself, or keep known-good states as QEMU snapshots or clones.

USB passthrough for devices such as Zigbee or Z-Wave radios, security keys and serial adapters, reattached whenever the VM runs (from 27.2.1). No audio devices or webcams.

Not documented.

Free 30-day trial, no card needed. MacVisor 27 Pro is one-time: $59 for one Mac, $79 for two Macs (launch prices until 1 December 2026, then $69, $99), with every single-Mac feature and every 27.x update. MacVisor Business is $79 per Mac a year from 3 Macs ($119 from 1 December 2026), with new major versions, email support (first reply within 2 business days, IST) and help deploying through your MDM. Enterprise support by quote.

Free and open source under Apache-2.0.