MacVisor vs. VMPal

macOS 14, 15, 26 and 27 from Apple's installers or your own IPSW, with accelerated graphics, and set up for you on macOS 27 (account, SSH and guest agent). Apple allows two macOS VMs at a time.

The latest macOS from Apple or your own IPSW, set up with no clicks on macOS 27. The same limit of two macOS VMs at a time, which VMPal states.

Any ARM64 distribution: a signed catalogue of cloud images (Ubuntu, Debian, Fedora, Rocky, Alma, openSUSE, Alpine and more) set up by cloud-init, or any ARM64 ISO. Rosetta runs x86-64 Linux programs.

One-click Ubuntu, Fedora, Kali, CentOS Stream and Pop!_OS, or any ISO, a terminal-only Ubuntu Server install, and Rosetta. No cloud images or cloud-init.

Windows 11 on ARM, installed unattended from Microsoft's ISO with your account, Remote Desktop, optional SSH, the guest agent, Secure Boot and a TPM 2.0 that BitLocker can seal to. Needs macOS 27.2; no GPU acceleration.

A core feature, on VMPal's own engine: installed for you, with TPM 2.0, Secure Boot, USB, Direct3D 11 and 12 and OpenGL 4.6, 120 Hz and Touch ID sign-in. Users report GPU crashes in its 0.x releases.

FreeBSD 15.1 and 16.0-CURRENT from FreeBSD's cloud images, with your SSH keys, the guest agent and snapshots. Console and SSH only, with no desktop, shared folders or clipboard.

Not supported.

FreeBSD- and Linux-based firewalls and routers, and appliances such as Home Assistant OS, booted as they are from their ARM64 images, with USB passthrough for Zigbee and Z-Wave radios.

No documented way to boot a firewall, router or appliance image as it is.

A signed catalogue of vendor cloud images (Linux and FreeBSD), or your own raw, ASIF or qcow2 image. cloud-init sets up your account, SSH keys, container runtime and home folder share from the New VM form or mvz create.

One-click installers for several distributions, with offline setup; cloud-init provisioning of your account, keys and runtime isn't a documented feature.

Docker, Podman, containerd or k3s, opt-in when you create the VM. The Docker or Podman socket and the k3s kubeconfig reach the Mac with no network setup.

Docker-compatible Linux containers on VMPal's own engine, without Docker Desktop: vmpal containers setup points Docker, Compose and Testcontainers at it.

macOS guests get accelerated graphics on the Mac's GPU. Linux and Windows guests have no GPU acceleration (Windows at any resolution on MacVisor's own display device). One display per VM.

Direct3D 11 and 12 and OpenGL 4.6 for Windows, OpenGL 4.1 for Linux and Metal for macOS, up to 5K and 120 Hz. One display per VM.

Clipboard, file transfer, port forwards, guest addresses and a clean shutdown over a virtual socket, with no network needed; VirtioFS shared folders, and Rosetta for Linux.

VMPal Tools: shared folders, clipboard, drag and drop, Mac shortcuts in Windows and Linux, Windows or Linux apps as Mac windows, per-VM sound and microphone, and Touch ID sign-in for Windows.

USB passthrough for devices such as Zigbee or Z-Wave radios, security keys and serial adapters, reattached whenever the VM runs (from 27.2.1). No audio devices or webcams.

USB devices for Windows, macOS and Linux guests on a Mac with macOS 27, assigned from a menu bar item.

A background service runs one process per VM, so VMs keep running when the app quits or the service updates. The app and the mvz CLI control the same VMs.

Each VM runs as its own Dock app, so a crash affects only that VM, and VMs can start in the background or at login. There is no background service that owns them.

Live (with memory) and disk-only snapshots of running VMs for every guest, near-free on APFS; suspend and resume; and shut down or suspend at logout, your choice.

Snapshots of running or stopped VMs, revert with a snapshot taken first, suspend and pause; closing a window saves the VM.

Templates and instant linked clones that store only their own changes; every cloud-image VM is a linked clone of its image.

Clones that use space only as they change, and vmpal run, which runs a command in a disposable clone. No template library: a "golden VM" is cloned instead.

Several storage locations on internal, external or network volumes; a running VM moves between them in one step (suspend, move, resume).

Several locations and external disks; a shut-down VM moves between them, or packs into one .vmpalvm file for another Mac.

The mvz CLI covers nearly everything the app does, from creating VMs to snapshots, networks, firewall rules and the MCP server, with --json output and documented exit codes.

The vmpal CLI: create, clone, set, start in the background, exec (as user or administrator), cp, run in a disposable clone, ui click, type and screenshot, snapshots and Hub scripts. No REST API.

mvz scripts a throwaway VM from a template (clone, start, exec, delete); no packaged CI runner integration yet.

Documented GitHub Actions and GitLab self-hosted runner setups around vmpal run, with exit codes for timeouts and failed runs.

NAT, bridged (also to a VLAN), and named shared and host-only networks, with up to four adapters per VM; every VM answers as <vm>.mvz.

Shared, bridged or host-only per VM, and a local network with the Mac and other VMs; no named network segments.

Creates 802.1Q VLAN interfaces on the Mac (tags 1-4094) for VMs to bridge to, or for a shared network to use as its uplink.

No 802.1Q VLAN interfaces.

Per-network DHCP with MAC-to-IPv4 reservations, by hand or made for cloud-init VMs automatically (within macOS 27's network limits).

No DHCP settings or address reservations documented.

TCP and UDP forwards on shared networks, reachable from other devices, plus per-VM forwards through the guest agent; Linux VMs forward their listening ports to the Mac automatically.

Port forwards from a port on the Mac to a VM, set in a VM's settings or with vmpal set; UDP isn't documented.

Allow and deny rules per network (protocol, address range, port), enforced by the Mac's packet filter outside the guest, even with the app closed. IPv4 only.

No firewall rules.

Per-network switches for DHCP, DNS, NAT44, NAT66 and IPv6 router advertisements, plus the subnet, IPv6 prefix, MTU and uplink.

No per-network DHCP, DNS, NAT or IPv6 controls.

A built-in MCP server (Tech Preview): Claude Code, Codex, Cursor and other agents use only the VMs you open to them, to run commands, read and write files, take snapshots and roll back, or see the screen. Local only, with every call logged.

Built in: agents see the screen, click and type, and run commands as a user or administrator, with one-click setup for Claude Code, Codex, Grok Build, Antigravity and others. VMPal types the stored sign-in password itself.

Per VM: Off (the default), View (state, screenshots, reading files) or Control (power, commands, files, snapshots, keyboard and mouse), set in VM Settings or with mvz set. Agents can't open a VM themselves, delete your snapshots or read stored passwords.

Agent control can be turned off per VM, or for every VM by an MDM policy; a separate view-only level isn't documented.

AI sandboxes (Tech Preview): coding agents such as Claude Code and Codex run in a disposable Linux or macOS VM with a copy of your project, API keys kept on the Mac and allow-listed internet; you review the diff before it lands.

Agents can work inside a VM or on the Mac, and vmpal run gives a disposable clone; no project copy, network allow list or reviewed diff.

Runs unattended with the app closed: VMs start at login, and High Availability restarts one that crashes. From 27.2.1, a watchdog, health checks and hooks restart VMs that stop responding.

VMs start in the background and at login; restart after a crash, a watchdog and health checks aren't documented.

Built in from 27.2.1: daily, weekly or on demand, to another drive or a network share, running VMs included, checked by SHA-256 and restorable on any Mac.

No scheduled backups or automatic snapshots; a VM can be packed into one .vmpalvm file by hand.

mvz over SSH controls VMs on a Mac you reach remotely, and Remote Desktop opens Windows VMs; no screen sharing of the Mac itself.

Remote Control: a Mac-to-Mac screen and input link over SSH, with no account or relay server, which an agent can also use for headless Mac minis.

Business and Enterprise include help deploying through your MDM, with sample profiles to pre-approve background items and Full Disk Access, a license script and update control; no in-app policy settings yet.

A license key file deployed by MDM, and policies in its License Manager: turn off agents, Hub scripts, crash reports, shared folders, clipboard and Remote Control, and pin a version.

Apple Silicon with macOS 27.

Apple Silicon with macOS 26 or later; USB passthrough needs macOS 27.

Free 30-day trial, no card needed. MacVisor 27 Pro is one-time: $59 for one Mac, $79 for two Macs (launch prices until 1 December 2026, then $69, $99), with every feature and every 27.x update. MacVisor Business is $79 per Mac a year from 3 Macs ($99 from 1 December 2026), with new major versions, email support (first reply within 2 business days, IST) and help deploying through your MDM. Enterprise support by quote.

Individual $69 for one Mac, or Team $99 per seat (3 seats or more), perpetual with one year of updates and support; renewal $59 per seat per year. 7-day money-back guarantee.