What is it

container is Apple’s open source tool for running Linux containers on macOS (Apple silicon). It works like docker or podman, but it’s built on top of Apple’s virtualization framework and designed to integrate with the OS in a more native way. It recently reached it’s 1 year anniversary and 1.0 release.

v1.0 came with the container machine command (youtube link), which lets you create and manage persistent Linux VMs. However, despite being very comfortable living in the terminal, I wanted a more visual way to explore and manage containers, machines, and images without having to remember all the CLI commands.

ContainerManager is a native macOS app that helps you interact with containers in a more visual way. It’s not a wrapper that shells out to the CLI, instead it links container’s own Swift client libraries and talks to the same background services directly, so the lists and actions are the same ones the container command uses under the hood. (It does still call the CLI for a few things: starting/stopping the services, building images, and opening a shell in Terminal.)

What it isn’t

ContainerManager isn’t a full featured container management solution, it’s more of a playground for learning and exploring the container tool and how containers work on macOS. It’s not trying to be Docker Desktop or podman or anything like that, it’s just a way to interact with the Apple container tool in a more visual way. YYMV, caveat emptor, etc 🙂.

What it does

The day-to-day stuff, without reaching for the man pages:

• Machines - create and run persistent Linux VMs, edit their boot config, view logs, and drop into an integrated terminal (or Terminal.app) without leaving the app.
• Containers - create, run, start/stop/kill, view logs, and exec into a shell.
• Images - pull from a registry, build from a Dockerfile right in the app, and turn any image straight into a container or machine.
• Networks and Volumes - the usual create / inspect / delete.
• System - see whether the services are running and start/stop them, plus a bit of guided setup to get the container tool installed and its base environment sorted if it isn’t already.

Stacks

“Stacks” is a feature that lets you stand up a few containers together as a unit (e.g. WordPress + a database) from a template or a custom builder, with the networking wired up for you. This isn’t a full compose implementation, but it’s something and let’s you get a multi-container setup running with a couple of clicks so you can explore how the containers interact with each other without having to write a bunch of CLI commands or YAML.

Requirements

• Apple silicon Mac
• macOS 26
• v1.0.0 of the container tool installed (ContainerManager will offer to grab it for you if it’s missing)

How to Get

It’s on GitHub: bartreardon/ContainerManager-App. Grab a build from the releases page.

It’s early days - it works but expect a rough edge here and there.

Found a bug or have an idea? Open an issue. 🙂

AI Disclaimer

ContainerManager was created with the assistance of AI, specifically Claude (Fable, while it existed, otherwise Opus) using nothing but the base Pro plan, using a combination of the Claude app for planning and scaffolding and the Coding Assistant in Xcode for writing and debugging code.

Opinionated opinion

This isn’t a post about AI however I feel that it’s important to be transparent about the tools I used to build ContainerManager. I used AI to help with some of the coding and debugging, but the design and overall direction of the app was me and was willed into existance because of my own ideas and desires. For me, AI isn’t a means to an end but a way to kickstart the process, something that I can often struggle with when turning my ideas into reality. I don’t buy into the hype, but this is a “force multiplier” (for want of a better term) for the way I work.

AI doesn’t replace human creativity, but it can be a useful tool to help with some of the more tedious or repetitive aspects that come with app development. I used it as a way to speed up the development process and get past roadblocks and help with documentation. As a tool for getting past all the donkey work, LLM’s are quite powerful. I say this with my own opinions that while LLM’s as a technoligy are facinating and, IMO, here to stay, how models are trained, source material and energy usage are real problems that exist today and need to be addressed. I don’t have the answers to those problems, but I think in time they are solvable. Time will tell, and hopefully RAM prices will drop.

In macOS 26 Tahoe, one of those broke.

TL;DR

I wrote an app/swift package that lets you easily add a folder of images to System Settings -> Wallpaper under macOS 26

It’s here WallpaperFolderManager

If you’re interested to know why, read on

Simpler Times

For setting a desktop background there’s nothing easier than desktoppr. Install the package, give it a nice image and boom, background set. It does more than that of course. You should head over there and check it out.

If you want to dump a bunch of images on the drive so people can select a random one there are a couple of options:

Plonk everything into /Library/Desktop Pictures/

This one is easy. Create /Library/Desktop Pictures/ if it doesn’t exist then fill it with images.

The problem with this is the images appear in System Settings -> Wallpaper -> Pictures after all the built in pictures. To see any of them you have to click “Show All” and then scroll past all the included pictures before you get to your custom ones.

Edit ~/Library/Preferences/com.apple.systempreferences.plist

This was a little more convoluted but still easy.

As a user you can add these yourself. In System Settings -> Wallpaper, clicke the “Your Photos” -> “Add Photo…” button, select “Choose Folder” and then select your folder of images. This places them in their own section at the bottom underneath the “Colours” section but they are at least visible with the folder name and preview of the images within.

From a script you could create this link by modifying the plist:

/usr/libexec/PlistBuddy -c "Add :DSKDesktopPrefPane:UserFolderPaths: string '/opt/Org Name/Org Pictures'" ~/Library/Preferences/com.apple.systempreferences.plist

This adds an item to the nested DSKDesktopPrefPane -> UserFolderPaths array.

% defaults read ~/Library/Preferences/com.apple.systempreferences.plist
{
    ...
    DSKDesktopPrefPane =     {
        UserFolderPaths =         (
            "/opt/Org Name/Org Pictures"
        );
        VisibleAlbums =         (
        );
    };
    ...
}

The defaults command is relatively unwieldy for this so we use PlistBuddy instead. This works fine from macOS 13 to macOS 15.

macOS 26 - Because why do things the simple way?

In macOS 26 the configuration now lives in ~/Library/Containers/com.apple.wallpaper.extension.image/ with a bunch of embedded plists as data blobs and some other configuration and there is a daemon called WallpaperAgent looking after it. Unsure if this is new in macOS 26 but I’m aware of it now.

Managing the new config from a shell command using defaults or plistbuddy would be rather annoying at best as there is a lot to consider and get right. I know this becasue I initially tried to work out where the settings were changed so I could get our custom folder of desktop backgrounds working. Shout out to FSMonitor which gave some rather enlightening discoveries.

When life gives you lemons, write a swift app

Enter WallpaperFolderManager (names are hard ok)

WallpaperFolderManager is a swift utility/package that handles all the work of creating the necessary files, plists, encoding etc required to be able to programatically add in a folder path to System Settings -> Wallpaper. It will create the required config and then restart cfprefsd and WallpaperAgent

Note: At the time of writing I’m not aware of any public API’s that hook in to container management. If there is one, let me know

Usage

# Add a folder
wallpaper-folder add ~/Pictures/Wallpapers

# Add a folder with verbose output
wallpaper-folder add ~/Pictures/Wallpapers --verbose

# Add a folder without restarting services
wallpaper-folder add ~/Pictures/Wallpapers --no-restart

# List registered folders
wallpaper-folder list

# List with verbose output (shows IDs and dates)
wallpaper-folder list --verbose

# Remove a folder
wallpaper-folder remove ~/Pictures/Wallpapers

# Show help
wallpaper-folder --help
wallpaper-folder add --help

Results

Before:

After: % wallpaper-folder add ~/Pictures/My\ Pics

Note: Requires closing and re-openeing System Settings if it was open to read the new settings

Caveats

I’ve tested this on macOS 15 and macOS 26. It should work on macOS 13 and 14 but I haven’t tried. On the older OS’s it falls back to modifying the com.apple.systempreferences which is (AFAIK) the same on macOS 13->15

It doesn’t support macOS 12 or earlier (and neither should you)

How to Get

Go to the releases page

There is a signed and notarized pkg (installs to /usr/local/bin) or standalone binary

It is also availabe as a swift package if you want to include this functionality in your own app. Simply add to your Package.swift:

dependencies: [
    .package(url: "https://github.com/bartreardon/WallpaperFolderManager.git", from: "1.0.0")
]

Today I pushed a new release of Outset with a couple of neat new features

Get it at https://github.com/macadmins/outset/releases

What is Outset?

If you’re new, Outset is a utility application which automatically processes scripts and packages during the boot sequence, user logins, or on demand. It is as alternative to creating and deploying custom launchd plists for a subset of common use cases, namely device start and user login events. Outset 4 is a swift rewrite of the origional which was written in python. It is maintained and released under Mac Admins Open Source

A while ago it was suggested we could add support for outset to run scripts deployed from a config profile. This required a bit of thought to implement in a nice way but I think what we have should work for most use cases.

Some considerations that were made:

• Profile delivered scripts should disable local scripts
• Scripts should not be directly exposed in the UI
• Support for multiple profiles to enable conditional profile (and therefore conditional scripts) for MDM’s that have that capability

Script security

The first point has a similar function to deploying a profile with a shasum of local scripts in that the presence of the config item disables scripts not identified from running. As a security feature this is useful to effectively disable local script execution. In addition, this is only supported for MDM delivered profiles. Payloads added to local preferences are ignored (except when using --debug which is intended for testing)

So that scripts are not direcetly visible in the macOS UI, the script is base64 encoded and deployed as data. In System Settings -> General -> Device Management this will appear something like this:

"login-every" =
{
"Test Script" = {length = 96, bytes
= 0x49794576 596d6c75 4c33707a 61416/4b ... 62475569 43676f3d};
};

Reading the contents using defaults returns

% defaults read /Library/Managed\ Preferences/io.macadmins.Outset.plist
{
    "script_payloads" =     {
        "login-every" =         {
            "Test Script" = {length = 96, bytes = 0x49794576 596d6c75 4c33707a 61416f4b ... 62475569 43676f3d };
        };
    };
}

This should protect script content from casual observers however absolute security cannot be guaranteed and determined individuals will still be able to discover the complete base64 encoded string and decode it.

Multiple profile support

Supporting multiple profiles was tricky. macOS will happily load multiple profiles for the same preference domain but if two profiles contain the same parent key then at best, only one will load but I believe the behaviour is undefined. To get around this, profiles can be created with custom parent keys, prefixed with script_payloads.

This means you can have a single profile with script_payloads or multiple payloads each with a custom keyname, e.g. script_payloads_testers, script_payloads_common, script_payloads_VIP etc and deploy one or ore of these to devices as needed.

More details are available in the Payloads page on the Outset wiki.

One drawback from this method though is that tools like ProfileCreator and iMazing Profile Editor or Jamf Pro custom schemas will not be able to support arbitary payload keys (apart from that, Jamf Pro Custom Schemas don’t support data as an object type which makes it impossible to use for script payloads). I’ll be looking at the Profile Manifests project to see if there is a compromise that can be made here.

What next?

Outset will continue to be maintained to make sure it is current and works on modern versions of macOS in an expected way.

If you have any feedback, feature requests or have notices a bug or issue, please create an issue on the Outset github project page

You can also come chat in the #outset channel in the MacAdmins Slack 🙂

🎉 An API 🎉

I’m still catching up on WWDC news but as this one ticks a huge box for my workloads, here’s the quickest of quick start guides …

From now on I’m going to use the term ABM to refer to both Apple Business Manager and Apple School Manager

Source documentation can be found at on the Apple School and Business Manager API developer web page and contains comprehensive information on what API’s are available. You should read that to get all the details on the features that have been added.

Quick Start

1 - Creating an API key

• Log on to your ABM
• On the bottom left, click your name and select “Preferences”

• There should be a new section in your profile called “API”. Click on that

  

• You will see a list of API accounts (or none if you don’t have any already). Click the “+” button to create a new API Account

  

• Give your API a new label, e.g. “My API”, then click “Create”

  

• Click the “Generate Private Key” button. The new key will be created and downloaded.
  • Note: This key is private and should not be shared. Keep it safe. You can’t re-download it but you can revoke it and create a new API key.

  

2 - Getting your details

Once created, your new API account will appear in the lsit of accounts. You can create more than one.

Click “Manage” to see the relevant details you will need, namely:

• Key ID
• Client ID

Write these down for the next step, but you can get them at any time from this section.

3 - Using the key to create a Client Assertion

Unlike other API’s where you encode some account credentials and then request a bearer token, Apple requires you create a JSON web token (JWT) using your API Key. Details on how to do this are on the Implementing OAuth for the Apple School and Business Manager API page.

Apple provide a handy python script you can use to generate the client assertion. If you are using this on macOS you will need the following:

• Python 3 (installed if you have xcode or command line tools installed)
• authlib library
• Crypto library

Copy and save locally as create_client_assertion.py

To get the two required librariues you can run the following:

pip3 install authlib PyCryptodome

Don’t install crypto or pycrypto as those don’t have ECC which is required in the Apple python script.

update the following with the values that you got earlier from your API account:

private_key_file = "private-key.pem"
client_id = "BUSINESSAPI.9703f56c-10ce-4876-8f59-e78e5e23a152"
team_id = "BUSINESSAPI.9703f56c-10ce-4876-8f59-e78e5e23a152"
key_id = "d136aa66-0c3b-4bd4-9892-c20e8db024ab"

ZSH Script:

If you don’t want to use python, I’ve ported the script to zsh as create_client_assertion.sh

It works exactly the same as the python script. You can pass in your client id and private key or hard code them in.

Creating the client assertion:

To create your client assertion file, place your private key in the same folder as your script and run:

python:

python3 create_client_assertion.py

zsh:

./create_client_assertion.sh 
# or if your values aren't hard coded
./create_client_assertion.sh "path_to_key.pem" "<client_id>" "<key_id>"
# where path_to_key.pem is your private key
# and <client_id> and <key_id> are your values from ABM

You should get a file client_assertion.txt with contents that looks something like:

eyJhbGciOiJFUzI1NiIsImtpZCI6ImQxMzZhYTY2LTBjM2ItNGJkNC05ODkyLWMyMGU4ZGIwMjRhYiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJCVVNJTkVTU0FQSS45NzAzZjU2Yy0xMGNlLTQ4NzYtOGY1OS1lNzhlNWUyM2ExNTIiLCJhdWQiOiJodHRwczovL2FjY291bnQuYXBwbGUuY29tL2F1dGgvb2F1dGgyL3YyL3Rva2VuIiwiaWF0IjoxNzQ5NjI5MTEwLCJleHAiOjE3NjUxODExMTAsImp0aSI6IkZBODBGMzI1LTk1NUMtNDIzMy04NDIyLUM0ODBERDEzNjc5RSIsImlzcyI6IkJVU0lORVNTQVBJLjk3MDNmNTZjLTEwY2UtNDg3Ni04ZjU5LWU3OGU1ZTIzYTE1MiJ9.cM4boKJ8xvLeN0fiMEDLeCdxyVizQuHLucuGaUAo5w7aeyhIgvug7tmnDxJwiS0AdRYW8FY7Lu97ufmYSGhKmQ

This will be valid for 180 days so you don’t need to run this process every time you want to use the ABM API.

4 Accessing the API

Finally - seems like we’ve done a lot so far but we’re at the business end now.

Once you have your client assertion you can use it to generate a bearer token and then start fetching data from ABM.

#!/bin/zsh

# Client assertion
client_assert="nQuYXBwbGUuY29tL2F1dGg...etc...RYW8FY7Lu97ufmYSGhKmQ"
# Client ID from API Account
client_id="BUSINESSAPI.9703f56c-10ce-4876-8f59-e78e5e23a152"

# make the request
request_json=$(curl -s -X POST \
-H 'Host: account.apple.com' \
-H 'Content-Type: application/x-www-form-urlencoded' \
"https://account.apple.com/auth/oauth2/token?grant_type=client_credentials&client_id=${client_id}&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=${client_assert}&scope=business.api")

# <insert validation checking here>

# presuming everything worked
ACCESS_TOKEN=$(echo $request_json | jq -r '.access_token')

## Fetch all organisational devices:
curl "https://api-business.apple.com/v1/orgDevices" -H "Authorization: Bearer ${ACCESS_TOKEN}"

Presuming the client assertion process worked you should now see a json representation of your devices from ABM as described in the API reference documentation

The access token will be valid for 1 hour after creation after which it will expire and you will need to create a new one if needed.

For more comprehensive details, do go and read Apple’s official documentation: https://developer.apple.com/documentation/applebusinessmanagerapi

🙂

I’ve written about issues with deploying too many system agents before but in a managed environment some things are unavoidable. We can do some things to make them better behaved though, and ensure that usability of the system by the human at the keyboard is prioritised over other processes.

The main issue is that a lot of agents install with default performance settings and as such, will compete for system resources on equal footing with user apps and other processes.

A greedy system agent might want to wake up on a certain schedule and consume as much CPU as it can before going back to sleep. While running, CPU usage can spike, the system can become sluggish and the user experience can become degraded.

As a sysadmin, we want to balance system performance so we can meet any security or management requirements while minimising the impact to the end user trying to actually do work.

What is Nice

Nice, in BSD terms, is a property that informs the OS how “nice” the process should be to other processes on the system when it comes to system resources like CPU usage. This can range from -20 to +20. If unset, the default is 0.

https://www.manpagez.com/man/3/nice/

The higher the value, the “more nice” a process can be with regard to giving up resources to higher priority tasks. Given a limited resource, macOS will prioritise processes with lower (i.e. less “nice”) nice values.

Note that this does not limit the resources a process can use, only how the process is scheduled by the OS. If a process wants to use 100% CPU and 100% of CPU is available then the OS will allocate it. If a higher priority task comes along though then resources will be re-allocated as required.

From a sysadmin perspective, this means you can set the nice property on running system agents and let the OS manage the resources, so for example if your video conference app has a higher priority than your inventory collection daemon, the latter won’t interfere as much as it would if they both had the same priority, but if the system is idle, the system agent will be able to ramp up and complete its tasks.

Making a process behave nicely

launchd has a property in the agent/daemon plist that can set this:

<key>Nice</key>
<integer>5</integer>

…however most of the time you don’t want to be maintaining this directly for third party launchd plists (although you can if that’s what you really want to do). Instead we can use the renice command to set the nice property of an existing process like so:

pid=$(pgrep -f "$PROCESS_NAME")
renice +20 -p "$pid"

This will set the nice property of the identified process to the highest value and nearly every other process on the system will take precedence. If you have particularly resource hungry processes, this can improve user experience in the UI quite a bit, while letting the system agent do its thing. The nice value will also applies to any child processes the agent might spawn.

You can validate the nice value of a running process by running:

ps -o ni= -p "$pid"

Disclaimer: Running renice on third party software should have no issues but you should verify that doing so doesn’t have any adverse effects on how the software needs to operate. Testing and validation is very much recommended.

The last time renice was mentioned on the MacAdmins Slack was in 2019 so I figured it was worth blogging about.

Limiting CPU resources

While we can’t set CPU resources directly, like “use 10% CPU only” we can limit the process on Apple Silicon macs to run on efficiency cores only. Howard Oakley has a great writeup on that on the Eclectic Light Company blog

To do this we can use the taskpolicy command like so:

taskpolicy -b -p "$pid"

This will limit the process to running on efficiency cores only, further improving resource utalisation for low priority tasks.

Tying things together

Here is a script that can perform all the above. It takes a process name as an argument and optionally a nice value in the range of -20 to +20. (link)

This would need to run after the system has booted and agents are running. An option would be to use this with an Outset login-privileged-every task, but could also run from an MDM or other device management framework automatically or on request.

#!/bin/bash

# Script to renice processes.

# Author: Bart Reardon
# Date: 2025-04-24
# Version: 1.0

## Description:
# This sets the priority of processes to the specified value.
# It will check for the process every 60 seconds and renice it if found.
# If the process is not found, it will retry for a maximum of 10 times.
# If the process is not found after 10 retries, it will exit with an error.
# Log output is written to /var/log/renice-<process_name>.log

# Usage: ./renice-process.sh <process_name> [nice_value]
# Example: ./renice-process.sh 'MyProcess' +10

# Process name will match any process name that contains the string.
# For example, if the process name is 'MyProcess', it will match 'MyProcess', 'MyProcess2', 'MyProcess3', etc.


PROCESS_NAME="$1"
NICE_VALUE="${2:-+10}" # Default to +20 if not provided
# If using in a jamf script:
# PROCESS_NAME="$4"
# NICE_VALUE="${5:-+10}" # Default to +20 if not provided

# Constants
RETRY_INTERVAL=60 # seconds
MAX_RETRIES=10 # maximum number of retries
TOTAL_RUNTIME=600 # seconds (10 minutes)
START_TIME=$(date +%s)

print_usage() {
    echo "Usage: $0 <process_name> [nice_value]"
    echo "Example: $0 'MyProcess' +10"
}

# check if running as root
if [ "$(id -u)" -ne 0 ]; then
    echo "This script must be run as root. Please run with sudo."
    exit 1
fi
# check PROCESS_NAME is not empty
if [ -z "$PROCESS_NAME" ]; then
    echo "Process name is required."
    print_usage
    exit 1
fi
# NICE_VALUE needs to be in the range -20 to +20
if ! [[ "$NICE_VALUE" =~ ^[-+]?[0-9]+$ ]] || [ "$NICE_VALUE" -lt -20 ] || [ "$NICE_VALUE" -gt 20 ]; then
    echo "nice_value must be an integer between -20 and +20."
    print_usage
    exit 1
fi

# log file
LOG_FILE="/var/log/renice-${PROCESS_NAME}.log"
# Create log directory if it doesn't exist
mkdir -p "$(dirname "$LOG_FILE")"

write_log() {
  local message="$1"
  # echo to stdout
  echo "$message"
  # echo to log file
  echo "$(date +'%Y-%m-%d %H:%M:%S') - $message" >> "$LOG_FILE"
}

# Function to renice  processes
renice_process() {
    pids=$(pgrep -f "$PROCESS_NAME")

    if [ -n "$pids" ]; then
        # echo to stderr to avoid confusion with stdout
        write_log "Found one or more processes for ${PROCESS_NAME}:"
        for pid in $pids; do
            write_log "Evaluating $(get_process_name "$pid") with PID $pid"
            # Check if the process is already reniced to the desired value
            if [[ $(get_nice_value "$pid") -eq "$NICE_VALUE" ]]; then
                write_log "Process $pid already has nice value of ${NICE_VALUE}. Skipping..."
                continue
            fi
            /usr/bin/renice ${NICE_VALUE} -p "$pid"
            /usr/sbin/taskpolicy -b -p "$pid"
            write_log "Reniced process $pid to ${NICE_VALUE} priority and limit to E cores only"
        done
        return 0
    else
        return 1
    fi
}

# Return the current nice value of a given PID
get_nice_value() {
    ps -o ni= -p "$1"
}

# Return process name of a given PID
get_process_name() {
    ps -o comm= -p "$1"
}

# Main loop
retry_count=0
write_log "Starting renice script..."
while true; do
    CURRENT_TIME=$(date +%s)
    ELAPSED_TIME=$((CURRENT_TIME - START_TIME))

    if [ "$ELAPSED_TIME" -ge "$TOTAL_RUNTIME" ]; then
        echo "Maximum runtime (10 minutes) exceeded.  Exiting."
        exit 1
    fi

    renice_process
    return_code=$?

    if [[ $return_code == 0 ]]; then
        echo "${PROCESS_NAME} process reniced successfully."
        break
    else
        echo "${PROCESS_NAME} process not found. Retrying in $RETRY_INTERVAL seconds..."
        sleep "$RETRY_INTERVAL"
        retry_count=$((retry_count + 1))

        if [ "$retry_count" -ge "$MAX_RETRIES" ]; then
            echo "Maximum retries reached. Exiting."
            exit 1
        fi
    fi
done

Extra Credit

If we were talking about a Linux system using systemd, we can be quite explicit about setting process priority and resource limitations.

For example for a systemd process foo we can create an override that is persistant and sets the values we want:

sudo systemctl edit foo

will create /etc/systemd/system/foo.service.d/override.conf

In that we can say something like:

[Service]
CPUWeight=5
CPUQuota=10%

And the process, and child tasks, will be hard limited to 10% utilisation.

If only this type of override were possible in launchd, but unfortunatly for us, it’s not 🙂 (that I’m aware of - very happy to be corrected)

I was thinking recently about very large shell scripts and ways to make them more compact for use in Jamf or other MDM’s for macOS.

So I nerd sniped myself made a script that compacts other scripts.

Why

This came to mind when working with Installomator which in version 10.8 is 517Kb in size and over 11k lines long.

This isn’t a problem in reality but things like the inline editor in the Jamf Pro UI tend to choke on stuff like this. Large scripts aren’t that uncommon in this context but half a meg is pretty large. Not that compressing and encoding the script helps any since the resulting data is pretty uneditable.

How

The solution I came up with is pretty simple:

• Use bzip2 compression at level 9 to compress the entire script
• Use base64 encoding to convert the compressed data to ascii
• Store the data as a blob in another script that performs the decompression and execution

Initially I did this by moving things into and out of temp files but that has the potential to leave junk behind if something doesn’t work as you would expect and cleanup doesn’t happen but fortunatly we can do everything with pipes.

Creating the data representation of the target script is pretty easy and we can use bzcat to do the compression and pass the result to base64 to encode:

data=$(/usr/bin/bzcat -zk9 "$inputFile" | /usr/bin/base64 -w120)

Once we have that, we just do the reverse and execute. This can be done as a one liner:

# base64 decode the data blob
# pipe through to bzcat to decompress
# pipe through to a zsh subshell with any arguments

/usr/bin/base64 -d -o - <<< "$data" | /usr/bin/bzcat | /bin/zsh -s "$@"

This worked pretty well and in the case of the Installomator script reduced from 517Kb, 11,179 line file to 122Kb, 1038 lines.

Where

Here’s my script that takes another script as an argument and creates the compacted version, ready to run.

compress.sh

#!/bin/zsh

# compress a script into a bzip2 compressed base64 encoded blob

inputFile="$1"
outputFile="$2"
if [ -z "$inputFile" ]; then
    echo "Usage: $0 <input-file> [<output-file>]"
    exit 1
fi
if [ -z $outputFile ]; then
    outputFile="${inputFile%.*}.bz2.sh"
fi
filedata=$(/usr/bin/bzcat -zk9 "$inputFile" | /usr/bin/base64 -w120)

scriptData=$( cat <<-EOF
#!/bin/zsh

# This is a bzip2 compressed base64 encoded script of ${inputFile}
# that will be decoded and executed in a subshell.

data="${filedata}"

/usr/bin/base64 -d -o - <<< "\$data" | /usr/bin/bzcat | /bin/zsh -s "\$@"
EOF
)

# write the script to the output file
echo "$scriptData" > "$outputFile"
chmod +x "$outputFile"
echo "Created compressed script: $outputFile"

Conclusion

Is this useful? Who knows. Maybe some scripts will hit a limit of what can be stored or delivered using MDM processes or maybe you just want to obfuscate the contents of a script or protect it from modification.

This was created more as a thought exercise but maybe someone has a use for it. There’s no harm in putting this out there and just the process of thinking about a problem and finding a solution is a neat thing to do.

Related

Speaking of scripts that may or may not have any utility but were fun to think about and create, this is my script for creating self extracting scripts that extract themselves to a given target location.

Maybe useful if you need to install a script somewhere but can’t (or don’t want to) create a .pkg to do the deployment for you.

At least a first post hosted on github.io (for as long as the .io TLD still exists)

Every other post on this site was migrated over from wordpress. Issues over there as well as the fact that I created this github.io 3 years ago with the intention of using it make for a good time to do this.

Step 1 - Exporting everything from wordpress

This is relatively easy.

Log on to wordpress, Tools -> Export and then select “Export All”

You will then get a download of your site as an XML file called yoursitename.wordpress.2024-10-08.000.xml or something to that effect

Step 2 - Converting everything to markdown

This is also relatively easy (everything here was run under macOS 15)

• Install brew
• run brew install node.js
• rename your wordpress xml to export.xml and put it in a handy folder somewhere
• cd to the folder where your export.xml file is and run npx wordpress-export-to-markdown --post-folders=false --prefix-date=true
  • follow the bouncing ball. this will create a folder called Output and all your posts and images will be downloaded and converted to markdown format

Step 3 - Moving it all to github.io

This one will take some finessing. I followed Chad Baldwin’s post here which if you follow will create a https://yourname.github.io site using the minima jekyll theme

Clone your repo locally and copy over your generated markdown files and images to the _posts directory.

From there you can modify the theme, or if you’re handy about it, use another theme. I’ll probably tinker with this one over time but for now it’s pretty much Minima with some css overides to add background and modify some other elements. Developer mode in whatever browser you use (I use Safari) is super handy for tweaking rather than trying to edit css, publish, wait for github actions to generate the pages, realise you missed something, rinse and repeat.

The Future

This makes adding a new post as easy as creating a new file in YYYY-MM-DD-post-title.md format and then editing as I see fit. When I’m ready I can commit and push the changes.

I also have to go over the older posts and do some minor edits as not all the images are displaying but that’s something I’ll use as inspiration to make future posts and perhaps fill in the blanks from the past year or so to add some “new old stock” posts about things that have happened the last time I posted something.

Happy Blogging 🙂

I rarely get the chance to attend converences outside Australia so this was a great opportunity to meet some of the people I’ve only ever interacted with online. I also got to speak about swiftDialog and Outset.

Mat X and team did a great job on the event. All the videos are up on youtube so you can check them out on the MDO channel

Here’s my presentations:

swiftDialog workshop

swiftDialog Open Source Journey

Outset 4 - The New Stuff (Quick Talk)

Looking forward to the next time I can attend in person 🙂

In May 2024, I spoke at X World Melbourne about the journey of creating and maintaining open source software. I was also able to give a workshop on how macadmins can get started using swiftDialog. This was the first time I had given a workshop and it was a great experience with some great feedback. This wasn’t recorded for X World but I did give the same workshop at the MacDevOpsYVR conference in Vancouver in June which was recorded and is available on the MDO youtube channel.

So You Want to Make an Open Source App

This talk is for those that are thinking about releasing their work as open source or anyone that wants to know what goes in to creating and supporting free software.

I’ll go over topics from creating something from scratch, taking over an existing project or even contributing to someone elses work. I’ll then look at options for publishing your work, what licenses are in use, getting access to resources like Macadmins Opensource (https://macadmins.io). Lastly I’ll look at the realities of ongoing maintenance, what to expect, how to interact with your customers, how, as a customer, to interact with developers and other highs and lows of running an open source project.

Watch here

swiftDialog is an open source admin utility app for macOS 11+ written in SwiftUI to allow bash or python (or other) scripts to display popup dialogs, provide user interaction and other workflows.

This talk will go through what swiftDialog is as an introduction to newcomers as well as go over some of the new features present in swiftDialog 2 and finish off with some demonstration workflows and Q and A if time allows.

Watch here