3

What is the best way to set up two completely separated instances of the latest MacOS on one single MacBook?

I need this for a rather special work-private-setup. For security and compliance reasons, the most important criterion would be that these two partitions share absolutely nothing -- no OS, no apps, no data, no shared directories either on the disk itself or on external drives, no access to anything in the other installation, no inclusion in the other installation's time machine backups, ... just nothing ;-) When one instance is running it should be as close as possible to the other installation physically not being existent on the machine.

My approach would be creating two partitions, encrypting both of them and installing MacOS on each of them. Is there anything else that I have to do? I am aware of the downsides ("waste" of hard disk space, licensing issues of third party apps, etc.) of such an approach

If possible I would like to not virtualize one of the two installations due to the loss of RAM and CPU performance. The one thing I have in abundance though is disk space.

6
  • Use Virtual Machines.
    – Solar Mike
    Commented Dec 26, 2021 at 18:32
  • fstab can prevent mount of the 'other OS' See apple.stackexchange.com/questions/414678/… and apple.stackexchange.com/questions/205814/…
    – Tetsujin
    Commented Dec 26, 2021 at 18:38
  • I get a vague feeling that 2 encrypted partitions would both unlock at the same time.. though I can't prove it, don't have anything i can test on.
    – Tetsujin
    Commented Dec 26, 2021 at 18:51
  • On most hardware you are correct @Tetsujin the key escrow assumes one actor per OS - if you are admin, you are admin for all keys on the storage. Only virtualization can do this even half way correctly. Virtualization doesn’t really take any more RAM / CPU than dual booting in my experience - I’m not sure why you discarded that or list that as a drawback.
    – bmike
    Commented Dec 26, 2021 at 19:08
  • Putting “TIA” as a signature is discouraged as chit chat here -better to ask your question straight out - show your research, list your criteria, ask your question at the end of the body.
    – bmike
    Commented Dec 26, 2021 at 19:19

1 Answer 1

0

The operating system is not designed to offer this level of isolation, so you would want to use a virtualization solution like VMWare Fusion and run VM as separate instances and manage the firewalls / sharing preferences to preserve your boundaries.

We do this at work for dev ops / testing / light remote usage within the boundaries of the Apple OS EULA. A clean OS running only fusion has very low overhead on RAM and CPU and performs very well on both Intel and Apple Silicon hardware across all recent hardware since 2013.

To attack the heart of your “problem” - you can’t really isolate log files and application / OS on macOS but you can easily make home folders / DMG / encrypted file stores and isolate folders of files. For that, one OS is sufficient and you just have to be disciplined about storing keys outside of keychains that are amenable to brute force attacks. You really don’t want to let anyone have physical access to your files and when you dual boot, you give up that huge moat in one shot. If you’re OK with a “hostile user” reading the files and sure you can encrypt them, you might have options to single boot, but host / guest isolation is easier for most people to manage. Without knowing your threat model in depth, it’s hard to just say “do this” to secure your files.

Lastly, why not just install your “secure” OK on an external drive? Only bring that to the system when you know the power is off and the “work” OS is not running and can’t snoop on things?

5
  • thanks for your quick answer. This brings me to two follow-up-questions however: 1) Am I getting you right that from your experience it is not possible to instruct one installation not to mount the other one's partition as the keys required to decrypt both partitions are stored in a place that has to be accessible by both installations? 2) already tried virtual box but performance losses were too big. Will have a look at vm fusion if you say its overhead is really low. Can you avoid that that the real os has access to external drives or connected smartphones used by the virtual os? Commented Dec 26, 2021 at 19:31
  • @hitbyfrozenfire the performance of a virtual machine or machines will be limited by the host machine. If that is slow or has limited memory - like less than 8GB then it will be slow.
    – Solar Mike
    Commented Dec 26, 2021 at 19:42
  • @solar mike that is exactly my problem... I have more than enough disk space for two full installations but only 8 gb of ram which is why I was originally favoring parallel installations over virtualizations. If it turns out that the latter is the only way to really ensure my security and compliance needs then this will be what I have to go for though. Commented Dec 26, 2021 at 19:45
  • @hitbyfrozenfire so if you were to install two OS side by side, you wouldn’t run them both at the same time. With Fusion, you’ll get nearly all of the 8 GB for the guest. On our larger hosts - we do always find disk space to run out first - not CPU or RAM.
    – bmike
    Commented Dec 26, 2021 at 20:03
  • When I say macOS isn’t designed to isolate - any admin on any of the OS can break into storage / reset passwords, copy the data. Yes - you could choose to store sensitive user data in encrypted DMG, but if you are OK with that - just install one OS and use multiple users to encrypt the private items. You probably don’t need two OS to get 95% of the bang for your buck for data privacy if you only care about files and not reading log files, isolation of apps, etc…
    – bmike
    Commented Dec 26, 2021 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .