Install / Upgrade
Running a Chefer-packaged app needs nothing — the single file is self-contained. You only need Chefer to package apps yourself.
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/TimLai666/chefer/main/scripts/install.sh | sh# Windows (PowerShell)
irm https://raw.githubusercontent.com/TimLai666/chefer/main/scripts/install.ps1 | iexThe installer detects your OS/arch, downloads the matching package, verifies its sha256, installs to ~/.chefer (or %LOCALAPPDATA%\chefer), and adds it to your PATH. Open a new terminal, then chefer version. Pin a version with CHEFER_VERSION=v0.5.0 ($env:CHEFER_VERSION on Windows). On macOS, allow the unsigned binary in System Settings → Privacy & Security on first run. Already have Chefer? Just run chefer upgrade — it swaps the binary and the whole kit/ together.
macOS users, please take this build: the previous
v0.4.0arm64 appliance kit shipped an x86-64 busybox and could not boot. This release fixes it.
Highlights
macOS is now a first-class target (validated on real Apple Silicon, on by default)
- Full
vz(Virtualization.framework) micro-VM backend: VM boot, virtiofs, exit-code propagation, TCP + UDP port forwarding, multi-servicedepends_on,persist_pathacross restarts, and defaultbridgeoutbound (pasta → VZ NAT, including in-container DNS). - GUI apps: native
VZVirtualMachineViewwindow +cage/Xwayland display, keyboard/mouse HID, and a bidirectional clipboard (text + PNG). - Live dynamic resolution + HiDPI (default on macOS 14+): resize the window and the guest genuinely re-modesets to follow it, with the Retina output scale applied so cursor/UI sizes stay correct.
- The old
CHEFER_VZ_EXPERIMENTALopt-in is gone —vzgates on the real preconditions (host arch, embedded appliance, embedded helper, macOS 13+) and reports honestly when one is missing. (Intel Macs share the same code path with an x86_64 appliance, but their VZ boot hasn't been exercised on real hardware.)
GPU passthrough (opt-in gpu: true)
- Native Linux NVIDIA: host-driver-version-matched userspace lib injection (nvidia-container-toolkit parity),
nvidia-smibound into the container, NVENC/NVDEC — validated on a real RTX 4070 (CUDA + NVENC). - WSL2 NVIDIA (
/dev/dxg+/usr/lib/wsl/{lib,drivers}) — validated on a real GT 1030 (CUDA). - AMD (ROCm) and Intel GPU node passthrough; per-service card selection (
gpu: [0, 2], hard isolation) andgpu: all/nonealiases.
Packaging / networking
source: imageprivate-registry auth (docker loginplainauths/CHEFER_REGISTRY_AUTH).- Docker-parity
/etc/resolv.confinjection into service containers — hostnames resolve even when the base image ships no resolv.conf. - GUI overlay now ships as a read-only squashfs that is mounted instead of unpacked each boot (~200 MB less per GUI launch).
- Windows WHP: in-container DNS, host↔guest clipboard image sync, and helper anti-orphan (Job Object + stdin-EOF self-termination).
Real-hardware fixes
- arm64 appliance initramfs was cross-built with an x86-64 busybox (kernel panic on boot) → now fetches the correct-arch
busybox-static; CI gained an arm64 appliance boot-smoke to block this class of regression. - Extraction now restores tar exec bits (bundled agents were EACCES), the runtime port proxy no longer double-binds against the vz relay, and the GUI init exports PATH.
Full changelog: v0.4.0...v0.5.0