If I use a docker run command like this it works, the known hosts and the ssh-agent work.

bash
  docker compose run -it --entrypoint "app" --no-deps --remove-orphans \
  -v /run/host-services/ssh-auth.sock:/agent.sock \
  -v ~/.ssh/known_hosts:/root/.ssh/known_hosts:ro \
  -e SSH_AUTH_SOCK=/agent.sock \
  app.local install

I can't get the same thing to work in a docker compose file. The know hosts file work but my key is not forwarded into the running container.

yml
  environment:
      SSH_AUTH_SOCK: /agent.sock

  volumes:
      - ~/.ssh/known_hosts:/root/.ssh/known_hosts:ro
      - /run/host-services/ssh-auth.sock:/agent.sock

I also tried $SSH_AUTH_SOCK instead of the /run/host-services/ssh-auth but also without any success. On my host machine $SSH_AUTH_SOCK is set and it points to an active socket (/var/run/com.apple.launchd.xxxxxxxxx/Listeners) The key is added to the agent and is listed using ssh-add -l I can't figure out why it does not work. Does anybody have any suggestions? orbstack Version 2.0.5 (19905) MacOS 26.4 (25E246)

Hey everyone, I'm trying to work around an irritating bug in a container I need where it doesn't like the default host IP 0.250.250.254. I can't seem to override it using the host-gateway-ip attribute in the Docker engine config:

unable to configure the Docker daemon with file /etc/docker/daemon.json: the following directives are specified both as a flag and in the configuration file: host-gateway-ip: (from flag: [0.250.250.254], from file: 172.30.0.1)

Is it possible to change the one passed via the flag somehow? https://cdn.discordapp.com/attachments/1492239899158380554/1492239899879931954/Screenshot_2026-04-10_at_21.07.44.png?ex=69da9c34&is=69d94ab4&hm=9d7dc22de542d8ec1489e48c5e52b98d0fc3d224dd768ac864a3fcad8a852d20&

When I try to create a VM with

orb create nixos

I get the dreaded error

[-32098] create 'nixos': make rootfs: image not found: {nixos 25.05 default}

When instead I do

orb create nixos:25.11

the command succeeds. All of this despite the fact that the Orbstack GUI lists only the versions 25.05 and Unstable (see screenshot). What's going on here? Is my Orbstack install corrupted? Many thanks for any help. PS: I'm under a macOS Tahoe host on an ARM machine. https://cdn.discordapp.com/attachments/1493900710083956787/1493900710264176760/Screenshot_2026-04-15_at_6.52.48_pm.png?ex=69e0a6f4&is=69df5574&hm=9a576f70467367868de273085190a2a8110a4571f16bc8e7a5c0b7a2469c4b4d&

When I try to add a new Linux machine, I'm getting: create 'ubuntu': make rootfs: download metadata: GET download status: 404 Not Found Any ideas to get it running? https://cdn.discordapp.com/attachments/1494653683579879484/1494653683718164540/Screenshot_17.04.2026_um_12.58.44_PM.png?ex=69e36437&is=69e212b7&hm=e59d69f13811e6ec738c94cfcff7ebcd8673fa2e931cdde6219a50ccdae96ef7&

Has anyone gotten nfs clients to work inside orbstack machines? Has anyone gotten iSCSI initiators to work inside orbstack machines? Has anyone managed to bind-mount an nfs-mount on the host Mac so it works reliably? I'm running out of ideas on how to get my TrueNAS data sets into Orbstack machines and make it work.

🐧 system | thread '<unnamed>' panicked at src/startup.rs:867:18:
🐧 system | called `Result::unwrap()` on an `Err` value: ENOSPC: No space left on device
🐧 system | note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Version: 2.1.1 (2010100)
Commit: 5938f7b0d94c0f51823fa763326a74302524c332 (v2.1.1)

Filesystem has 80GB+ left

The failed request shown below is for a context where the machine is an OrbStack hosted virtual running Ubuntu; the container was started by compose. I started debug successfully where the context machine is a cloud based machine at DreamCompute running Ubunutu; the container was created directly from a Docker image (no compose). I also got a failure where the context machine is a Raspberry PI; no compose here either. Please help. Let me know if I need to provide additional information or if there are diagnostic steps I can take. Thanks. "~ orb debug -c rvfyi mosquitto + pull image: [Docker] unknown: failed to resolve reference "api-registry.orbstack.dev/wormhole:1.0.0": unexpected status from HEAD request to https://orbstack-wormhole.46b92b876b97ec1d51081cf9af4132b9.r2.cloudflarestorage.com/manifests/1.0.0?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=b2b21c0f188ee60657b1bc068beea420%2F20260516%2F%2Fs3%2Faws4_request&X-Amz-Date=20260516T215945Z&X-Amz-Expires=600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=8f05af4e1fc9a9b6590516033345ff8325f324d534cf2b66dba2655a203d857a: 403 Forbidden"

After using MacOS's APP to migrate all data from old macbook to the new one? https://cdn.discordapp.com/attachments/1506539942556205086/1506539942778638407/image.png?ex=6a0ea228&is=6a0d50a8&hm=312e6789c3444e634581ecaa09cb51741ddc84bd5f0838153d0271d0ec0c6f79&

in the fix listed in v2.1.2 patch notes is not working for me. pressing any key does nothing. i have to right click the container and open a terminal in new tab. pls fix

UI: Fixed machine terminal sessions not restarting

https://cdn.discordapp.com/attachments/1507003906973110432/1507003907308650516/image.png?ex=6a105242&is=6a0f00c2&hm=5d05707a00621d284265f98b98d6d6463d46903d38d3c8ddd2651c684b14b66d&

It looks like the latest release removed the possibility to access mapped ports (e.g.,

-p 127.0.0.1:2638:2638

) on localhost and is forcing the bridge device on us – is that on purpose? Because this is a huge problem for us to the point that we can't use OrbStack anymore. The Python version we use (https://github.com/astral-sh/python-build-standalone) can't resolve .orb.local hostnames (

gaierror: [Errno 8] nodename nor servname provided, or not known

), the IPs change all the time, and we use OrbStack to run a local database, so we need to be able to configure it to something static. Any workarounds?

After a recent update of orbstack (2.2.0), it seems that accessing a site through it's entry in /etc/hosts results in

err_connection_reset

... not sure where the failure is, but I'm putting this out there in-case someone else has solved it faster than I have...

Summary Launching OrbStack reliably kernel-panics the Mac within ~1 minute. Because OrbStack auto-starts at login, this produced a panic→reboot→panic loop (machine unusable until OrbStack was disabled). Every panic is in the

OrbStack Helper

(VM manager) task, with kernel heap corruption in zone

data.kalloc.1024

. Environment - OrbStack: 2.2.1 (build 20628) - macOS: 27.0 (build 26A5353q) — pre-release/beta seed - Hardware: Mac mini

Mac16,10

, Apple M4 (SoC T8132) - Kernel:

Darwin 27.0.0: xnu-13361.0.0.501.1~2/RELEASE_ARM64_T8132

Reproducibility: 100%. 7 panics in ~30 min, every one triggered by OrbStack starting (6 on login auto-start; 1 when I manually invoked

orbctl

). Panic fires within ~60s of the engine starting.

In the alpine edge VM, this happens when I try to link an executable from macOS:

alpine:/Users/luke/src/foo$ mac link jj
Permission denied. This command must be run as root. (hint: use sudo?)
alpine:/Users/luke/src/foo$ sudo mac link jj
sudo: mac: command not found

USB CDC ACM device 303a:1001 binds to cdc_acm and creates /sys/class/tty/ttyACM0, but no /dev/ttyACM0 is created, and manually mknod’d 166:0 returns EPERM even as root. When I attach the device through the UI and run

dmesg

, I see this output:

[271430.202155] usb 1-1: Product: USB JTAG/serial debug unit
[271430.202157] usb 1-1: Manufacturer: Espressif
[271430.202165] usb 1-1: SerialNumber: 98:A3:16:8F:84:F8
[271430.205751] cdc_acm 1-1:1.0: ttyACM0: USB ACM device

So the device is successfully being identified by the kernel but I'm unable to access it.

I stumbled across the announcement that sound is now passed through to linux machines and containers. Great news! While it works already on the linux machine I tested, the same did not work for a container. I followed the docs but got an error. Steps to reproduce:

bash
docker run --rm -it ubuntu:latest
# inside docker
apt update && apt install alsa-utils
speaker-test -t wav -c 2

this produces

speaker-test 1.2.15.2

Playback device is default
Stream parameters are 48000Hz, S16_LE, 2 channels
WAV file(s)
ALSA lib confmisc.c:855:(parse_card) [error.core] cannot find card '0'
ALSA lib conf.c:5207:(_snd_config_evaluate) [error.core] function snd_func_card_inum returned error: No such file or directory
ALSA lib confmisc.c:422:(snd_func_concat) [error.core] error evaluating strings
ALSA lib conf.c:5207:(_snd_config_evaluate) [error.core] function snd_func_concat returned error: No such file or directory
ALSA lib confmisc.c:1342:(snd_func_refer) [error.core] error evaluating name
ALSA lib conf.c:5207:(_snd_config_evaluate) [error.core] function snd_func_refer returned error: No such file or directory
ALSA lib conf.c:5730:(snd_config_expand) [error.core] Evaluate error: No such file or directory
ALSA lib pcm.c:2722:(snd_pcm_open_noupdate) [error.pcm] Unknown PCM default
Playback open error: -2,No such file or directory

Any ideas on what I might be doing wrong? This is on Version 2.2.1 (20628)

When I try to do docker run I get the following error: docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF: unknown Looks like there’s already an existing issue for this: #2522

OrbStack appears to report incorrect filesystem capacity and available space for certain APFS volumes mounted into containers. Applications inside containers see incorrect free space values, while macOS reports the correct values. This can potentially lead to applications incorrectly believing that the disk is full. __Environment__ Hardware: Mac Mini M1 macOS: Sequoia 15.7.4 (Orbstack has full disk space access) OrbStack: 2.2.1 Filesystem: APFS Docker containers: qBittorrent, Overseerr __Reproduction steps__ Create an external APFS volume with a total capacity of approximately 20 TB. Mount the volume into a container: volumes: - /Volumes/Data:/data Enter the container and run: df -h /data __Expected behavior__ The container should report approximately: Filesystem Size Used Avail mac 18T 2T 16T matching the values reported by macOS. __Actual behavior__ Inside the container: Filesystem Size Used Avail mac 2.2T 1.9T 348G On macOS: df -h /Volumes/Data returns: Filesystem Size Used Avail /dev/diskXsY 18Ti 1.8Ti 16Ti __Additional information__ APFS reports the following: APFS Container Capacity Ceiling: 20.0 TB Capacity In Use By Volumes: 2.0 TB Capacity Not Allocated: 18.0 TB It appears OrbStack may be exposing the "Capacity In Use By Volumes" value as the filesystem size instead of the APFS container capacity. Other mounted volumes exhibit correct behavior, albeit with a lower capacity (6 TB and 4 TB). The issue affects multiple applications suggesting it originates from the filesystem layer rather than individual applications. Thanks for looking into this! Edited for proper formatting

Insider the debian vm launched by Orb I am getting this.

❯ sudo apt update
sudo: /etc/sudo.conf is owned by uid 501, should be 0
sudo: /etc/sudo.conf is owned by uid 501, should be 0
sudo: /etc/sudoers is owned by uid 501, should be 0
sudo: no valid sudoers sources found, quitting
sudo: error initializing audit plugin sudoers_audit

Who knows whats up? Version 2.2.1 (20628)

It appears that any VM launched with OrbStack runs with vm.overcommit_memory=1 and there’s no sysctl.d for it. I’m wondering where it is coming from / why is it enabled? I don’t get the same setup when using podman / docker on a Linux box. So a couple questions regarding this behavior; - where is it set? Seems to come from vinit - Why 1 specifically? - Can I opt into a different mode (and persist it) - What else diverges from a stock Linux box? - Could there be a “prod-fidelity” mode? The issue I’m encountering was debugging an allocation bug that I was hitting in production but could not replicate locally. Thanks for your work on this awesome project

I recently added a second payment method to my account, and I notice that I have been charged twice for the same transaction (as shown in the attached screenshot). Could you please look into this and process a refund for the duplicate charge? https://cdn.discordapp.com/attachments/1522067473749381310/1522067474063818762/SCR-20260702-iust.png?ex=6a471f4c&is=6a45cdcc&hm=d869164afe895d857d94c4d83fe1607bb97ed8fb2159ccdaa684f3ceb8182dab&

Hi, I'm using the latest OrbStack on macOS (Apple Silicon). Docker Engine works correctly. Here are my findings: - docker info works - docker run mcr.microsoft.com/hello-world works - curl https://registry-1.docker.io/v2/ returns HTTP 401 normally - Docker socket is normal - VM is running correctly However Docker Hub images consistently fail: docker pull hello-world → EOF docker pull alpine → EOF docker login → EOF Some Quay images also fail with EOF while already downloaded images run correctly. Current OrbStack config: network_proxy: auto docker info shows: HTTP Proxy: http://proxy.orb.internal:8305 HTTPS Proxy: http://proxy.orb.internal:8305 Is this a known issue related to proxy.orb.internal or registry manifest fetching? Thanks!

Hello, what's the best practice to enforce NetworkPolicy in Orbstack currently ? I tried going the Cilium route (the release note for 0.5.0 says it's supported) but couldn't make it work 🙁

Hi! I'm having a Docker registry issue on OrbStack 2.2.1. System: - OrbStack 2.2.1 - macOS 26.5.2 - Apple M4 - Docker Engine 29.4.0 Diagnostic report: https://orbstack.dev/_admin/diag/orbstack-diagreport_2026-07-04T13-00-45.573900Z.zip Problem: Docker can reach registries, but pulling many images fails with EOF or Bad Gateway. Examples: docker pull hello-world EOF docker pull alpine EOF docker pull ubuntu EOF However, some registries/images work: ✅ mcr.microsoft.com/hello-world ✅ quay.io/prometheus/busybox Already downloaded images also run correctly. For example: docker run --rm quay.io/prometheus/busybox echo success works fine. Things already checked: - Different networks (home Wi-Fi and China Mobile hotspot) - Cisco VPN enabled/disabled - curl to registry-1.docker.io works (HTTP 401 as expected) - auth.docker.io works - DNS resolution works - Docker login reaches Docker Hub - Docker daemon is healthy - OrbStack engine is running normally - Docker context is correct - Existing images run normally Running orb report also prints: ERRO failed to get scon info: panic: sconrpc ready event fired but socket was not connectible but the diagnostic report uploads successfully. Any ideas what could cause Docker registry pulls to randomly fail with EOF?

Will orbstack be supporting this soon? Mac has supported this since the M3s

Since v2.2.1, Docker Compose projects are split into multiple groups by dependencies instead of being shown as a single project. This affects the usability of the UI for larger Compose projects. GitHub issues: * #2537 * #2550 * #2551 Is this a known bug or an intentional UI change?

Critical data loss after OrbStack update ☀️ Hi everyone, I updated OrbStack this morning to version 2.2.2. Immediately afterwards, my Docker/OpenProject installation lost all of its data. Symptoms: OpenProject was working correctly before the update. After the update, orb list is empty. ~/OrbStack appears to have been recreated today. Docker volumes are gone. PostgreSQL was reinitialized with a fresh database. I did not intentionally reset OrbStack or remove any volumes. I have already generated and uploaded the OrbStack diagnostic report. This installation contains critical data for my project, I had spent days configuring OpenProject workflows 😭. Is there any way to recover the previous VM, disk, Docker volumes or storage used before the update? 😭 thank you all in advance for your help 🩷

Hello Why the heck is is orbstack hiding the .img file from TM by default? who thought this was sa good idea to begin with? Data should always be safe first THEN you worry about disk usage not just the docker image but even the volumes the datastore are not backed up! hello? this a product you selling to companies, promoting to users and by default it will NOT have any backup anywhere! backblaze skip it , you disabled timemachine by default this is unacceptable and show incompetence by the team in the decision making process I lost a DB with more then 50GB of data thanks to someone thought they were the smartest person in the room, evidently they were not.

I have an ESP32 device that successfully shows up as

/dev/ttyACM0

in my Docker container if I manually attach it (passthrough doesn't work). However, if I unplug the device while it is still attached and then plug it back in, it still shows as "attached" in the UI but I have to detach and attach again for it to show up in the Docker container.

like trying to build an image that only uses public images