Johnny Matthews | Basic Multipass setup on MacOS

I generally prefer to install things locally. However, over the past three-or-so years, there has been a huge uptick in attacks targetting developers by infiltrating their local NPM, Pip, or insert-package-manager-here directories. I’m not gonna get into how these attacks work in this post, but I am gonna lay out my method for protecting myself on MacOS by using Multipass. This was written on 7th of August 2025.

What is Multipass

Multipass is a straight-forward virtual machine (VM) management application from Canonical (the folks who make and maintain Ubuntu). Basically, Multipass lets you run Unix-based oses straight from the terminal on Apple silicon. Applications like QEMU, VirtualBox, and VMWare let you do this already, but I find Multipass to be the simpliest approach if you don’t care about GUIs or GPU-accessiblity or anything like that.

Sidenote: I wrote another guide called Create a Pen Testing Ubuntu VM that uses Multipass, but it kinda skims over everything in favour of installing Kali-tools. This guide is a more general-purpose guide that more people might find useful (hopefully). There’s also another guide that covers how to install GUI tools on Multipass VMs that you might find useful.

Steps

We’re gonna run through three things here:

  1. Installing Multipass.
  2. Adding the tab-completion for Multipass (which I wrote, so that’s cool).
  3. Spinning up a virtual machine.

Install Multipass

This is probably the easiest step since all you need is Homebrew.

  1. Check you’ve got Homebrew installed:

    brew --version
    Homebrew 4.6.0
  2. Install the Multipass cask:

    brew install --cask multipass
  3. Check that Multipass got installed correctly:

    multipass --version
    multipass   1.16.0+mac
    multipassd  1.16.0+mac
  4. Done!

Add tab-completion for ZSH

This step is optional but useful if you, like me, end up with tens of VMs sat in Multipass. All we’re doing is setting up ZSH so that when you type multipass shell/start/stop/delete/whatever and hit TAB, the terminal will autocomplete your available options (in this case VM names). If you’re interested, take a look at the git repo.

  1. Create a completions dir if you don’t have one already:

    mkdir -p ~/.config/zsh/completions
  2. Download the completion file into that dir:

    wget -O ~/.config/zsh/completions/_multipass https://raw.githubusercontent.com/johnnymatthews/multipass-zsh-autocomplete/refs/heads/yolo/_multipass

    If you’ve not got Wget installed (and don’t wanna install it), use Curl like a pleb:

    curl -o ~/.config/zsh/completions/_multipass https://raw.githubusercontent.com/johnnymatthews/multipass-zsh-autocomplete/refs/heads/yolo/_multipass
  3. Add these lines to your ~/.zshrc:

    fpath=(~/.config/zsh/completions $fpath)
    autoload -Uz compinit && compinit

    I don’t think it matters where you put these lines, but it might. Ask your local Gen AI bot.

  4. Reload ZSH:

    source ~/.zshrc
  5. Done.

Make a Ubuntu box

Now for the fun stuff.

  1. Create a VM with custom specs:

    multipass launch --name my-dev-box --cpus 2 --memory 4G --disk 30G

    This gives your virtual machine 2 CPUs, 4GB of RAM, and 30GB of disk space; which is usually enough for most situations. That being said, I’m running an M4 MacBook Air with 24GB of RAM so I usually give my VMs 8GB of RAM and 4 CPUs with 30GB of disk space.

  2. Check that your VM is running:

    multipass list
    Name                    State             IPv4             Image
    my-dev-box              Running           192.168.64.2     Ubuntu 24.04 LTS
  3. Shell into your new VM:

    multipass shell my-dev-box

    You should now be inside your Ubuntu VM. The prompt will change to something like ubuntu@my-dev-box:~$.

  4. Install whatever you need without worrying about mucking up your host machine:

    sudo apt update && sudo apt upgrade -y
    sudo apt install nodejs npm python3-pip git -y
    npm install --global some-sketchy-package

    If you break something, just delete the VM and start again.

  5. When you’re done, exit the VM:

    exit
  6. Stop the VM to save resources:

    multipass stop my-dev-box

    Tack on the --all option if you can’t be arse typing out your VM name:

    multipass stop --all
  7. Delete the VM entirely once you’re done with it:

    multipass delete my-dev-box --purge

Done! You’ve now got a sandboxed Ubuntu environment to use for testing sketchy packages or just keeping your local environment clean.

Set up proper SSH

While you can always enter your VM using multipass shell ... there are gonna be certain situations where you wanna SSH into the thing; say you’ve created a different user that you wanna access or something like that. Follow this, fairly standard, process to copy your public SSH key to your new box.

  1. Generate your SSH key on your host (i.e. your MacOS machine), if you haven’t already:

    ssh-keygen

    Follow the promts to create a key.

  2. Copy your new public-key to your clipboard:

    cat ~/.ssh/id_ed25519.pub | pbcopy

    Make sure you select your .pub key here. Any file in the ~/.ssh directory is a private key, and you don’t wanna touch them.

  3. Start your Multipass VM (if you haven’t already) and shell into it:

    multipass start my-dev-box && multipass shell
  4. Enter this command, substituting <YOUR_PUBLIC_KEY> for the one in your clipboard:

    echo "<YOUR_PUBLIC_KEY>" >> ~/.ssh/authorized_keys

    Make sure to keep the double-quotes "". For example:

    echo "ssh-ed25519 AAAA39SKIELQIJDNB5UISIE39OIWLSHB5OEI1099ILLDSMRNABIISU/IEJW9S289SKWJ johnny@macbook
  5. Exit that shell:

    exit
  6. List your Multipass VMs and grab the IP address:

    multipass list
    Name                    State             IPv4             Image
    my-dev-box              Running           192.168.64.2     Ubuntu 24.04 LTS
  7. Login to the VM again, but this time over SSH now:

    ssh ubuntu@192.168.64.2

    ubuntu is the default user that Multipass makes for it’s VMs. You can create a new user the usual adduser workflow.

That’s it! Wasn’t that fun. If you have any questions, ask your faviourite Gen AI assistant.