For homelabs on macOS
MacTain is a native Mac app for the self-hosted services your homelab relies on. See what's running, start a whole Blueprint with a click, and keep everything up to date, all without living in Terminal.
The app
MacTain is built with the GUI in mind. Your containers, Blueprints, images, data and secrets all live in one Mac app, with the details a click away.
Health, uptime, CPU and memory for everything that's running, with start, stop and restart right there.
Secure Egress Plus
Route selected containers through your own WireGuard VPN connection. Import your configuration, choose which containers to protect, and manage everything in the native app—without configuring a separate VPN sidecar.
Import a standard WireGuard configuration.
Assign individual containers or Blueprint components.
Secure Egress is designed to block protected workloads when VPN protection cannot be established.
(full-size image, opens in a new tab)No separate VPN sidecar is needed to use MacTain’s Secure Egress. Import your own WireGuard configuration and assign the containers or Blueprint components you want to protect. MacTain manages the VPN gateway and protection enforcement. You still choose and configure your VPN provider or WireGuard endpoint.
Compose to Blueprint Plus
Most homelabs begin as a compose.yaml copied from a project's README. MacTain converts the parts it supports into a Blueprint, a readable file you can review, edit and run.
# compose.yaml
services:
jellyseerr:
image: fallenbagel/jellyseerr:latest
ports:
- "5055:5055"
environment:
- TZ=America/New_York
volumes:
- jellyseerr_config:/app/config
sonarr:
image: lscr.io/linuxserver/sonarr:latest
ports:
- "8989:8989"
environment:
- TZ=America/New_York
volumes:
- sonarr_config:/config
- /Users/Shared/Media/TV:/tv
volumes:
jellyseerr_config:
sonarr_config:
[blueprint]
schema = "mactain.blueprint/v2"
name = "mediastack"
[defaults.component]
env = { "TZ" = "America/New_York" }
[[resources.volumes]]
id = "jellyseerr_config"
type = "local"
[[resources.volumes]]
id = "sonarr_config"
type = "local"
[[components]]
id = "jellyseerr"
kind = "container"
image = "fallenbagel/jellyseerr:latest"
ports = [
{ host = 5055, to = 5055, type = "tcp" }
]
mounts = [
{ volume = "jellyseerr_config", to = "/app/config" }
]
[[components]]
id = "sonarr"
kind = "container"
image = "lscr.io/linuxserver/sonarr:latest"
ports = [
{ host = 8989, to = 8989, type = "tcp" }
]
mounts = [
{ volume = "sonarr_config", to = "/config" },
{ type = "bind", source = "/Users/Shared/Media/TV", to = "/tv" }
]
MacTain converts the common parts of Compose: images, ports, environment, volumes and bind mounts. Some settings assume a shared Docker host and have no equivalent when each container runs in its own lightweight VM, such as network_mode: host, privileged, devices (for example /dev/dri for hardware transcoding), cap_add and pid: host. The converter warns about each one and leaves it out of the Blueprint, so read the warnings before you start it.
Under the hood
MacTain is built on Apple Containerization. Your containers don't share one big Linux VM. Each one boots in its own small virtual machine, with a minimal Linux kernel and a tiny init process, and the MacTain Engine creates and controls each one.
If something breaks out of a container, it's still inside that container's own VM, walled off from macOS and from your other services. The Engine runs as you, not as root. You get the protection rootless containers aim for, with nothing extra to set up.
Mount just the folders a service needs from your Mac.
An optimized kernel and a minimal root filesystem keep each VM light.
Made for always-on
Launch at login, autostart the containers you choose, and set startup delays so services come up in order.
Build from a Dockerfile or Containerfile right on your Mac, then run it like any other image.
Follow live logs on Free. Plus keeps history across stops, failed starts and restarts.
Local Domains and service-name discovery, so you stop memorizing port numbers.
You never need it to use MacTain. But if you like to script things, the mactain CLI drives the same Engine as the app, with JSON output where you need it.
CLI reference →# Define and start a container in one step
$ mactain container start \
--name hello-web \
--image docker.io/library/nginx:latest \
--publish 8080:80 \
--detach
Container started: hello-web
$ mactain container list
$ mactain container logs hello-web
# Bring a Compose file across
$ mactain blueprint convert compose \
--input compose.yaml --output mediastack.toml
$ mactain blueprint plan ./mediastack.toml
Selected components (2): jellyseerr, sonarr
- create jellyseerr (image: fallenbagel/jellyseerr:latest)
- create sonarr (image: lscr.io/linuxserver/sonarr:latest)
$ mactain blueprint start ./mediastack.tomlPricing
$0
$39.99 USD a year
Try Plus free for 14 days. No credit card.
Compare plans