How to Run Whonix on macOS Apple Silicon (+ Pre-Built Images Included)

Whonix Logo

There are pre-built Whonix images floating around online, but most of them are outdated and you can never be fully sure where they came from. If you care about what you’re actually running, building from source is the way to go.

There are also a bunch of guides out there that cover this process, but a lot of them are incomplete or have steps that just don’t work — which leads to failed builds and a lot of frustration. This guide has been tested through roughly 3 full builds and works consistently.

Step 1: Create a Debian arm64 VM in UTM

Instead of setting up Debian manually from an ISO, grab the ready-made image straight from the UTM Gallery:

https://mac.getutm.app/gallery/debian-12-rosetta

Open UTM, click the gallery link above, and import the image. It’ll drop you into a working Debian 12 arm64 environment without having to go through a manual install.

A few things to check before you continue:

Don’t enable GPU acceleration — it causes crashes.
Storage: make sure the VM’s storage folder is somewhere you can easily find it later, since the final Whonix images will end up there.

Once the VM is running, open a terminal and run:

sudo apt update && sudo apt install spice\-vdagent spice\-webdavd dosfstools

Then set the hostname to host:

sudo hostnamectl set-hostname host

Step 2: Prepare the Build Environment

Install the required dependencies:

sudo apt update  
sudo apt install git time curl approx lsb\-release fakeroot dpkg\-dev fasttrack\-archive\-keyring safe\-rm

Configure passwordless sudo

Note: If you’re using the UTM Gallery image, you may already have sudo set up correctly and can skip this. That said, it doesn’t hurt to run it anyway.

su  
sudo adduser user sudo          # replace "user" with your actual username  
reboot

After rebooting:

bash

echo '%sudo ALL=(ALL:ALL) NOPASSWD:ALL' | sudo EDITOR=tee visudo -f /etc/sudoers.d/dist-build-sudo-passwordless >/dev/null

Clone the derivative-maker repo

cd ~  
git clone --depth=1 --branch 18.1.4.2-developers-only --jobs\=4 --recurse-submodules --shallow-submodules git@github.com:Whonix/derivative-maker.git  
cd derivative-maker

Before you run anything, check the current stable version at https://www.whonix.org/wiki/Dev/Build_Documentation/images (or the forum news). If there’s a newer stable branch like 18.x.x.x-stable, swap the branch name accordingly.

Step 3: Build Whonix

Both builds run inside your Debian VM. They take a long time — don’t close the terminal.

Important: Don’t build the Gateway and Workstation at the same time — run them one after the other, otherwise you may run into issues. Also keep in mind that the build time can vary a lot, anywhere from 25 minutes to a few hours depending on your machine — on an M5 Pro MacBook it took around 25–35 minutes per image.

Gateway:

~/derivative-maker/derivative-maker \\  
  \--flavor whonix-gateway-lxqt \\  
  \--target utm \\  
  \--arch arm64 \\  
  \--tb open \\  
  \--repo true \\  
  \--vmsize 15G

Workstation:

~/derivative-maker/derivative-maker \\  
  \--flavor whonix-workstation-lxqt \\  
  \--target utm \\  
  \--arch arm64 \\  
  \--tb open \\  
  \--repo true \\  
  \--vmsize 25G

Once both builds finish, you’ll have the UTM-ready Whonix images in your VM’s storage folder.

Getting them onto the host is a separate problem — shared folders, SBM, and other UTM file transfer methods tend to be unreliable in practice. What actually worked was uploading the images directly from inside the Debian VM to MEGA (mega.nz) and downloading them on the host from there.

If you just want the pre-built images, you can grab them here: https://mega.nz/folder/X3w0lAQB#rTsMsUUH2zgofMzg_Z3vEw — these are the images I built myself following this exact guide. That said, if you don’t trust me or need a different version, just build it yourself using the steps above.

Known Issues

Depending on the version you build, you may run into some quirks. On the version shown in this guide (18.1.4.2), there are known problems with installing Tor Browser directly inside the Whonix Workstation — the installer can fail or behave unexpectedly. The good news is that Tor routing through the Gateway works fine regardless, so your traffic is still being routed through Tor as intended.