Modes

Mode	What it gives the guest
`nat`	An address on a private network, sharing your Mac's connection. The default, and what you want almost always.
`host-only`	A network with the Mac and nothing else. No outbound internet.
`bridged:en0`	An address on your real LAN, as though the guest were another machine on it.

1vm create dev --network nat
1vm set dev network.mode host-only
1vm set dev network.mode bridged:en0

NAT

The 1VM engine ships a first-party user-mode NAT stack — DHCP, DNS and TCP/UDP translation — rather than delegating to an external network daemon. The guest gets an address automatically and outbound connections just work.

1vm ip <vm> prints the address, and 1vm list shows it alongside state. A machine that has booted but not yet completed DHCP reports as waiting rather than pretending to have an address it does not have.

Port forwarding

Most of the time you do not have to declare anything. A Linux guest with current guest tools reports the TCP and UDP ports it is listening on, and those are published on your Mac's loopback address automatically — on both the Apple engine and the 1VM engine. The machine's Ports tab lists what is published right now, and so does the command:

1vm ports dev

Host ports are owned by whichever process bound them first, and that is decided by the kernel rather than by 1VMTool. If something on your Mac already holds a port, the forward is reported as a collision instead of replacing the existing socket.

Explicit forwards still work, and are the answer when you want a fixed host port or a guest whose tools cannot report:

1vm set dev portForwards.add tcp:2222:22
1vm set dev portForwards.add tcp:8080:80
1vm set dev portForwards.remove tcp:8080:80

The form is protocol:hostPort:guestPort.

Published ports bind loopback only by default — reachable from your Mac, not from the rest of your network. Exposing a machine's ports to the LAN is a deliberate per-machine choice, and the defaults for new Linux machines live in Settings → Resources, or 1vm config-global. If you need the guest itself to hold an address on your network, use bridged networking instead.

Containers are separate: ports published by Docker belong to the engine running them, and the Containers page counts them for you. See Docker.

Bridged is entitlement-gated

Bridged networking needs the com.apple.vm.networking entitlement, which Apple grants on request. Without it, bridged shows in the interface as unavailable with a reason rather than being hidden or failing at boot. That is deliberate: an option that vanishes tells you nothing about why.

SSH

SSH is a first-class path rather than something you configure by hand:

1vm ssh enable dev
1vm ssh config --install     # adds an Include line to ~/.ssh/config
ssh dev                      # plain ssh now resolves the machine name

1vm ssh trust dev pins the guest host key, and --relearn re-pins it after you rebuild a machine. If you clone a machine that will run alongside its parent, use 1vm clone dev test --rekey-ssh so the two do not present the same host key.