Connect a Self-Hosted Mac to Bitrise CI Guide

Published November 11, 2026 • Figment editorial team

For a Bitrise DEN self-hosted agent, request a Figment M-series Mac (from $95/month; physical provisioning is request-based and the exact chip, RAM, and disk are confirmed in the quote). If you want the machine set up for you, the Managed Build Mac at $249/month includes one M-series Mac, CI setup, backups, monitoring, and 30 minutes of monthly support. The $29/month virtual Intel macOS VM (2 vCPU, 8 GiB RAM, 80 GiB disk) can host a DEN agent for pipelines that build with Intel-compatible toolchains, including supported Xcode 26 or earlier releases; pick an M-series Mac for Apple-silicon-only tooling.

Bitrise cloud macOS stacks are convenient until concurrency slots fill up during release crunches. A self-hosted DEN (Dedicated Environments Network) agent routes those same builds to a Mac you rent, on a flat monthly line item, with tooling you control. This guide registers one Figment Mac in a Bitrise runner pool, routes an app to it, and works a real break-even against your current Bitrise minutes bill.

Primary references used here: Bitrise's DEN on-premise runners documentation and Apple's porting macOS apps to Apple silicon note on Intel Xcode support.

When a Self-Hosted Agent Actually Pays Off

Bitrise cloud machines are a sensible starting point. The move to self-hosted makes sense when one or more of these is true:

Builds routinely queue for several minutes during working hours.
Engineers coordinate pushes to avoid colliding with release pipelines.
Your monthly cloud-minutes bill for macOS is already approaching the price of a dedicated Mac.
You need a specific Xcode, Ruby, or system library the cloud stack does not ship.

Bitrise's documentation is explicit that the DEN agent is not plug-and-play: you install the toolchain you need. On a Figment Mac the base macOS is in place; Xcode, CocoaPods, and Fastlane install once and persist between runs.

Prerequisites Before You Touch the Mac

Confirm these before running any install commands:

Workspace Owner or Admin role on bitrise.io, which is required to create a runner pool and copy its intro secret.
Shell access to the Figment Mac. Browser-based terminal access ships with every Figment plan; inbound public SSH for a physical M-series Mac is set up on request, so confirm your access path in the quote.
Outbound HTTPS from the Mac to https://den.services.bitrise.io and https://build-log.services.bitrise.io (the two endpoints the agent actually talks to).
Homebrew installed, and Xcode plus the Command Line Tools installed and licensed (sudo xcodebuild -license accept).

In Bitrise, go to Workspace settings → Self-hosted agents, create a runner pool (for example, figment-m-series), and copy its agent intro secret. You will paste it once, during daemon install.

Install and Register the DEN Agent

Run these on the Figment Mac. The commands match the current Bitrise install instructions:

# Add the Bitrise DEN tap and install the agent + Bitrise CLI
brew tap bitrise-io/den-agent
brew install bitrise-den-agent
brew install bitrise

# Register the launchd daemon. Replace YOUR_INTRO_SECRET with the pool token.
sudo "$(brew --prefix)/bin/create_bitrise_daemon.sh" \
  --bitrise-agent-intro-secret=YOUR_INTRO_SECRET \
  --enable-agent-self-update

The script writes a launchd plist and starts the service. Confirm the agent is up:

sudo launchctl list | grep bitrise
curl -sI https://den.services.bitrise.io | head -1
curl -sI https://build-log.services.bitrise.io | head -1

A missing process or a connection error on either endpoint explains an "offline" status in the Bitrise UI; a HTTP/2 200 or redirect is expected. Do not open these endpoints in any upstream allowlist unless the firewall is yours to change — Bitrise has no published IP allowlist to maintain on their side.

Route an App to the Self-Hosted Pool

Routing has two parts. The pool assignment in the Bitrise web UI is the authoritative control.

Assign the pool. In bitrise.io, open the app → Settings → Stacks & Machines and select the self-hosted runner pool you created. New builds for this app will dispatch to agents in that pool.
Optional: declare intent in bitrise.yml. For multi-app templates or review visibility, add a meta block. The exact machine_type_id value depends on your workspace tier, so copy it from the UI rather than inventing one:

format_version: "13"
default_step_lib_source: https://github.com/bitrise-io/bitrise-steplib.git

meta:
  bitrise.io:
    # Copy stack and machine_type_id strings from the app's Stacks & Machines tab.
    stack: osx-xcode-16
    machine_type_id: <value from the Bitrise UI>

app:
  envs:
    - BITRISE_PROJECT_PATH: MyApp.xcworkspace
    - BITRISE_SCHEME: MyApp

workflows:
  build_and_test:
    steps:
      - activate-ssh-key: {}
      - git-clone: {}
      - cocoapods-install: {}
      - xcode-build-for-simulator:
          inputs:
            - scheme: $BITRISE_SCHEME
      - xcode-test:
          inputs:
            - scheme: $BITRISE_SCHEME

Replace BITRISE_SCHEME and BITRISE_PROJECT_PATH with the scheme and workspace your repository actually defines. Do not hand-edit secrets into YAML; keep API keys and signing material in Bitrise's secret store or a Keychain the daemon user can read.

Validate the First Build, Then the Signing Chain

Trigger a manual build in Bitrise and watch the log for the agent hostname line Bitrise emits at startup — it will match the Mac's hostname, not a label you invent. Then make sure the daemon user has what it needs:

# The daemon runs as its own user, not your login shell.
sudo xcode-select --switch /Applications/Xcode.app
sudo xcodebuild -license accept

# Tail the agent log (Apple silicon Homebrew path).
tail -f /opt/homebrew/var/log/bitrise-den-agent.log

For signing, install the signing certificate into the daemon user's login keychain and reference provisioning profiles as files checked into a secure store or synced with Fastlane match. Do not export the whole shell environment to a plaintext file; it can contain API tokens. Transfer secret names into the Bitrise app's Secrets tab and leave the values in a password manager you control.

Fail fast if a step errors. Every command above exits non-zero on failure, and Bitrise step failures stop the workflow by default — never treat a red build as a successful timing sample.

Worked Break-Even Against Bitrise Cloud Minutes

Bitrise prices cloud macOS builds per concurrent machine slot and per build minute; the exact numbers depend on your current plan, so pull them from your Bitrise billing page before you finalize this. The structure of the decision is simple:

Let R = your macOS per-minute rate in USD, M = your average build minutes per calendar month, and C = the price of a Figment Mac you would replace them with.

Monthly cloud cost = R × M.
You break even against a $95/month M-series Mac when M ≥ 95 / R.
You break even against a $249/month Managed Build Mac (CI setup, backups, monitoring, 30 minutes monthly support included) when M ≥ 249 / R.

A concrete worksheet: at R = $0.07/min and M = 2,500 minutes/month, cloud cost is 0.07 × 2,500 = $175. That is above the $95 self-hosted line and below the $249 managed line, so a self-managed M-series Mac saves about $80/month, while the managed tier costs $74/month more than staying on cloud — buy it only if your team values the setup and monitoring time it replaces. Rerun the arithmetic with your actual rate card; do not assume a published per-minute price without checking it.

Capacity on one Mac is finite. How many parallel Xcode jobs a given machine sustains depends on its exact chip and RAM, which you confirm in your Figment configuration quote — the $95 entry price does not imply a specific RAM figure. Measure wall-clock build time at one, two, and three concurrent pipelines and stop adding slots when per-job time inflates. Past that point, add a second Figment Mac to the same runner pool and let Bitrise distribute jobs across both.

Next Step

Request a Figment M-series Mac for your Bitrise runner pool, or start with the Figment Mac hosting overview to compare the $29 Intel VM, $49 i3 Mac waitlist, $95 M-series Mac, and the $249 Managed Build Mac side by side.

Related guides: