Shared vs Private Mac Hosting: Price and Access
Pick private the moment real signing keys enter the picture
If Apple distribution certificates, provisioning profiles, App Store Connect API keys, or private source code will touch the machine, choose a private (dedicated) Mac. Shared desktops and multi-tenant sessions are fine for exploratory work, teaching, or one-off installs, but the extra tens of dollars per month to isolate signing material is almost always cheaper than rotating a leaked cert. Start a configuration at /mac-hosting/start.
What "shared" actually means across providers
The word covers three different things, and the gap between them changes both price and risk:
- Shared desktop sessions. Multiple users log into one macOS install over VNC or a browser. File permissions are the only wall. Treat the home folder as readable by other tenants unless the provider explicitly separates OS accounts.
- Shared hosts with isolated guests. Several macOS VMs run on one Mac. The hypervisor isolates them, but CPU, RAM, and disk I/O are shared, so neighbour load affects build times.
- Virtual Intel macOS on Linux/KVM. Figment's $29/month plan is a virtual Intel macOS guest with 2 vCPU, 8 GiB RAM, and 80 GiB disk. Each customer gets their own guest; it is reached through a browser console and the desktop terminal. It runs compatible Intel Mac toolchains, including supported Xcode 26 or earlier releases, and can cross-compile and sign Intel and arm64 targets that those toolchains support. It has no GPU acceleration, no audio, and cannot execute Apple silicon-only binaries or Xcode 27. See Apple's Porting your macOS apps to Apple silicon for the Xcode 26/27 split.
What a private Mac buys you
A dedicated physical Mac is one tenant per machine for the length of the term. You install your own software under Apple's licence, keep signing material in that Keychain, and no other customer competes for RAM or disk I/O. The question is which private plan.
- Figment. i3 Mac $49/month, M-series Mac from $95/month, Managed Build Mac $249/month (one M-series Mac, CI setup, backups, monitoring, 30 minutes monthly support), Managed Mac Team $999/month (two M-series Macs, two CI runners, team setup, backups, monitoring, one hour monthly support). The i3 and physical M-series tiers collect requests until supply is confirmed in the quote; the exact chip, RAM, and disk at $95 are set per quote, not published as a fixed spec.
- MacStadium. Published monthly prices on the MacStadium pricing page: M2.S $109 (M2, 8 GB, 256 GB), M4.S $149 (M4 10-core, 16 GB, 256 GB), M4.M $249 (M4 10-core, 24 GB, 512 GB). The same page states a 99.99% uptime target and customer-portal support, with monthly prepay or annual agreements via sales; no annual dollar amount is published.
- CloudMac. The CloudMac pricing page lists an M4, 16 GB, 256 GB reserved Mac at $99.99/month, and cloudmac.org advertises the same box at $999/year, which works out to $83.25/month. The 256 GB tier shows "Reserve now"; the 512 GB and 1 TB tiers show "Fully reserved, next allocation not scheduled," so availability is tier-specific.
- AWS EC2 Mac. Dedicated hosts only, 24-hour minimum per allocation per the AWS Dedicated Hosts pricing page. US East on-demand rates from the current AWS pricing feed: mac2 (M1) $0.65/hr, mac2-m2 $0.878/hr, mac-m4 $1.23/hr. Storage and data transfer bill separately.
The isolation audit (your artifact)
Run the eight rows. Any "Private required" answer means stop considering a shared desktop.
| Question | Shared is fine | Private required |
|---|---|---|
| Will Apple distribution or Developer ID certificates live on the machine? | No | Yes |
| Will provisioning profiles be stored or rotated here? | No | Yes |
| Does CI clone private repositories onto the host? | No | Yes |
| Will App Store Connect API keys, signing passwords, or deploy tokens sit on disk? | No | Yes |
| Do contractors or agencies need their own accounts? | Only with separated OS accounts and audit | Yes |
| Do you install kernel extensions, custom brew builds, or system-wide agents? | Unlikely to work | Yes |
| Is all work open source with no signing and no secrets? | Acceptable | Not required |
| Do you need visionOS, Xcode 27, or Apple silicon-only execution? | Not applicable | Yes, M-series physical |
Score three or more "Private required" rows and the Managed Build Mac at $249/month tends to be cheaper than the operator time to safely run your own node.
Worked cost worksheet
Pick the row that matches your hardware need, not just the cheapest headline.
| Option | Headline price | Effective monthly | Isolation | Notes |
|---|---|---|---|---|
| Figment virtual Intel macOS | $29/month | $29 | Single-tenant guest on Linux/KVM | Intel toolchains, Xcode 26 or earlier, no GPU/audio |
| Figment i3 Mac (request) | $49/month | $49 | Physical Mac | Allocation and availability confirmed in quote |
| Figment M-series (request) | from $95/month | from $95 | Physical Mac | Allocation and chip/RAM/disk set in quote |
| CloudMac M4 16 GB monthly | $99.99/month | $99.99 | Dedicated physical | Pricing |
| CloudMac M4 16 GB annual | $999/year | $83.25 | Dedicated physical | cloudmac.org |
| MacStadium M2.S | $109/month | $109 | Dedicated physical | M2, 8 GB, 256 GB |
| MacStadium M4.S | $149/month | $149 | Dedicated physical | M4, 16 GB, 256 GB |
| AWS mac-m4 on-demand | $1.23/hr | $1.23 × 730 = $897.90 | Dedicated host | 24-hour minimum per allocation; storage and transfer extra |
Two honest observations from the table. First, Figment's $29 guest is the lowest entry price for an isolated macOS environment, but it is an Intel VM, not an M4, so a CloudMac or MacStadium M4 is the fair comparison the moment you need Apple silicon execution. Second, 12 months of Figment's M-series entry at $95 is $1,140; CloudMac's published annual is $999. If the quote lands on a smaller chip than an M4, the published $999 M4 annual is cheaper and that matters. Ask Figment sales for the exact chip, RAM, disk, and term in the quote before committing. Taxes and any setup fees apply as stated in each vendor's actual offer.
Operational checks before you load a key
- Run
whoandwon a dedicated Mac and confirm you are the only interactive session. - Configure your CI runner as an outbound agent to GitHub Actions, Bitrise, or your orchestrator so no inbound port is exposed; see GitHub's self-hosted runner hardening.
- Transfer the distribution certificate as an encrypted
.p12with the password delivered through your secret manager. Download provisioning profiles from the Apple Developer portal on the target machine rather than exporting profile files from another Keychain. Never dump the shell environment to a plain-text file; move secret names and let the secret manager restore values. - Update allowlists only at services you control (your artifact store, package registry, deploy target). There is no fixed App Store Connect IP range to allowlist; do not invent one.
- When you retire a host, rotate every credential it ever stored, whether the plan was shared or private.
How to pick and start
- Open source, no signing, learning Xcode on Intel: start with the Figment virtual Intel macOS at $29 and validate your build through the browser console.
- One developer who needs a real Mac for signing: request an i3 or M-series quote at /mac-hosting/start; compare the quoted chip and disk against CloudMac and MacStadium's published M4 tiers before committing.
- A team with CI, backups, and monitoring: the Managed Build Mac at $249/month includes the CI setup and 30 minutes monthly support; the Managed Mac Team at $999/month covers two Macs and two runners with one hour monthly support.
- Anything that needs visionOS, Xcode 27, or Apple silicon execution: skip the VM and request physical M-series.
Related reading:
