--- title: "Install machine runner 3 on macOS" description: "Instructions on how to install CircleCI's self-hosted machine runner (3.0) on macOS." platform: "Cloud, Server" doc_version: "unversioned" last_updated: "2026-10-14" --- > For current CircleCI product defaults, deprecated patterns, and Cloud/Server differences, see [AGENTS.md](https://circleci.com/docs/AGENTS.md). > > For the complete documentation index and site structure, see [llms.txt](https://circleci.com/docs/llms.txt). # Install machine runner 3 on macOS This page describes how to install CircleCI’s machine runner 3 on macOS. ## Prerequisites To install machine runners and run jobs, you will need to have root access, and have the following utilities and tools installed on your system: * [Homebrew](https://brew.sh/) * [curl](https://curl.se/) (installed by default on macOS). * sha256sum (if not pre-installed): * `brew install coreutils` * [tar](https://www.gnu.org/software/tar/) * The [CircleCI CLI](https://circleci.com/docs/guides/toolkit/circleci-cli/) if you wish to install runners from the command line. ## Self-hosted runner terms agreement Before you can install self-hosted runners through the web app, you will need to agree to the [CircleCI Runner Terms](https://circleci.com/legal/runner-terms/). To access the **Runners** section of the [CircleCI web app](https://app.circleci.com/) an organization admin must agree to the terms at **Org**  **Runners**. > **Image:** Runner terms and conditions Figure 1. Runner terms and conditions Once the terms have been accepted, **Runners** will appear permanently in the side navigation. Your role within your org is determined differently depending on how you integrate with your code, as follows: * If you have a `github` or `bitbucket` type organization, CircleCI mirrors VCS permissions for organizations. If you are an admin on your organization’s VCS, you are an admin on CircleCI. If you are unsure, [check the admin permissions](https://support.circleci.com/hc/en-us/articles/360034990033-Am-I-an-Org-Admin) on your VCS. * If you have a `circleci` type organization, you can check roles by navigating to **Org**  **People**. Full details on roles and permissions are available in the [Roles and Permissions Overview](https://circleci.com/docs/guides/permissions-authentication/roles-and-permissions-overview/). Find out about organization types in the [Users, Organizations and Integrations Guide](https://circleci.com/docs/guides/permissions-authentication/users-organizations-and-integrations-guide/). If you are installing and using self-hosted runners through the CLI, you are agreeing to the [CircleCI Runner Terms](https://circleci.com/legal/runner-terms/). ## 1\. Create namespace and resource class To install self-hosted runners, you need to create a CircleCI namespace and resource class. Once set up you will receive a resource class token. You must be an organization admin to complete this process. View your installed runners on the inventory page in the [web app](https://app.circleci.com/) by selecting **Runners** from the sidebar. If you already create orb in your organization you will already have a namespace configured. You must use this same namespace for runners. Each organization can only create a single namespace. 1. On the [CircleCI web app](https://app.circleci.com/), navigate to **Runners** and select **Create Resource Class**. > **Image:** Runner set up Figure 2. Runner set up, step one - Get started 2. Create a custom [Resource Class](https://circleci.com/docs/guides/execution-managed/resource-class-overview/). You will configure jobs to use this resource class when you want them to run on your self-hosted runner. We suggest using a lowercase representation of your CircleCI account name for your namespace. CircleCI will populate your org name as the suggested namespace by default in the UI. Namespace and resource classes must follow specific naming conventions: * The **namespace** can contain lowercase letters, numbers, underscores, and dashes. * The **resource class name** can contain uppercase and lowercase letters, numbers, colons, underscores, dashes, and plus signs. > **Image:** Runner set up Figure 3. Runner set up, step two - Create a namespace and resource class 3. Enter a description for your resource class. The description is an optional field. 4. Select **Save and continue** to save and view your resource class token. 5. Copy and save the resource class token. Self-hosted runners use this token to claim work for the associated resource class. The token is only displayed once, be sure to store it safely. > **Image:** Runner set up Figure 4. Runner set up, step three - Create a resource class token 6. Select the **Machine** tab and progress on to the platform-specific instructions in the next section of this installation guide. If you are installing **self-hosted runners for server**, the CircleCI CLI needs to be configured using your server API key. Run `circleci setup` to configure the CLI and access the option to supply a new API token if required. To install self-hosted runners, you need to create a CircleCI namespace and resource class. Once set up you will receive a resource class token. You must be an organization admin to complete this process. View your installed runners on the inventory page in the [web app](https://app.circleci.com/) by selecting **Runners** from the sidebar. If you already create orb in your organization you will already have a namespace configured. You must use this same namespace for runners. Each organization can only create a single namespace. 1. Create a namespace for your organization’s self-hosted runners if you do not already have one configured. We suggest using a lowercase representation of your CircleCI organization’s account name. Use the following command to create your CircleCI organization’s namespace: ```console $ circleci namespace create --org-id ``` 2. Create a resource class for your runner using the following command. You will configure jobs to use this resource class when you want them to run on your slef-hosted runner: ```console $ circleci runner resource-class create / --generate-token ``` Make sure to replace `` and `` with your org namespace and desired resource class name, respectively. You can add a description but this is optional. Resource class names must follow specific naming conventions. * The **namespace** can contain lowercase letters, numbers, underscores, and dashes. * The **resource class name** can contain uppercase and lowercase letters, numbers, colons, underscores, dashes, and plus signs. The resource class token is returned after the runner resource class is successfully created. The token is only displayed once, so be sure to store it safely. ## 2\. Install CircleCI runner on macOS You can install runner on macOS with [Homebrew](https://brew.sh/). 1. On the target macOS machine with Homebrew installed, run the following command to add the CircleCI repository: ```shell brew tap circleci-public/circleci ``` 2. Run the following command to install the `circleci-runner` package: You may see a notification indicating a background item for Circle Internet Services Inc. has been added. ```shell brew install circleci-runner ``` 3. Open the runner `config.yaml` file with a text editor of your choice, and modify the `runner.name` and `api.auth_token` values. ```shell nano $HOME/Library/Preferences/com.circleci.runner/config.yaml ``` ```shell runner: name: "my-macos-runner" working_directory: "/Users/$USER/Library/com.circleci.runner/workdir" cleanup_working_directory: true api: auth_token: "your-auth-token" ``` Replace `api.auth_token` with the token generated in the steps above, and choose a name for your runner. 4. **If you are using CircleCI Server** you will need to provide the URL for your install. You can do this by either setting the `CIRCLECI_RUNNER_API_URL` environment variable: ```shell export CIRCLECI_RUNNER_API_URL="your server domain" ``` Or by adding the URL to `$HOME/Library/Preferences/com.circleci.runner/config.yaml` using text editor of your choice. ```yaml api: auth_token: "your-auth-token" # On server, set url to the hostname of your server installation. url: https://your.domain.here ``` **If you are migrating an existing configuration from a previous runner installation**, you may move the existing launch agent file from its current path to the new path. **This will overwrite the default config file installed via brew and replace it with your existing config file.** ```shell mv /Library/Preferences/com.circleci.runner/launch-agent-config.yaml $HOME/Library/Preferences/com.circleci.runner/config.yaml ``` After copying the file, you may remove the logging block to send logs to the default location for machine runner 3 (specified below): ```yaml # remove this block from your existing config logging: file: /Library/Logs/com.circleci.runner.log ``` ## 3\. Review and accept the Apple signature notarization The binary must be approved to run on your macOS system because the self-hosted runner is not compiled from source during installation. This can be done via the macOS UI by accepting the pop-up asking if you wish to run the binary from the internet, or programmatically. 1. Verify the signature and notarization with this command: ```shell spctl -a -vvv -t install "$(brew --prefix)/bin/circleci-runner" ``` The command returns output that looks like this: ```shell /opt/homebrew/bin/circleci-runner: accepted source=Notarized Developer ID origin=Developer ID Application: Circle Internet Services Inc. ``` 2. When ready, run the command to accept the notarization. You will need to enter the macOS system password. ```shell sudo xattr -r -d com.apple.quarantine "$(brew --prefix)/bin/circleci-runner" ``` ## 4\. Start macOS machine runner 3 To start the macOS machine runner 3 for the first time, you will need to bootstrap the service. Depending on whether you are using a GUI or non-GUI session (for example, when remotely tunneling into the machine), the commands to bootstrap the service will differ: 1. For running the agent in a GUI session, you can bootstrap the provided `.plist` file and enable the service by running the following commands: ```shell launchctl bootstrap gui/$(id -u) $HOME/Library/LaunchAgents/com.circleci.runner.plist launchctl enable gui/$(id -u)/com.circleci.runner launchctl kickstart -k gui/$(id -u)/com.circleci.runner ``` 2. Finally, you can check the service is running by invoking the following command: ```shell launchctl print gui/$(id -u)/com.circleci.runner ``` 1. When using a non-GUI (or headless) session, move the provided `.plist` file to `/Library/LaunchAgents`. This location is for per-user agents configured by the administrator, which allows the service to load after a reboot. Run the following command to do this: ```shell sudo mv $HOME/Library/LaunchAgents/com.circleci.runner.plist /Library/LaunchAgents/ ``` 2. Now you can bootstrap the `.plist` file and enable the service by running the following commands: ```shell launchctl bootstrap user/$(id -u) /Library/LaunchAgents/com.circleci.runner.plist launchctl enable user/$(id -u)/com.circleci.runner launchctl kickstart -k user/$(id -u)/com.circleci.runner ``` 3. Finally, you can check the service is running by invoking the following command: ```shell launchctl print user/$(id -u)/com.circleci.runner ``` ## Machine runner configuration example Once you have installed the runner, select **Continue** in the CircleCI web app. You will be presented with an example configuration snippet showing a job configured to use your new self-hosted runner resource class. > **Image:** Runner set up Figure 5. Runner set up, copy code to config file The fields you must set for a specific job to run using your machine runners are: * `machine: true` * `resource_class: /` Simple example of how you could set up a job: ```yaml version: 2.1 workflows: build-workflow: jobs: - runner jobs: runner: machine: true resource_class: / steps: - run: echo "Hi I'm on Runners!" ``` The job will then execute using your self-hosted runner when you push the `.circleci/config.yml` to your VCS provider. ## Stop macOS machine runner 3 To stop the machine runner service, run the following command to disable the machine runner service, depending on the service target used in the previous step: ```shell launchctl disable gui/$(id -u)/com.circleci.runner ``` ```shell launchctl disable user/$(id -u)/com.circleci.runner ``` ## Uninstall machine runner 3 on macOS To uninstall machine runner 3 from your macOS device, follow these steps. 1. Stop the machine runner service by using the following command to disable it, depending on the service target used during installation: Targeting the GUI domain: ```shell launchctl bootout gui/$(id -u)/com.circleci.runner ``` Targeting the user domain: ```shell launchctl bootout user/$(id -u)/com.circleci.runner ``` 2. Uninstall machine runner: To uninstall without purging logs and configuration files, run the following command. ```shell brew uninstall --cask circleci-public/homebrew-circleci/circleci-runner ``` This command will **purge all logs and configuration files**. To uninstall and purge all logs and configuration files, run the following command. ```shell brew uninstall --cask --zap circleci-public/homebrew-circleci/circleci-runner ``` ## Access runner logs On your macOS machine, logs from `circleci-runner` are located in the following directory by default. ```shell $HOME/Library/Logs/com.circleci.runner/runner.log ``` ## Additional resources * [Manual Installation for Machine Runner 3](https://circleci.com/docs/runner/machine-runner-3-manual-installation/) * [Machine Runner 3 Linux Package Installation](https://circleci.com/docs/runner/install-machine-runner-3-on-linux/) * [Machine Runner 3 Windows Installation](https://circleci.com/docs/runner/install-machine-runner-3-on-windows/) * [Machine Runner 3 Docker Installation](https://circleci.com/docs/runner/install-machine-runner-3-on-docker/) * [Machine Runner 3 Configuration Reference](https://circleci.com/docs/runner/machine-runner-3-configuration-reference/)