Once your credentials email lands, you should be in your remote desktop within 5 minutes. This page covers graphical access, command-line access, latency data, and security hardening in one pass — just follow it in order.
Every Mac mini ships with both VNC (5900) and SSH (22) enabled by default, with credentials sent in the same encrypted email. Tailscale is optional — install and manage it yourself.
See the full macOS desktop. Ideal for installing certificates, working in Xcode's GUI, or editing 4K video — anything that needs a mouse. Recommended bandwidth: 10Mbps+.
Your main channel for running build scripts, registering CI runners, and syncing files with rsync. Not latency-sensitive — works fine even on 2G — and our recommended default for daily use.
Pull your cloud Mac into your private network with a direct internal IP — no public ports exposed. You have full admin rights, and it's a one-line brew install.
| Method | Protocol / Port | Good for | Not ideal for | Latency sensitivity |
|---|---|---|---|---|
| VNC | RFB / 5900 | Graphical work, installing certificates, simulator interaction, video editing | Long-running automated tasks | High — keep under 120ms |
| SSH | SSH / 22 | Scripts, CI runners, file sync, long tmux sessions | One-off setups that require the GUI | Low — usable even at 300ms |
| Tailscale | WireGuard / UDP | Multi-device access, tunnel base once public ports are closed | Minimal setups that don't want extra software | Depends on the underlying link |
If you're also on a Mac locally, there's nothing to install. In Finder, press ⌘K (Go → Connect to Server), enter the address from your credentials email in the format below, then type in your VNC password.
When creating a new connection, enter nodeIP:5900, set Encryption to Prefer on, and start with Picture quality on Automatic — then fine-tune using the table below once connected. Set Scaling to 100% to avoid blurry text from double-scaling.
If you're prompted to confirm a fingerprint on first connect, check it against the host fingerprint at the bottom of your credentials email before accepting. Five wrong password attempts trigger a 60-second lockout — that's the default anti-brute-force policy, not a malfunction.
# Finder ⌘K, or open directly from Terminal
$ open vnc://203.0.113.10:5900
# Adjust resolution per session (run on the remote host)
$ displayplacer "id:main res:1920x1080 hz:60"
✓ connected: mini-tokyo-07 (M4, 24GB)VNC responsiveness comes down to three variables: resolution × color depth × compression quality. Rule of thumb — lower resolution first, then color depth, and only touch compression quality last. Compression artifacts hurt code readability more than lower resolution does.
| Preset | Resolution | Color depth | JPEG quality | Est. bandwidth | Best network |
|---|---|---|---|---|---|
| Smoothness first | 1280×720 | 16-bit | 4/9 | 3–5 Mbps | 4G hotspot, transoceanic links |
| Balanced (default) | 1920×1080 | 16-bit | 6/9 | 8–12 Mbps | Home broadband, nearby node |
| Quality first | 2560×1440 | 24-bit | 9/9 | 20–35 Mbps | Gigabit wired + latency under 60ms |
Dropping color depth from 24-bit to 16-bit saves roughly 40% bandwidth with almost no visible difference for coding — switch back to 24-bit when color grading.
If you uploaded an SSH public key at checkout, your machine ships ready for key-only access. If not, no problem — log in with the initial password from your email first, then disable password login using the first terminal block below.
# Local: push your public key up (password auth for this one time)
$ ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@203.0.113.10
# Remote: disable password login
$ sudo sed -i '' 's/^#\{0,1\}PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
$ sudo launchctl kickstart -k system/com.openssh.sshd
✓ Key-based authentication only from now on# Incrementally upload a project directory (resumable)
$ rsync -avzP --exclude .git ./MyApp admin@203.0.113.10:~/work/
# Mount the remote directory locally (requires macFUSE)
$ sshfs admin@203.0.113.10:/Users/admin/work ~/remote-work
# Unmount when done
$ umount ~/remote-work# Start a session to run a full archive build
$ tmux new -s build
$ xcodebuild archive -scheme MyApp -destination 'generic/platform=iOS'
# Press Ctrl-b d to detach — it keeps running even if you disconnect
# Reattach later
$ tmux attach -t build~/.ssh/config locally and add ServerAliveInterval 30 — then ssh tokyo gets you there instantly, and it also fixes NAT-timeout disconnects.Check this table before picking a node: figures are median ICMP ping in milliseconds — lower means more responsive. Rule of thumb: under 60ms feels nearly local for dragging windows, 60–120ms is fine for daily development, and above 150ms you should stick to SSH-only or headless mode.
| Origin city | → Tokyo node | → Seoul node | → Silicon Valley node | Recommendation |
|---|---|---|---|---|
| Beijing | 52 | 46 | 152 | Seoul first, Tokyo as backup |
| Shanghai | 38 | 42 | 148 | Tokyo first |
| Shenzhen | 48 | 44 | 158 | Either Seoul or Tokyo works |
| Tokyo | 2 | 34 | 108 | Local, direct |
| Seoul | 33 | 2 | 132 | Local, direct |
| Singapore | 68 | 74 | 168 | Tokyo slightly better; use Balanced preset for VNC |
| Los Angeles | 102 | 128 | 6 | Silicon Valley first |
Want to test it yourself? Test IPs for each node and mtr usage are in the network self-check section of the Troubleshooting page, along with a template for filing a ticket with your traceroute.
Physical distance has no software fix. The gap between 40ms and 150ms in the table above can't be recovered with any compression setting. Users in Asia typically default to Singapore, Hong Kong, Tokyo, or Seoul; users in the Americas default to Silicon Valley.
On a mediocre connection, switch VNC to "Smoothness first": 16-bit color depth plus mid-range JPEG quality usually pulls frame rate from 12fps back up above 25fps, so scrolling code no longer smears.
2.4GHz Wi-Fi commonly jitters ±30ms; a wired connection can get you down to ±3ms. VNC is more sensitive to jitter than to raw latency — a 50ms average with high jitter feels worse than a steady 80ms.
Run compiling, packaging, and file transfers in the background over SSH, and reserve VNC for whatever truly needs a mouse click. If the screen isn't refreshing, bandwidth naturally goes to your data transfer instead.
This machine is your dedicated physical node, and hardening it is on you. Work through these five steps in order and your public attack surface is basically closed off.
Port 22 in /etc/ssh/sshd_config to a high port (e.g., 2222) and automated scanner traffic drops by roughly 90%.brew install fail2ban, then enable the sshd jail — 5 failed attempts triggers a 10-minute ban by default, with zero impact on CI.# Build a local tunnel: remote 5900 maps to local 5901
$ ssh -N -L 5901:localhost:5900 admin@203.0.113.10
# In another window, just connect to the local port
$ open vnc://localhost:5901
✓ All VNC traffic is now encrypted over SSHIf this machine is purely a self-hosted runner, we recommend never opening a graphical session at all: less attack surface, less memory overhead, zero VNC bandwidth.
svc.sh generates a LaunchDaemon that starts on boot, restarts on crash, and reconnects automatically after a disconnect.security unlock-keychain before the build so signing no longer depends on a GUI session popup.# Disable screen sharing (can be re-enabled anytime)
$ sudo launchctl disable system/com.apple.screensharing
# Register and keep the GitHub Actions runner running
$ ./config.sh --url https://github.com/org/repo --token XXXX
$ sudo ./svc.sh install && sudo ./svc.sh start
# Unlock the signing keychain before building
$ security unlock-keychain -p "$KC_PASS" ci.keychain-db
✓ runner online, no GUI sessionMatch your symptom below and try the one-line fix first. If it's still broken, file a ticket with what you observed and what you've tried — first response within 2 hours.
| Symptom | Most likely cause | One-line fix |
|---|---|---|
| VNC shows a black screen | Screen sharing service crashed | sudo launchctl kickstart -k system/com.apple.screensharing |
| VNC is choppy / dropping frames | Quality preset exceeds your connection's capacity | Switch color depth to 16-bit, drop JPEG quality to 4/9, lower resolution to 1280×720 |
| SSH connection times out | Still connecting to port 22 after changing it, or blocked by a local firewall | ssh -p 2222 admin@203.0.113.10 -v to see where the handshake stalls |
| SSH rejects your key | Local private key permissions too open | chmod 600 ~/.ssh/id_ed25519 |
| SSH keeps disconnecting | NAT idle timeout killing the long-lived connection | printf "ServerAliveInterval 30\n" >> ~/.ssh/config |
| Clipboard stops syncing | Remote clipboard service hung | Run killall pboard over SSH — the service restarts automatically |
| Tunnel can't reach 5901 | Tunnel process has exited | Rerun ssh -N -L 5901:localhost:5900 admin@203.0.113.10 |
The full step-by-step walkthrough (including Xcode signing failures and keychain unlocking) is in the Troubleshooting Handbook
VNC/SSH credentials ship within 10 minutes of payment. Billed by the day, with refunds for unused days within 7 days.