Mac setup for DevOps and SRE engineers

1. Foundations

xcode-select --install for git and compilers, then Homebrew. Keep a Brewfile in your dotfiles so a new laptop is one brew bundle away.

2. The CLI kit

brew "awscli"
brew "azure-cli"
brew "kubernetes-cli"
brew "helm"
brew "k9s"
brew "kubectx"
brew "jq"
brew "yq"
brew "gh"
brew "mise"

Trim to the clouds you use, and add Google Cloud's CLI if you need it. Terraform moved to the BSL licence and installs from HashiCorp's own tap (brew install hashicorp/tap/terraform); the open-source fork OpenTofu is brew install opentofu. mise manages per-project tool versions (kubectl, terraform, node) from a .mise.toml.

3. Containers on Apple silicon

• Docker Desktop, OrbStack (lighter; free for personal use, paid for commercial) or Colima (free, CLI) all run Linux containers in a lightweight VM.
• The architecture caveat: your Mac is arm64, many production servers are amd64. Build for production with docker buildx build --platform linux/amd64. Running amd64 images locally works through emulation but is slower.
• Local Kubernetes: kind, k3d, or the Kubernetes built into Docker Desktop or OrbStack.

4. SSH and secrets

• Generate an Ed25519 key with ssh-keygen -t ed25519 and add UseKeychain yes and AddKeysToAgent yes under a Host * block in ~/.ssh/config, so the passphrase lives in the macOS Keychain.
• Keep cloud credentials out of plain files where you can: aws sso login, short-lived tokens, or a password manager's CLI.

5. Terminal

Pick one terminal and learn its splits and tabs: Ghostty, iTerm2, WezTerm or kitty. Add tmux if you live on remote hosts and need sessions that survive disconnects. Which job belongs to tmux and which to your window manager is covered in tmux or a window manager.

6. Layout for on-call and incidents

During an incident you want at once: a terminal or two (logs, kubectl), dashboards (Grafana, Datadog, your cloud console), the incident channel, and the runbook. That's five windows, and on a laptop they all overlap.

• With an external monitor, give dashboards the big screen and terminals the laptop, or the other way round. See MacBook with an external monitor.
• Pin chat to one place: right-click Slack's Dock icon → Options → Assign To → This Desktop, so it doesn't follow you around.
• Keep windows from covering each other. This matters most under pressure.

Ribbon is a scrolling window manager that puts each window in a column on a strip wider than the screen. In an incident, the terminal, a dashboard, the incident channel and the runbook sit side by side; opening another dashboard adds a column rather than covering the terminal. Stack two terminals in one column with ⌃⌥], jump to any window with ⌃⌥1–9, and each monitor gets its own strip. It's driven entirely from the keyboard (⌃⌥ plus a key) and has a ribbon:// URL scheme and command-line tool for scripting. Try it in the live demo; pricing is $9.99 once. For more on terminals specifically, see arrange terminal windows on a Mac.