I've done this before with one VM per client. Makes archiving etc. simple also, and means that per-client setup stuff never tramples on each other.

Gives an answer for how you firewall sensitive data also, e.g. every document you gave me never existed anywhere except in this (potentially encrypted) VM. Easy to delete cleanly.

That sounds like a clean way to organize multiple clients.

For some types of development, I find working on a remote server using SSH/Mosh/tmux works really well for me. I am retired now but I used to ask clients to rent a reasonably powerful VPS that we both had access to and just worked on that. I think this gave customers good control over their property (i.e., the work I did on their behalf).

The user per client on the computer sounds like a nice idea. I haven't done that, but can easily see the appeal. Nice one

It's a great system. The only real pain I've run into with it, on macOS anyway, is that you can't isolate iCloud accounts and still receive texts on your Mac. So unless you have a separate phone for each client, that's not so great. Also, the lack of profiles on iDevices means any client-specific apps (2fa stuff, for instance, or if you like to have Slack on your iDevice, or dev/testing apps, or whatever) ends up in a shared space on there.

I created a new iCloud account with my work email.

Right, the trouble's getting text messages and such through to your laptop (text message 2fa is so nice with a synced phone—auto fill!), if you have multiple clients. One work phone + personal phone (or tablets, or whatever) is fine. It's when you have three clients, and maybe they rotate out sometimes, that it gets to be a little annoying.

... unless you can add multiple iCloud accounts to one phone. I guess I've never tried, because I just assumed you couldn't. Though you'd still have the problem of things like dev builds and all that existing in the same space, and email accounts (on the phone) syncing to the same application without much separation, and all that.

Why are you using SMS 2FA anyway?

I once worked with a guy in the early 2000s that did 1 laptop per major client project (this was local workflow type app stuff, so windows desktop clients with maybe some kind of data backend) when he was complete he literally took the laptop and put a label on it and put it on a shelf. He'd been burned once to many times on backwards compatibility and library quirks with windows.

Would almost be better with in addition a vm per customer or at least some kind of encrypted partition per user/customer. Not sure how easy it is under Linux.

> Not sure how easy it is under Linux.

Not sure how easy it is on other OSes. On Linux, it's easy.

Just bite the bulllet and move to Qubes

Another advantage of doing this on separate VMs on Qubes is it makes it easy to comply with end-of-contract requirements to destroy all data. Just delete the VMs, and if needed, old backups.

Didn't know Qubes had such a feature (encrypted home partition/container). Will have a look, thanks.

On the face of it, it looks fairly simple on Linux with the encrypted homes feature.

Don't have the need for that, so I've never tested it in practice, though.

I tried to use this approach before, but if I remember correctly Homebrew didn’t like it. I like to manage my software with Homebrew, but multi user simply wasn’t working

You can install Homebrew in a non-default directory like somewhere under your home directory. It requires every package to be rebuilt during install, but it's possible. This means you should even be able to get away without even escalating your privileges to root.

How do you handle brew? It makes all the /usr/local/bin stuff belong to the regular user which installed it. Other users had trouble working with brew-installed stuff, last time I tried a few years ago.

You can install brew in your home directory using the Untar Anywhere approach. I’m particular sceptical of how brew handles permissions, so I always install it to ~/homebrew. One thing to note, if you use this approach Homebrew will not use its precompiled binaries and build everything from source.

https://docs.brew.sh/Installation#untar-anywhere

Use Nix instead.

I do the same on Linux, I install software that I always use (DBeaver, Intellij, Spotify, 1Password, browsers, postman, docker stuff, etc) with my 'personal' user and when I switch clients I just create a new user and copy over my licenses.

Then I use firefox for everything client related (their outlook, jira, etc) and just login to my gmail on chrome or brave or something.

KDE has the concept of activities (think like, virtual desktop on steroids, with custom widgets and look) which I used for some time to split between clients' work.

It was a fun gimmicky but I can't say I missed it once I had to start using a Mac.

I've started using that when working from home, putting the work stuff on a separate activity.

> While I don't have a one for each potential client...

So 6 clients = 6 computers...pardon me Macbooks is your ideal setup?

I hope that was a joke.

I really hope that was a joke.