Edmondo's Vault

macOS Boot Modes

May 18, 20264 min read

macOS Boot Modes

macOS has two special boot environments. They are entirely different things despite both being “hold a button at startup.”

Safe ModeRecovery Mode
What bootsNormal macOS, restrictedMinimal recoveryOS from a separate volume
APFS volumeNormal System + DataSeparate hidden Recovery volume
Your filesAccessibleAccessible via Terminal
SIP modifiable?NoYes — this is the only way
Use caseDiagnose bad agents/driversReinstall, modify SIP, repair disk

Safe Mode

What it actually is

Safe Mode is not a different boot target (unlike systemd’s rescue.target). It boots the normal macOS system volume but applies a policy flag that changes what launchd bootstraps and what the kernel loads.

It is primarily a diagnostic tool: if a third-party service or kernel extension is causing a system problem, Safe Mode lets you reach a usable system without it.

What gets skipped

launchd services:

  • All plists in /Library/LaunchDaemons/ — third-party daemons
  • All plists in /Library/LaunchAgents/ — machine-wide third-party agents
  • All plists in ~/Library/LaunchAgents/ — per-user agents
  • Login items

What still runs:

  • Everything in /System/Library/LaunchDaemons/ and /System/Library/LaunchAgents/ — all Apple system services

Kernel extensions (Intel only):

  • Third-party kexts not in /System/Library/Extensions/ are not loaded. kextd rejects them.

Auxiliary Kernel Collection / DriverKit (Apple Silicon only):

  • The AuxKC (Auxiliary Kernel Collection — the collection of third-party DriverKit extensions) is excluded entirely at kernel boot time. This is architecturally different from Intel — on Apple Silicon the kernel never loads the AuxKC at all in Safe Mode, rather than kextd rejecting individual kexts at runtime.

Does Safe Mode clear caches?

Yes, but less than people think. Safe Mode invokes the CacheDelete subsystem to clear:

  • Font caches (regenerated by fontd on next boot)
  • Kernel extension caches (on Intel)
  • Some system caches registered with the CacheDelete framework

Realistic space reclaimed: 100 MB – 1 GB. Safe Mode cache clearing will not solve a 700 GB problem.

Does Safe Mode use a different APFS volume?

No. It boots from the same System and Data volumes as normal. The SSV is the same. All your files are present and unchanged.

How to enter Safe Mode

Apple Silicon:

  1. Shut down completely (not restart — full shutdown)
  2. Hold the Power button until “Loading startup options…” appears
  3. Click your startup disk
  4. Hold Shift, then click “Continue in Safe Mode”

Intel:

  1. Restart
  2. Hold Shift immediately when the screen turns on / after the startup chime
  3. Release when you see the login window (it will say “Safe Boot” in the menu bar)

Can you replicate Safe Mode without rebooting?

Partially. You can suppress third-party services:

# Unload all third-party daemons (be careful — this stops real services)
sudo launchctl bootout system /Library/LaunchDaemons/*.plist
 
# Clear font caches without rebooting
sudo atsutil databases -remove

You cannot replicate the AuxKC exclusion on Apple Silicon without rebooting — already-loaded kernel extensions cannot be unloaded from a live system.

Recovery Mode

What it is at the filesystem level

The Recovery volume is a separate APFS volume in the container (disk0s3 or similar — visible in diskutil apfs list). It contains a minimal macOS environment (recoveryOS) that is independent of your main macOS install. It boots its own kernel and its own userspace.

On Apple Silicon, there are two recovery environments:

  • 1P Recovery (first-party, associated with the installed OS): accessible by holding Power at boot, then selecting Options
  • 2P Recovery (second-party, factory-burned by Apple into the Secure Enclave): deeper fallback, accessible by holding Power longer. Cannot be modified or corrupted by anything that runs on the main OS.

When you need Recovery Mode

  • To run csrutil disable to turn off SIP (rare, be careful)
  • To run csrutil authenticated-root disable if you need to modify the System volume
  • To reinstall macOS
  • To run First Aid on your boot disk (you can’t fsck a mounted volume)
  • To reset SMC/NVRAM

See also

Graph View

Backlinks