{"record":{"id":"2f35739f8d28a81d","repo":"lima-vm/lima","slug":"passwordlesssudo-error-w","errorCode":null,"errorMessage":"passwordLessSudo error: %w","messagePattern":"passwordLessSudo error: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/networks/sudoers.go","lineNumber":94,"sourceCode":"\t\t\treturn err\n\t\t}\n\t\tcmd = exec.CommandContext(ctx, \"sudo\", \"--user\", user.User, \"--group\", user.Group, \"--non-interactive\", \"true\")\n\t\tlogrus.Infof(\"Running: %v\", cmd.Args)\n\t\tif err := cmd.Run(); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to run %v: %w\", cmd.Args, err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (c *Config) VerifySudoAccess(ctx context.Context, sudoersFile string) error {\n\tif sudoersFile == \"\" {\n\t\terr := c.passwordLessSudo(ctx)\n\t\tif err == nil {\n\t\t\tlogrus.Debug(\"sudo doesn't seem to require a password\")\n\t\t\treturn nil\n\t\t}\n\t\treturn fmt.Errorf(\"passwordLessSudo error: %w\", err)\n\t}\n\thint := fmt.Sprintf(\"run `%s sudoers >etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima %q`)\",\n\t\tos.Args[0], sudoersFile)\n\tb, err := os.ReadFile(sudoersFile)\n\tif err != nil {\n\t\t// Default networks.yaml specifies /etc/sudoers.d/lima file. Don't throw an error when the\n\t\t// file doesn't exist, as long as password-less sudo still works.\n\t\tif errors.Is(err, os.ErrNotExist) {\n\t\t\terr = c.passwordLessSudo(ctx)\n\t\t\tif err == nil {\n\t\t\t\tlogrus.Debugf(\"%#q does not exist, but sudo doesn't seem to require a password\", sudoersFile)\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\tlogrus.Debugf(\"%#q does not exist; passwordLessSudo error: %s\", sudoersFile, err)\n\t\t}\n\t\treturn fmt.Errorf(\"can't read %#q: %w: (Hint: %s)\", sudoersFile, err, hint)\n\t}\n\tsudoers, err := Sudoers()","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/networks/sudoers.go#L76-L112","documentation":"When no sudoersFile is configured, Lima probes for fully passwordless sudo via passwordLessSudo; this error wraps whatever made that probe fail. It means Lima cannot confirm that network daemons can be launched via sudo non-interactively, so sudo-requiring networks cannot be used.","triggerScenarios":"VerifySudoAccess(ctx, \"\") runs and passwordLessSudo returns an error — the `sudo -k` flush or the `sudo --user ... --non-interactive true` check failed (see errors 824/825 for inner causes).","commonSituations":"Default setup with no /etc/sudoers.d/lima file installed and no blanket NOPASSWD rule, headless/CI hosts where sudo prompts cannot be answered, or networks.yaml lacking the sudoersFile path.","solutions":["Generate and install the Lima sudoers file: limactl sudoers | sudo tee /etc/sudoers.d/lima and point paths.sudoersFile at it in networks.yaml","Or grant passwordless sudo to your group in /etc/sudoers (e.g. %admin ALL=(ALL:ALL) NOPASSWD: ALL)","Or switch to usernet (ModeUserV2) networks which need no sudo","Run the inner command manually to see the real cause: sudo -k && sudo --user <u> --group <g> --non-interactive true"],"exampleFix":"// before\n$ limactl start  # passwordLessSudo error\n// after\n$ limactl sudoers | sudo tee /etc/sudoers.d/lima\n$ limactl start","handlingStrategy":"fallback","validationCode":"if os.Getenv(\"CI\") != \"\" || !canPromptForPassword() {\n    // prefer sudoersFile path or usernet networks over passwordLessSudo probing\n}\nif err := exec.Command(\"sudo\", \"-n\", \"true\").Run(); err != nil {\n    return errors.New(\"passwordless sudo not available; install /etc/sudoers.d/lima\")\n}","typeGuard":null,"tryCatchPattern":"if err := verifySudoAccess(ctx, sudoersFile); err != nil {\n    if strings.Contains(err.Error(), \"passwordLessSudo error\") {\n        // fallback: use user-mode (usernet) networks, or install the sudoers file\n    }\n}","preventionTips":["Always install /etc/sudoers.d/lima via `limactl sudoers` on hosts using socket_vmnet","Set paths.sudoersFile explicitly in networks.yaml so the file-based check runs","Use usernet networks on hosts without passwordless sudo","Verify NOPASSWD rules after macOS or sudo package upgrades"],"tags":["network","sudo","permissions","socket-vmnet"],"backgroundTag":"sudo-password-required","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}