{"record":{"id":"3074072e0338be8f","repo":"lima-vm/lima","slug":"failed-to-write-authorized-keys-file-for-user-q","errorCode":null,"errorMessage":"failed to write authorized_keys file for user %#q: %w","messagePattern":"failed to write authorized_keys file for user %#q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go","lineNumber":303,"sourceCode":"\tlogrus.Infof(\"Executing command: %v\", cmd.Args)\n\tif output, err := cmd.CombinedOutput(); err != nil {\n\t\treturn fmt.Errorf(\"failed to execute command %v: %w (output=%#q)\", cmd.Args, err, output)\n\t}\n\n\tpwPath := filepath.Join(homedir, \"password\")\n\tif err = os.WriteFile(pwPath, []byte(pw+\"\\n\"), 0o400); err != nil {\n\t\treturn fmt.Errorf(\"failed to write password file for user %#q: %w\", u.Name, err)\n\t}\n\tlogrus.Infof(\"Created user %#q. The password is stored in %#q\", u.Name, pwPath)\n\n\tdotSSHPath := filepath.Join(homedir, \".ssh\")\n\tif err = os.MkdirAll(dotSSHPath, 0o700); err != nil {\n\t\treturn fmt.Errorf(\"failed to create .ssh directory for user %#q: %w\", u.Name, err)\n\t}\n\tauthKeysPath := filepath.Join(dotSSHPath, \"authorized_keys\")\n\tauthKeysContent := strings.Join(u.SSHAuthorizedKeys, \"\\n\")\n\tif err = os.WriteFile(authKeysPath, []byte(authKeysContent), 0o600); err != nil {\n\t\treturn fmt.Errorf(\"failed to write authorized_keys file for user %#q: %w\", u.Name, err)\n\t}\n\tfor _, f := range []string{pwPath, dotSSHPath, authKeysPath} {\n\t\tif err = os.Chown(f, uid, -1); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to chown %#q for user %#q: %w\", f, u.Name, err)\n\t\t}\n\t}\n\tif u.Sudo != \"\" {\n\t\tif err := writeSudoers(u.Name, u.Sudo); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to write sudoers file for user %#q: %w\", u.Name, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// writeSudoers appends a sudoers entry for the given user.\n// writeSudoers is expected be called only once on creating the user account.\nfunc writeSudoers(userName, sudo string) error {\n\tif strings.Contains(sudo, \"\\n\") {","sourceCodeStart":285,"sourceCodeEnd":321,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go#L285-L321","documentation":"Writing the `authorized_keys` file (`<homedir>/.ssh/authorized_keys`, mode 0600) failed after the `.ssh` directory was created successfully. Without this file SSH public-key login for the user cannot work, so provisioning aborts. The wrapped os.WriteFile error carries the actual cause.","triggerScenarios":"os.WriteFile(authKeysPath, joined SSH keys, 0o600) fails in createUser during processUserData. Causes: ENOSPC, EACCES on the just-created directory, I/O errors, or security software blocking writes into .ssh.","commonSituations":"Disk-full VM during heavy provisioning; EDR/antivirus on macOS guest restricting .ssh writes; extremely long ssh key lists hitting quota/limits.","solutions":["Check guest disk space and free space if needed","Verify `<homedir>/.ssh` exists as a writable directory (mode 0700)","Inspect the wrapped errno (EACCES/ENOSPC/EIO) in the log","Re-run provisioning after fixing; keys come from the user-data `users[].ssh_authorized_keys` field"],"exampleFix":"// before: instance disk full\nlimactl disk resize / grow instance disk\n// after: reprovision\nlimactl start instance.yaml","handlingStrategy":"validation","validationCode":"dotSSH := filepath.Join(home, \".ssh\")\nst, err := os.Stat(dotSSH)\nif err != nil || !st.IsDir() || st.Mode().Perm()&0o200 == 0 {\n    return fmt.Errorf(\"%s must exist as a writable directory\", dotSSH)\n}","typeGuard":null,"tryCatchPattern":"if err := processUserData(ctx, data); err != nil {\n    var pe *os.PathError\n    if errors.As(err, &pe) && strings.Contains(err.Error(), \"authorized_keys\") {\n        log.Printf(\"authorized_keys write failed at %s: %v\", pe.Path, pe.Err)\n    }\n}","preventionTips":["Provision with sufficient free disk space","Keep ssh_authorized_keys entries well-formed (one key per list item)","Avoid security tooling that blocks writes into ~/.ssh during provisioning"],"tags":["ssh","filesystem","macos","guestagent"],"backgroundTag":"file-write-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}