{"record":{"id":"6b9cf3743e0e4ea1","repo":"lima-vm/lima","slug":"field-user-must-not-be-root","errorCode":null,"errorMessage":"field User must not be `root`","messagePattern":"field User must not be `root`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cidata/template.go","lineNumber":174,"sourceCode":"\timagePath := filepath.Join(instDir, filenames.ISO)\n\tlabel, err := iso9660util.Label(imagePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get ISO label: %w\", err)\n\t}\n\n\tt.IsWindowsServer = !strings.HasPrefix(label, windowsClientISOLabelPrefix)\n\n\treturn nil\n}\n\nfunc ValidateTemplateArgs(args *TemplateArgs) error {\n\tif err := identifiers.Validate(args.Name); err != nil {\n\t\treturn err\n\t}\n\t// args.User is intentionally not validated here; the user can override with any name they want\n\t// limayaml.FillDefault will validate the default (local) username, but not an explicit setting\n\tif args.User == \"root\" {\n\t\treturn errors.New(\"field User must not be `root`\")\n\t}\n\tif args.UID == 0 {\n\t\treturn errors.New(\"field UID must not be 0\")\n\t}\n\tif args.Home == \"\" {\n\t\treturn errors.New(\"field Home must be set\")\n\t}\n\tif args.Shell == \"\" {\n\t\treturn errors.New(\"field Shell must be set\")\n\t}\n\tif len(args.SSHPubKeys) == 0 {\n\t\treturn errors.New(\"field SSHPubKeys must be set\")\n\t}\n\tfor i, m := range args.Mounts {\n\t\tf := m.MountPoint\n\t\tif !path.IsAbs(f) {\n\t\t\treturn fmt.Errorf(\"field mounts[%d] must be absolute, got %#q\", i, f)\n\t\t}","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/cidata/template.go#L156-L192","documentation":"ValidateTemplateArgs (pkg/cidata/template.go:174) rejects TemplateArgs whose User field is \"root\". Lima creates a non-root default user in the guest; provisioning as root is unsupported by design, so cloud-config/ISO generation for the instance is refused before anything is written.","triggerScenarios":"Calling GenerateCloudConfig/GenerateISO9660/GenerateWindowsISO (directly or via limactl) with args.User == \"root\" - typically because lima.yaml sets `user: root` explicitly.","commonSituations":"Users accustomed to other VM tools setting `user: root` in lima.yaml expecting a root login; scripting instance creation with hardcoded root user.","solutions":["Remove `user: root` from lima.yaml (or the --user override) and let Lima pick/default the username","Set a non-root user name explicitly, e.g. `user: myuser`","Use sudo inside the guest for privileged operations instead of a root default user"],"exampleFix":"# before\nuser: root\n# after\nuser: myuser","handlingStrategy":"validation","validationCode":"if args.User == \"root\" {\n    return errors.New(\"user must not be root; use a regular user and sudo inside the guest\")\n}","typeGuard":null,"tryCatchPattern":"if err := cidata.ValidateTemplateArgs(args); err != nil {\n    if strings.Contains(err.Error(), \"field User must not be\") {\n        return fmt.Errorf(\"set a non-root user in lima.yaml: %w\", err)\n    }\n    return err\n}","preventionTips":["Never set `user: root` in lima.yaml; Lima always provisions a non-root default user","Call cidata.ValidateTemplateArgs(args) early in custom tooling before generation","Use guest-side sudo for privileged commands instead of a root login"],"tags":["validation","user","cidata"],"backgroundTag":"invalid-user-config","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}