{"record":{"id":"73816c9301c486c1","repo":"lima-vm/lima","slug":"field-mounts-d-location-refers-to-an-inaccessi","errorCode":null,"errorMessage":"field `mounts[%d].location` refers to an inaccessible path: %#q: %w","messagePattern":"field `mounts\\[(.+?)\\]\\.location` refers to an inaccessible path: %#q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/limayaml/validate.go","lineNumber":137,"sourceCode":"\t\tif err := identifiers.Validate(disk.Name); err != nil {\n\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `additionalDisks[%d].name is invalid`: %w\", i, err))\n\t\t}\n\t}\n\n\tfor i, f := range y.Mounts {\n\t\tif !filepath.IsAbs(f.Location) && !strings.HasPrefix(f.Location, \"~\") {\n\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `mounts[%d].location` must be an absolute path, got %#q\",\n\t\t\t\ti, f.Location))\n\t\t}\n\t\t// f.Location has already been expanded in FillDefaults(), but that function cannot return errors.\n\t\tloc, err := localpathutil.Expand(f.Location)\n\t\tif err != nil {\n\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `mounts[%d].location` refers to an unexpandable path: %#q: %w\", i, f.Location, err))\n\t\t}\n\t\tst, err := os.Stat(loc)\n\t\tif err != nil {\n\t\t\tif !errors.Is(err, os.ErrNotExist) {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `mounts[%d].location` refers to an inaccessible path: %#q: %w\", i, f.Location, err))\n\t\t\t}\n\t\t\tif warn {\n\t\t\t\tlogrus.Warnf(\"field `mounts[%d].location` refers to a non-existent directory: %#q:\", i, f.Location)\n\t\t\t}\n\t\t} else if !st.IsDir() {\n\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `mounts[%d].location` refers to a non-directory path: %#q: %w\", i, f.Location, err))\n\t\t}\n\n\t\tswitch *f.MountPoint {\n\t\tcase \"/\", \"/bin\", \"/dev\", \"/etc\", \"/home\", \"/opt\", \"/sbin\", \"/tmp\", \"/usr\", \"/var\":\n\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `mounts[%d].mountPoint` must not be a system path such as /etc or /usr\", i))\n\t\t// home directory defined in \"cidata.iso:/user-data\"\n\t\tcase *y.User.Home:\n\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `mounts[%d].mountPoint` is the reserved internal home directory %#q\", i, *y.User.Home))\n\t\t}\n\t\t// There is no tilde-expansion for guest filenames\n\t\tif strings.HasPrefix(*f.MountPoint, \"~\") {\n\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `mounts[%d].mountPoint` must not start with `~`\", i))","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/limayaml/validate.go#L119-L155","documentation":"Validate() calls os.Stat on the expanded `mounts[i].location`. If Stat fails for a reason other than os.ErrNotExist (e.g. permission denied on a parent directory, not a directory in the path, I/O error), this error wraps the OS error.","triggerScenarios":"A mount location exists in name but is not stat-able: permission denied on a path component, a path component is actually a file, or filesystem errors, when Validate runs.","commonSituations":"Mounting a directory under a root-only path like `/var/lib/docker/...` from an unprivileged limactl run; pointing at a path inside an encrypted/fuse mount that errors; macOS TCC blocking access to ~/Library or Desktop.","solutions":["Fix host permissions so the invoking user can traverse the path (chmod/chown, or grant disk access on macOS)","Point the mount at a directory the user can read","If the path no longer exists, remove or correct the mount entry (ErrNotExist is allowed, other errors are not)"],"exampleFix":"// before\nmounts:\n  - location: /var/lib/docker/volumes/myvol\n// after\nmounts:\n  - location: ~/docker-volumes/myvol","handlingStrategy":"validation","validationCode":"const fs = require('fs')\nfunction accessibleDir(loc) {\n  const p = loc.startsWith('~') ? require('os').homedir() + loc.slice(1) : loc\n  try { fs.accessSync(p, fs.constants.R_OK | fs.constants.X_OK); return true } catch { return false }\n}","typeGuard":null,"tryCatchPattern":"try { await limactl(['start', inst]) } catch (e) { if (/inaccessible path/.test(e.message)) { fixPermissionsOrRelocate(e.message); } else throw e }","preventionTips":["Stat every mount path with the same user that runs limactl","Grant macOS disk/TCC access to the terminal for ~/Desktop, ~/Library, etc.","Avoid mounts under root-owned directories like /var/lib"],"tags":["lima","filesystem","permissions","mounts"],"backgroundTag":"path-access-denied","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}