{"record":{"id":"879de77de35b07a9","repo":"lima-vm/lima","slug":"base-disk-q-child-must-not-have-a-different-fi","errorCode":null,"errorMessage":"base disk (%#q) child must not have a different filename (%#q)","messagePattern":"base disk \\(%#q\\) child must not have a different filename \\(%#q\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/qemuimgutil/qemuimgutil.go","lineNumber":286,"sourceCode":"// AcceptableAsBaseDisk checks if a disk image is acceptable as a base disk.\nfunc AcceptableAsBaseDisk(info *Info) error {\n\tswitch info.Format {\n\tcase \"qcow2\", \"raw\":\n\t\t// NOP\n\tdefault:\n\t\tlogrus.WithField(\"filename\", info.Filename).\n\t\t\tWarnf(\"Unsupported image format %#q. The image may not boot, or may have an extra privilege to access the host filesystem. Use with caution.\", info.Format)\n\t}\n\tif err := rejectExternalFileReferences(info); err != nil {\n\t\treturn err\n\t}\n\t// info.Children is set since QEMU 8.0\n\tswitch len(info.Children) {\n\tcase 0:\n\t// NOP\n\tcase 1:\n\t\tif info.Filename != info.Children[0].Info.Filename {\n\t\t\treturn fmt.Errorf(\"base disk (%#q) child must not have a different filename (%#q)\", info.Filename, info.Children[0].Info.Filename)\n\t\t}\n\t\tif len(info.Children[0].Info.Children) > 0 {\n\t\t\treturn fmt.Errorf(\"base disk (%#q) child must not have children of its own\", info.Filename)\n\t\t}\n\tdefault:\n\t\treturn fmt.Errorf(\"base disk (%#q) must not have multiple children: %+v\", info.Filename, info.Children)\n\t}\n\treturn nil\n}\n","sourceCodeStart":268,"sourceCodeEnd":296,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/qemuimgutil/qemuimgutil.go#L268-L296","documentation":"AcceptableAsBaseDisk inspects `qemu-img info` output (Info.Children, populated since QEMU 8.0) to ensure a base disk image contains no suspicious external references. A qcow2 image normally has no children; if it reports exactly one child, that child must reference the image's own filename (e.g. a self-referencing format structure). When the child's filename differs from the base disk's filename, it means the image embeds a reference to a different file — likely a backing file or extent — which is treated as an untrusted external file reference that could exfiltrate host files into the guest.","triggerScenarios":"Calling AcceptableAsBaseDisk (via EnsureDisk) on a qcow2/raw image whose qemu-img info JSON shows exactly one entry in info.Children whose Info.Filename differs from the top-level info.Filename — typically a qcow2 with a backing file, an external data file, or a VMDK extent, on QEMU >= 8.0 where Children are reported.","commonSituations":"Using a base image that was created with `qemu-img create -b backing.qcow2` (a backing-file chain) or converted from a VMDK with multiple extents; downloading a disk image that references an external data file; running with QEMU 8.0+ where children are detected but older tooling didn't flag them.","solutions":["Flatten the image to remove the backing chain: run `qemu-img convert -O qcow2 image.qcow2 flattened.qcow2` and use the flattened file as the base disk.","Re-download or rebuild the base image from an official Lima template source so it is a self-contained qcow2/raw file.","Commit the backing chain into one file: `qemu-img commit` on the child, then verify with `qemu-img info` that no external references remain."],"exampleFix":"// before: base disk is a qcow2 with a backing file\n//   qemu-img create -f qcow2 -b base.qcow2 -F qcow2 overlay.qcow2; use overlay.qcow2 as base disk\n// after\n//   qemu-img convert -O qcow2 overlay.qcow2 selfcontained.qcow2\n//   limactl start --disk selfcontained.qcow2","handlingStrategy":"validation","validationCode":"// Before using an image as a base disk, inspect it yourself:\n// qemu-img info --output=json disk.qcow2\n// jq -e '.\"snapshots\" == null and (.\"backing-filename\" | not)' disk-info.json \n// Ensure no backing file and that any child entry has the same filename as the image.\nfunc hasSelfReferencingChildOnly(infoJSON []byte) bool { /* parse qemu-img info; len(children)<=1 && children[0].filename == top filename */ return true }","typeGuard":"func acceptableBaseDiskFilename(info Info) bool {\n\treturn len(info.Children) == 0 ||\n\t\t(len(info.Children) == 1 && info.Children[0].Info.Filename == info.Filename)\n}","tryCatchPattern":null,"preventionTips":["Never build base disks with `qemu-img create -b`; always use a backing-file-free image.","Run `qemu-img info` on any downloaded image and check for backing-filename / external data file before registering it.","Flatten images with `qemu-img convert -O qcow2` as a standard preparation step."],"tags":["qemu","disk-image","qcow2","security","validation"],"backgroundTag":"backing-file-image-rejected","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}