{"record":{"id":"9f685dc27138bea8","repo":"lima-vm/lima","slug":"failed-to-write-password-file-for-user-q-w","errorCode":null,"errorMessage":"failed to write password file for user %#q: %w","messagePattern":"failed to write password file for user %#q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go","lineNumber":292,"sourceCode":"\t} else if actualUID != uid {\n\t\tlogrus.Warnf(\"Requested UID %d for user %#q, but the system assigned UID %d; using the actual UID\", uid, u.Name, actualUID)\n\t\tuid = actualUID\n\t}\n\n\t// sysadminctl does not create the custom home directory\n\tif err = populateHomeDir(ctx, uid, homedir); err != nil {\n\t\treturn fmt.Errorf(\"failed to populate home directory for user %#q: %w\", u.Name, err)\n\t}\n\n\tcmd = exec.CommandContext(ctx, \"chmod\", \"700\", homedir)\n\tlogrus.Infof(\"Executing command: %v\", cmd.Args)\n\tif output, err := cmd.CombinedOutput(); err != nil {\n\t\treturn fmt.Errorf(\"failed to execute command %v: %w (output=%#q)\", cmd.Args, err, output)\n\t}\n\n\tpwPath := filepath.Join(homedir, \"password\")\n\tif err = os.WriteFile(pwPath, []byte(pw+\"\\n\"), 0o400); err != nil {\n\t\treturn fmt.Errorf(\"failed to write password file for user %#q: %w\", u.Name, err)\n\t}\n\tlogrus.Infof(\"Created user %#q. The password is stored in %#q\", u.Name, pwPath)\n\n\tdotSSHPath := filepath.Join(homedir, \".ssh\")\n\tif err = os.MkdirAll(dotSSHPath, 0o700); err != nil {\n\t\treturn fmt.Errorf(\"failed to create .ssh directory for user %#q: %w\", u.Name, err)\n\t}\n\tauthKeysPath := filepath.Join(dotSSHPath, \"authorized_keys\")\n\tauthKeysContent := strings.Join(u.SSHAuthorizedKeys, \"\\n\")\n\tif err = os.WriteFile(authKeysPath, []byte(authKeysContent), 0o600); err != nil {\n\t\treturn fmt.Errorf(\"failed to write authorized_keys file for user %#q: %w\", u.Name, err)\n\t}\n\tfor _, f := range []string{pwPath, dotSSHPath, authKeysPath} {\n\t\tif err = os.Chown(f, uid, -1); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to chown %#q for user %#q: %w\", f, u.Name, err)\n\t\t}\n\t}\n\tif u.Sudo != \"\" {","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go#L274-L310","documentation":"Lima's macOS fake cloud-init guest agent failed to write the generated password file (`<homedir>/password`, mode 0400) for a newly created user. This happens right after `sysadminctl -addUser` succeeds and the home directory is populated, so it indicates a filesystem-level problem (permissions, disk space, read-only volume, or the home directory path is not writable by root). The agent throws it to abort user provisioning since the user cannot discover their generated password without this file.","triggerScenarios":"os.WriteFile fails while writing `<homedir>/password` inside createUser, called from processUserData when provisioning cloud-init `users` entries on a macOS (darwin) guest. Typical underlying causes: home directory volume is full, the path is on a read-only mount, APFS/permissions errors, or SIP/MDM restrictions on the home path.","commonSituations":"VM disk image is full after large provisioning; the user-data sets `home` to a non-standard path on a read-only or non-existent mount; the home directory was created with wrong ownership by populateHomeDir; macOS host restrictions on the chosen directory.","solutions":["Check guest disk space (`df -h`) and expand the Lima disk if full","Verify the `home` path in the user-data users entry exists and is writable by root","Inspect the wrapped error (`%w`) in the log for the exact errno (EACCES, ENOSPC, EROFS)","Recreate the instance with `limactl delete` and re-provision if the home directory is in a corrupt state"],"exampleFix":"// before (user-data with bad home path)\nusers:\n- name: alice\n  home: /nonexistent/ro/alice\n// after\nusers:\n- name: alice\n  home: /Users/alice","handlingStrategy":"validation","validationCode":"// before provisioning, inside the guest\nconst home = \"/Users/alice\"\nst, err := os.Stat(home)\nif err != nil || !st.IsDir() {\n    return fmt.Errorf(\"home dir %s missing or not a directory: %w\", home, err)\n}\nif f, err := os.Create(home + \"/.write_test\"); err != nil {\n    return fmt.Errorf(\"home not writable: %w\", err)\n} else { f.Close(); os.Remove(home + \"/.write_test\") }","typeGuard":null,"tryCatchPattern":"err := processUserData(ctx, data)\nvar pwErr *os.PathError\nif errors.As(err, &pwErr) && strings.Contains(err.Error(), \"password file\") {\n    log.Printf(\"password file write failed at %s: %v — check disk space/permissions\", pwErr.Path, pwErr.Err)\n}","preventionTips":["Size the VM disk generously before provisioning","Keep `home` at the default /Users/<name> unless the mount is known writable","Monitor wrapped errno values (ENOSPC/EACCES/EROFS) in guestagent logs"],"tags":["filesystem","macos","guestagent","cloud-init"],"backgroundTag":"file-write-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}