{"record":{"id":"aa0fcccf5bd9ee62","repo":"lima-vm/lima","slug":"failed-to-unprotect-instance-q-w","errorCode":null,"errorMessage":"failed to unprotect instance %#q: %w","messagePattern":"failed to unprotect instance %#q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/limactl/unprotect.go","lineNumber":42,"sourceCode":"\t}\n\treturn unprotectCommand\n}\n\nfunc unprotectAction(cmd *cobra.Command, args []string) error {\n\tctx := cmd.Context()\n\tvar errs []error\n\tfor _, instName := range args {\n\t\tinst, err := store.Inspect(ctx, instName)\n\t\tif err != nil {\n\t\t\terrs = append(errs, fmt.Errorf(\"failed to inspect instance %#q: %w\", instName, err))\n\t\t\tcontinue\n\t\t}\n\t\tif !inst.Protected {\n\t\t\tlogrus.Warnf(\"Instance %#q isn't protected. Skipping.\", instName)\n\t\t\tcontinue\n\t\t}\n\t\tif err := inst.Unprotect(); err != nil {\n\t\t\terrs = append(errs, fmt.Errorf(\"failed to unprotect instance %#q: %w\", instName, err))\n\t\t\tcontinue\n\t\t}\n\t\tlogrus.Infof(\"Unprotected %#q\", instName)\n\t}\n\treturn errors.Join(errs...)\n}\n\nfunc unprotectBashComplete(cmd *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {\n\treturn bashCompleteInstanceNames(cmd)\n}\n","sourceCodeStart":24,"sourceCodeEnd":53,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/cmd/limactl/unprotect.go#L24-L53","documentation":"Thrown by `limactl unprotect` when the instance was successfully inspected (and is marked protected) but `inst.Unprotect()` fails while removing the protection marker (the protection flag file inside the instance directory). The wrapped error describes the filesystem-level cause. Like the inspect error, it is collected and joined so the loop continues with remaining instances.","triggerScenarios":"Calling `limactl unprotect NAME` on an instance whose Unprotect() fails, e.g. the protection file cannot be removed due to file permissions, a read-only LIMA_HOME mount, or the instance directory being concurrently modified.","commonSituations":"Running limactl without write permission on ~/.lima (different user, sudo-created instances); ~/.lima on a read-only volume; antivirus or backup tooling locking the protection file; running unprotect concurrently with another limactl command on the same instance.","solutions":["Check ownership/permissions of ~/.lima/<instance> and ensure the invoking user can write there.","Close other limactl processes operating on the instance, then retry.","If ~/.lima is on a read-only mount, remount read/write or set LIMA_HOME to a writable location.","As a last resort, remove the protection marker file inside the instance directory manually."],"exampleFix":"// before\n$ limactl unprotect default\n// failed to unprotect instance \"default\": permission denied\n// after\n$ sudo chown -R $(whoami) ~/.lima\n$ limactl unprotect default","handlingStrategy":"try-catch","validationCode":"if fi, err := os.Stat(filepath.Join(os.Getenv(\"LIMA_HOME\"), instName)); err != nil || fi.Mode()&0200 == 0 {\n    return fmt.Errorf(\"instance dir %q missing or not writable\", instName)\n}","typeGuard":null,"tryCatchPattern":"if err := inst.Unprotect(); err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) {\n        // handle permission/path problems: fix perms or advise sudo\n    }\n    return err\n}","preventionTips":["Keep ~/.lima owned by the invoking user; avoid sudo-mixing limactl usage.","Do not run unprotect concurrently with other limactl commands on the same instance.","Keep LIMA_HOME on a writable volume."],"tags":["cli","filesystem","permissions","limactl"],"backgroundTag":"permission-denied","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}