{"record":{"id":"f54bfa71c67ca18b","repo":"abiosoft/colima","slug":"error-setting-up-sudoers-for-route-w","errorCode":null,"errorMessage":"error setting up sudoers for route: %w","messagePattern":"error setting up sudoers for route: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"environment/container/incus/route.go","lineNumber":34,"sourceCode":"// addContainerRoute adds a macOS route for the Incus container subnet\n// via the VM's col0 IP address, making containers directly reachable from the host.\nfunc (c *incusRuntime) addContainerRoute() error {\n\tif !util.MacOS() {\n\t\treturn nil\n\t}\n\n\tvmIP := limautil.IPAddress(config.CurrentProfile().ID)\n\tif vmIP == \"127.0.0.1\" || vmIP == \"\" {\n\t\treturn nil\n\t}\n\n\tif !util.SubnetAvailable(BridgeSubnet) {\n\t\tlog.Warnf(\"subnet %s conflicts with host network, skipping route setup\", BridgeSubnet)\n\t\treturn nil\n\t}\n\n\tif err := embedded.InstallSudoers(c.host); err != nil {\n\t\treturn fmt.Errorf(\"error setting up sudoers for route: %w\", err)\n\t}\n\n\t// delete any stale route first (ignore errors)\n\t_ = c.removeContainerRoute()\n\n\tif err := c.host.RunQuiet(\"sudo\", \"/sbin/route\", \"add\", \"-net\", BridgeSubnet, vmIP); err != nil {\n\t\treturn fmt.Errorf(\"error adding route for %s via %s: %w\", BridgeSubnet, vmIP, err)\n\t}\n\n\treturn nil\n}\n\n// removeContainerRoute removes the macOS route for the Incus container subnet.\nfunc (c *incusRuntime) removeContainerRoute() error {\n\tif !util.MacOS() {\n\t\treturn nil\n\t}\n","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/abiosoft/colima/blob/c3a5f9184d83a197184f897a9f07eb3c01b3bc88/environment/container/incus/route.go#L16-L52","documentation":"On macOS hosts, colima installs a sudoers file (embedded.InstallSudoers) so it can run /sbin/route without a password prompt; that install step failed. The wrapped error typically comes from writing /etc/sudoers.d/colima or validating it with visudo.","triggerScenarios":"embedded.InstallSudoers(c.host) fails: /etc/sudoers.d missing or not included by /etc/sudoers, write permission denied (sudo password entry failed), sudoers validation rejected the file, or the embedded sudoers asset is missing.","commonSituations":"Hardened macOS with sudoers include disabled, corporate machines with managed /etc/sudoers, interrupted first-run where the sudo prompt timed out, macOS upgrade resetting sudoers.d.","solutions":["Verify /etc/sudoers contains '@includedir /etc/sudoers.d' (visudo -c)","Check the file: 'sudo cat /etc/sudoers.d/colima' and 'sudo visudo -c'","Manually re-run colima start so the sudo prompt can be answered","If sudoers is centrally managed, add an equivalent rule for the route command"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// preflight the sudoers include dir before provisioning\nif _, err := os.Stat(\"/etc/sudoers.d\"); err != nil {\n    return fmt.Errorf(\"/etc/sudoers.d missing; ensure @includedir is configured in /etc/sudoers\")\n}","typeGuard":null,"tryCatchPattern":"if err := embedded.InstallSudoers(c.host); err != nil {\n    return fmt.Errorf(\"error setting up sudoers for route: %w\", err)\n    // user-actionable: run 'sudo visudo -c' and check /etc/sudoers.d/colima, then retry colima start\n}","preventionTips":["On managed/hardened macOS, pre-create an equivalent sudoers rule for /sbin/route","Complete the sudo password prompt on first colima start instead of cancelling it","After macOS upgrades, verify sudoers includes still resolve (visudo -c)"],"tags":["sudoers","macos","route","permissions","incus"],"backgroundTag":null,"analyzedSha":"c3a5f9184d83a197184f897a9f07eb3c01b3bc88","analyzedAt":"2026-08-15T18:58:08.334Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}