lima-vm/lima · error

can't read %#q: %w: (Hint: %s)

Error message

can't read %#q: %w: (Hint: %s)

What it means

Lima cannot read the configured sudoers file (e.g. /etc/sudoers.d/lima) needed to validate network daemon sudo access, and passwordless sudo did not work as a fallback either. The message includes a Hint with the exact command to (re)generate and install the file.

Source

Thrown at pkg/networks/sudoers.go:110

			return nil
		}
		return fmt.Errorf("passwordLessSudo error: %w", err)
	}
	hint := fmt.Sprintf("run `%s sudoers >etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima %q`)",
		os.Args[0], sudoersFile)
	b, err := os.ReadFile(sudoersFile)
	if err != nil {
		// Default networks.yaml specifies /etc/sudoers.d/lima file. Don't throw an error when the
		// file doesn't exist, as long as password-less sudo still works.
		if errors.Is(err, os.ErrNotExist) {
			err = c.passwordLessSudo(ctx)
			if err == nil {
				logrus.Debugf("%#q does not exist, but sudo doesn't seem to require a password", sudoersFile)
				return nil
			}
			logrus.Debugf("%#q does not exist; passwordLessSudo error: %s", sudoersFile, err)
		}
		return fmt.Errorf("can't read %#q: %w: (Hint: %s)", sudoersFile, err, hint)
	}
	sudoers, err := Sudoers()
	if err != nil {
		return err
	}
	if string(b) != sudoers {
		// Happens on upgrading socket_vmnet with Homebrew
		return fmt.Errorf("sudoers file %#q is out of sync and must be regenerated (Hint: %s)", sudoersFile, hint)
	}
	return nil
}

View on GitHub (pinned to dd909d0973)

Solutions

1. Run the Hint command: limactl sudoers > etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima /etc/sudoers.d/lima
2. Check that paths.sudoersFile in networks.yaml matches the actual installed file location
3. Fix file permissions so the user can read the sudoers file (root-owned 0440 is standard for /etc/sudoers.d; note non-root read failure is expected if fallback sudo also fails)
4. If you rely on the file-missing fallback, ensure passwordless sudo (NOPASSWD) actually works

Example fix

// before
# /etc/sudoers.d/lima missing
// after
$ limactl sudoers > etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima /etc/sudoers.d/lima

if sudoersFile != "" {
    if _, err := os.Stat(sudoersFile); errors.Is(err, os.ErrNotExist) {
        out, _ := exec.Command("limactl", "sudoers").Output()
        // install: sudo install -o root <tmp> /etc/sudoers.d/lima
        _ = out
    }
}

if err := verifySudoAccess(ctx, sudoersFile); err != nil {
    var pathErr *os.PathError
    if errors.As(err, &pathErr) && errors.Is(pathErr.Err, os.ErrNotExist) {
        // regenerate & install the sudoers file, then retry
    }
}

When it happens

Trigger: VerifySudoAccess is called with a non-empty sudoersFile, os.ReadFile fails with a non-ErrNotExist error (permission denied, path wrong), or the file does not exist and the passwordLessSudo fallback also fails.

Common situations: New Lima install where /etc/sudoers.d/lima was never created, the sudoersFile path in networks.yaml points to the wrong location, or the file exists but is unreadable by the current user.

Related errors

• failed to run %v: %w
• passwordLessSudo error: %w
• sudoers file %#q is out of sync and must be regenerated (Hin
• failed to install plist to %s: %w
• failed to remove %s: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/a40b7e571fd75774. Report an issue: GitHub.