lima-vm/lima · error

failed to chmod %#q: %w

Error message

failed to chmod %#q: %w

What it means

EnsureDisk wraps an os.Chmod failure after successfully renaming the non-ISO image to the disk path. Lima normalizes the disk file to mode 0644 so QEMU/virtualization can read it; failing to set the mode is surfaced here. The wrapped errno (usually EPERM or ENOENT) identifies the cause.

Source

Thrown at pkg/driverutil/disk.go:110

		}
		if err := diskUtil.Convert(ctx, diskImageFormat, diskPath, diskPath, &diskSizeInBytes, false); err != nil {
			os.Remove(diskPath)
			_ = os.Rename(isoPath, imagePath)
			return fmt.Errorf("failed to create disk %#q: %w", diskPath, err)
		}
	} else {
		format, err := nativeimgutil.DetectFormat(imagePath)
		if err != nil {
			return err
		}

		// Resize handled by prepareDisk() after CreateDisk()
		if format == string(diskImageFormat) {
			if err = os.Rename(imagePath, diskPath); err != nil {
				return fmt.Errorf("failed to rename %#q to %#q: %w", imagePath, diskPath, err)
			}
			if err := os.Chmod(diskPath, 0o644); err != nil {
				return fmt.Errorf("failed to chmod %#q: %w", diskPath, err)
			}
		} else {
			if err := diskUtil.Convert(ctx, diskImageFormat, imagePath, diskPath, &diskSizeInBytes, false); err != nil {
				return fmt.Errorf("failed to convert %#q to %#q: %w", imagePath, diskPath, err)
			}
			os.Remove(imagePath)
		}
	}
	return nil
}

View on GitHub (pinned to dd909d0973)

Solutions

1. Check the wrapped errno; for EPERM fix ownership of instDir files (chown to the lima user)
2. Move ${LIMA_HOME} to a local filesystem that supports POSIX permissions if on NFS/SMB
3. Ensure only one lima process manages the instance to avoid the file disappearing mid-setup
4. Re-run the create/start command after fixing permissions; the disk already exists check will let you continue or recreate

Example fix

// before: chmod fails on NFS share
// LIMA_HOME=/mnt/nfs/lima
// after: use a local directory
export LIMA_HOME="$HOME/.lima"

if fi, err := os.Stat(instDir); err != nil || fi.Mode().Perm()&0o200 == 0 {
    return fmt.Errorf("instDir not writable by current user")
}

func chmodSupported(path string) bool {
    return !isNetworkMount(path) // e.g. check /proc/mounts for nfs/cifs
}

if err := driverutil.EnsureDisk(ctx, instDir, diskSize, format); err != nil {
    if strings.Contains(err.Error(), "chmod") {
        var perr *os.PathError
        errors.As(err, &perr) // EPERM => ownership or FS limitation
    }
    return err
}

When it happens

Trigger: os.Chmod(diskPath, 0o644) fails right after a successful rename in EnsureDisk: diskPath owned by another user, filesystem disallows chmod (some network/NFS mounts), or the file was removed between rename and chmod by a concurrent process.

Common situations: Instance directory shared over NFS/SMB or in a container bind mount that ignores or rejects permission changes; limactl run under a different UID than the file owner; SELinux/AppArmor policies blocking chmod.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• failed to unprotect instance %#q: %w
• open disk: %w
• failed to remove the autostart entry for instance %#q: %w
• failed to remove stale raw image %q: %w
• failed to remove stale raw digest file %q: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/9ded5196f0d5a3ef. Report an issue: GitHub.