lima-vm/lima · error

failed to generate password: %w

Error message

failed to generate password: %w

What it means

generateWindowsInitialPassword (pkg/cidata/template.go:147) generates the initial Windows guest admin password using password.Generate(16, 4, 0, false, false). If the generator returns an error (e.g. requested digit count cannot be satisfied for the length/constraints), it is wrapped with this message and Windows ISO generation aborts.

Source

Thrown at pkg/cidata/template.go:147

	SkipDefaultDependencyResolution bool
	VMType                          string
	VSockPort                       int
	VirtioPort                      string
	Plain                           bool
	TimeZone                        string
	NoCloudInit                     bool
	WindowsInitialPassword          string
	LegacyBIOS                      bool
	IsWindowsServer                 bool
	TPM                             bool
}

func (t *TemplateArgs) generateWindowsInitialPassword() error {
	const pwLen = 16
	// Avoid special characters to minimize potential keyboard layout issue.
	pw, err := password.Generate(pwLen, pwLen/4, 0, false, false)
	if err != nil {
		return fmt.Errorf("failed to generate password: %w", err)
	}

	t.WindowsInitialPassword = pw
	return nil
}

// checkWindowsVersion checks if a guest VM is Windows 11 (true) or Windows server 2025 (false).
func (t *TemplateArgs) checkWindowsVersion(instDir string) error {
	imagePath := filepath.Join(instDir, filenames.ISO)
	label, err := iso9660util.Label(imagePath)
	if err != nil {
		return fmt.Errorf("failed to get ISO label: %w", err)
	}

	t.IsWindowsServer = !strings.HasPrefix(label, windowsClientISOLabelPrefix)

	return nil
}

View on GitHub (pinned to dd909d0973)

Solutions

1. Simply retry the command; generation is usually transient-failure-proof
2. If reproducible, verify the host's random source (/dev/urandom) works
3. Check for a modified/forked password.Generate with incompatible parameters

err := limactl.Start(ctx, instName)
if err != nil && strings.Contains(err.Error(), "failed to generate password") {
    // transient - retry the start operation
    return retryStart(ctx, instName)
}

When it happens

Trigger: password.Generate failing with pwLen=16 and 4 digits - practically rare; occurs on RNG/source failure or if the password library's constraints are unsatisfiable (bad parameters or entropy exhaustion).

Common situations: Extremely uncommon in practice; seen if system entropy source fails or the password library parameters are changed to inconsistent values in a fork/custom build.

Related errors

• --condition=boot is only supported on macOS
• failed to register instance %#q to start at login: %w
• cannot use `--sync` with a wsl2 instance, the host directory
• expected the depth of the converted host working directory (
• unsupported shell %#q for Windows guest, must be one of %v

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/9a62cdb148ee9f66. Report an issue: GitHub.