lima-vm/lima · error

failed to run %v: %#q: %w

Error message

failed to run %v: %#q: %w

What it means

When generating the default key pair, Lima runs `ssh-keygen -t ed25519 -q -N "" -C lima -f <privPath>` and captures combined output; any non-zero exit is wrapped with the command args, its output, and the error. Commonly this is ssh-keygen missing from PATH or refusing to overwrite an existing key.

Source

Thrown at pkg/sshutil/sshutil.go:326

			// no passphrase, no user@host comment
			privPath := filepath.Join(configDir, filenames.UserPrivateKey)
			keygenExe := "ssh-keygen"
			if runtime.GOOS == "windows" {
				sshExe, sshErr := NewSSHExe()
				if sshErr != nil {
					return sshErr
				}
				keygenExe = companionForSSH(sshExe, "ssh-keygen")
				privPath, err = PathForSSH(ctx, sshExe, privPath)
				if err != nil {
					return err
				}
			}
			keygenCmd := exec.CommandContext(ctx, keygenExe, "-t", "ed25519", "-q", "-N", "",
				"-C", "lima", "-f", privPath)
			logrus.Debugf("executing %v", keygenCmd.Args)
			if out, err := keygenCmd.CombinedOutput(); err != nil {
				return fmt.Errorf("failed to run %v: %#q: %w", keygenCmd.Args, string(out), err)
			}
			return nil
		}); err != nil {
			return nil, err
		}
	}
	entry, err := readPublicKey(filepath.Join(configDir, filenames.UserPublicKey))
	if err != nil {
		return nil, err
	}
	res := []PubKey{entry}

	if !loadDotSSH {
		return res, nil
	}

	// Append all of ~/.ssh/*.pub
	homeDir, err := os.UserHomeDir()

View on GitHub (pinned to dd909d0973)

Solutions

1. Install OpenSSH client tools so ssh-keygen is on PATH (apt install openssh-client / brew install openssh / enable Windows OpenSSH feature).
2. If the key files already exist but are broken, back them up and remove id-lima and id-lima.pub from $LIMA_HOME/_config, then retry.
3. Read the ssh-keygen output embedded in the error message for the exact failure reason.
4. Set the keygen path explicitly if Lima supports overriding it (LIMA_SSH_KEYGEN environment variable on some versions).

Example fix

// before
which ssh-keygen  # not found
// after
sudo apt-get install -y openssh-client
ssh-keygen -t ed25519 -N "" -f ~/.lima/_config/user

keygen, err := exec.LookPath("ssh-keygen")
if err != nil { return fmt.Errorf("openssh-keygen not installed: %w", err) }

keys, err := sshutil.DefaultPubKeys(ctx)
if err != nil {
    if strings.Contains(err.Error(), "failed to run") {
        // surface embedded ssh-keygen output; prompt user to install openssh
    }
    return err
}

When it happens

Trigger: DefaultPubKeys takes the _config directory lock and invokes ssh-keygen; the binary is absent, fails (e.g. target private key already exists without -y overwrite), or the OS cannot exec it.

Common situations: OpenSSH client tools not installed (minimal Windows or container images); corrupted/stale id-lima key files in _config confusing ssh-keygen; PATH not containing ssh-keygen; antivirus blocking execution on Windows.

Related errors

• failed to create pipe for less: %w
• failed to start less: %w
• failed to run %#q on %#q: %#q: %w
• could not create %#q directory: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/c8bd6c79ed842118. Report an issue: GitHub.