lima-vm/lima · error

failed to run : ; stdout=%#q, stderr=%#q

Error message

failed to run %v: %w; stdout=%#q, stderr=%#q

What it means

canGetServices runs a kubectl probe (with KUBECONFIG set) capturing stdout/stderr, expecting the command to exit 0 with output `yes`. If the command exits nonzero, this error wraps the run error plus captured stdout and stderr, so the kubectl diagnostics are embedded in the message.

Solutions

1. Read the embedded stderr in the message - it contains kubectl's own diagnosis (connection refused, unauthorized, etc.).
2. Verify the kubeconfig file exists and points at a reachable cluster (`kubectl --kubeconfig <path> cluster-info`).
3. Confirm the Kubernetes cluster/control plane inside the VM is running (`docker ps` / `kubectl get nodes`).
4. Ensure the kubectl binary exists in PATH within the guest.

Example fix

// before
KUBECONFIG=/nonexistent/config
// after
export KUBECONFIG=$HOME/.kube/config && kubectl cluster-info

if _, err := os.Stat(kubeconfig); err != nil {
    return fmt.Errorf("kubeconfig missing: %w", err)
}
if _, err := exec.LookPath("kubectl"); err != nil {
    return fmt.Errorf("kubectl not installed in guest")
}

if err := canGetServices(ctx, kubeconfig); err != nil {
    if strings.Contains(err.Error(), "connection refused") {
        // cluster still starting; retry with backoff
    }
    log.Printf("probe failed: %v", err) // stderr inside message has kubectl diagnosis
}

When it happens

Trigger: The kubectl probe command fails to execute or exits nonzero: kubeconfig path does not exist or is invalid, cluster API server is unreachable, auth credentials expired, or kubectl binary is missing (exec: not found).

Common situations: Kubernetes cluster in the VM is still starting or has crashed; kubeconfig generated for a different context/port; kubectl not installed in the guest; certificate/token expired after VM snapshot restore.

Related errors

• failed to run : expected `yes`, got %#q
• failed to run : ; stderr=%#q
• failed to scan kubectl event stream
• failed to unmarshal line %#q
• failed to unmarshal service object

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/fee56109abacb80a. Report an issue: GitHub.

Appendix: source

Thrown at pkg/guestagent/kubernetesservice/kubernetesservice.go:118

	}
	for _, kc := range candidateKubeConfigs {
		if _, err := os.Stat(kc); !errors.Is(err, os.ErrNotExist) {
			return kc
		}
	}
	return ""
}

func canGetServices(ctx context.Context, kubectl, kubeconfig string) error {
	cmd := exec.CommandContext(ctx, kubectl, "auth", "can-i", "get", "service")
	if kubeconfig != "" {
		cmd.Env = append(os.Environ(), "KUBECONFIG="+kubeconfig)
	}
	var stdout, stderr bytes.Buffer
	cmd.Stdout = &stdout
	cmd.Stderr = &stderr
	if err := cmd.Run(); err != nil {
		return fmt.Errorf("failed to run %v: %w; stdout=%#q, stderr=%#q", cmd.Args, err, stdout.String(), stderr.String())
	}
	if strings.TrimSpace(stdout.String()) != "yes" {
		return fmt.Errorf("failed to run %v: expected `yes`, got %#q", cmd.Args, stdout.String())
	}
	return nil
}

func (s *ServiceWatcher) startAndStreamKubectl(cmd *exec.Cmd) error {
	stdout, err := cmd.StdoutPipe()
	if err != nil {
		return err
	}

	var stderr bytes.Buffer
	cmd.Stderr = &stderr

	if err := cmd.Start(); err != nil {
		return fmt.Errorf("failed to run %v: %w; stderr=%#q", cmd.Args, err, stderr.String())

View on GitHub (pinned to dd909d0973)