lima-vm/lima · error

failed to run %v: %w

Error message

failed to run %v: %w

What it means

The passwordless-sudo probe failed while running `sudo -k` to flush the cached sudo credentials. This is the first step of verifying that Lima's network daemons can be started via sudo without a password; if even `sudo -k` fails, sudo itself is broken or unavailable in this environment.

Source

Thrown at pkg/networks/sudoers.go:64

			user, err := cfg.User(daemon)
			if err != nil {
				return "", err
			}
			sb.WriteRune('\n')
			fmt.Fprintf(&sb, "%%%s ALL=(%s:%s) NOPASSWD:NOSETENV: \\\n", cfg.Group, user.User, user.Group)
			fmt.Fprintf(&sb, "    %s, \\\n", cfg.StartCmd(name, daemon))
			fmt.Fprintf(&sb, "    %s\n", cfg.StopCmd(name, daemon))
		}
	}
	return sb.String(), nil
}

func (c *Config) passwordLessSudo(ctx context.Context) error {
	// Flush cached sudo password
	cmd := exec.CommandContext(ctx, "sudo", "-k")
	logrus.Infof("Running: %v", cmd.Args)
	if err := cmd.Run(); err != nil {
		return fmt.Errorf("failed to run %v: %w", cmd.Args, err)
	}
	// Verify that user/groups for both daemons work without a password, e.g.
	// %admin ALL = (ALL:ALL) NOPASSWD: ALL
	for _, daemon := range []string{SocketVMNet} {
		if ok, err := c.IsDaemonInstalled(daemon); err != nil {
			return err
		} else if !ok {
			continue
		}
		user, err := c.User(daemon)
		if err != nil {
			return err
		}
		cmd = exec.CommandContext(ctx, "sudo", "--user", user.User, "--group", user.Group, "--non-interactive", "true")
		logrus.Infof("Running: %v", cmd.Args)
		if err := cmd.Run(); err != nil {
			return fmt.Errorf("failed to run %v: %w", cmd.Args, err)
		}

View on GitHub (pinned to dd909d0973)

Solutions

1. Ensure sudo is installed and the current user can use it (run `sudo -k` manually)
2. Fix /etc/sudoers so NOPASSWD rules apply to your group (e.g. '%admin ALL=(ALL) NOPASSWD: ALL')
3. Generate and install the Lima sudoers file: limactl sudoers | sudo tee /etc/sudoers.d/lima, then set networks.yaml sudoersFile accordingly so the file-based path is used instead
4. If in CI/container, avoid the sudo-based networks (use usernet/ModeUserV2 networks instead)

Example fix

// before
# networks.yaml: paths.sudoersFile == ""  → probe path
// after
$ limactl sudoers | sudo tee /etc/sudoers.d/lima
# networks.yaml
paths:
  sudoersFile: /etc/sudoers.d/lima

if err := exec.Command("sudo", "-k").Run(); err != nil {
    return fmt.Errorf("sudo unavailable or broken on this host: %w", err)
}

if err := verifySudoAccess(ctx); err != nil {
    if strings.Contains(err.Error(), "failed to run") {
        // fall back to usernet-only networks (no sudo required)
    }
}

When it happens

Trigger: VerifySudoAccess with an empty sudoersFile calls passwordLessSudo, and exec of `sudo -k` returns non-zero — sudo not installed, sudoers misconfigured so even -k requires auth, or the command was killed by context cancellation/timeout.

Common situations: Running in a container/CI environment without sudo, a sudoers file with 'Defaults !use_pty' or restricted settings, or the user not in any sudo-enabled group.

Related errors

• passwordLessSudo error: %w
• can't read %#q: %w: (Hint: %s)
• sudoers file %#q is out of sync and must be regenerated (Hin
• failed to install plist to %s: %w
• failed to remove %s: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/4785eaace0896f31. Report an issue: GitHub.