lima-vm/lima · error

failed to unprotect instance %#q: %w

Error message

failed to unprotect instance %#q: %w

What it means

Thrown by `limactl unprotect` when the instance was successfully inspected (and is marked protected) but `inst.Unprotect()` fails while removing the protection marker (the protection flag file inside the instance directory). The wrapped error describes the filesystem-level cause. Like the inspect error, it is collected and joined so the loop continues with remaining instances.

Source

Thrown at cmd/limactl/unprotect.go:42

	}
	return unprotectCommand
}

func unprotectAction(cmd *cobra.Command, args []string) error {
	ctx := cmd.Context()
	var errs []error
	for _, instName := range args {
		inst, err := store.Inspect(ctx, instName)
		if err != nil {
			errs = append(errs, fmt.Errorf("failed to inspect instance %#q: %w", instName, err))
			continue
		}
		if !inst.Protected {
			logrus.Warnf("Instance %#q isn't protected. Skipping.", instName)
			continue
		}
		if err := inst.Unprotect(); err != nil {
			errs = append(errs, fmt.Errorf("failed to unprotect instance %#q: %w", instName, err))
			continue
		}
		logrus.Infof("Unprotected %#q", instName)
	}
	return errors.Join(errs...)
}

func unprotectBashComplete(cmd *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
	return bashCompleteInstanceNames(cmd)
}

View on GitHub (pinned to dd909d0973)

Solutions

1. Check ownership/permissions of ~/.lima/<instance> and ensure the invoking user can write there.
2. Close other limactl processes operating on the instance, then retry.
3. If ~/.lima is on a read-only mount, remount read/write or set LIMA_HOME to a writable location.
4. As a last resort, remove the protection marker file inside the instance directory manually.

Example fix

// before
$ limactl unprotect default
// failed to unprotect instance "default": permission denied
// after
$ sudo chown -R $(whoami) ~/.lima
$ limactl unprotect default

if fi, err := os.Stat(filepath.Join(os.Getenv("LIMA_HOME"), instName)); err != nil || fi.Mode()&0200 == 0 {
    return fmt.Errorf("instance dir %q missing or not writable", instName)
}

if err := inst.Unprotect(); err != nil {
    var perr *fs.PathError
    if errors.As(err, &perr) {
        // handle permission/path problems: fix perms or advise sudo
    }
    return err
}

When it happens

Trigger: Calling `limactl unprotect NAME` on an instance whose Unprotect() fails, e.g. the protection file cannot be removed due to file permissions, a read-only LIMA_HOME mount, or the instance directory being concurrently modified.

Common situations: Running limactl without write permission on ~/.lima (different user, sudo-created instances); ~/.lima on a read-only volume; antivirus or backup tooling locking the protection file; running unprotect concurrently with another limactl command on the same instance.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• failed to determine the host directory to sync: %w
• failed to unregister instance %#q from start at login: %w
• the YAML is invalid, attempted to save the buffer as %#q but
• failed to determine if another hostagent is running: %w
• unable to load instance %s: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/aa0fcccf5bd9ee62. Report an issue: GitHub.