lima-vm/lima · error

failed to write password file for user %#q: %w

Error message

failed to write password file for user %#q: %w

What it means

Lima's macOS fake cloud-init guest agent failed to write the generated password file (`<homedir>/password`, mode 0400) for a newly created user. This happens right after `sysadminctl -addUser` succeeds and the home directory is populated, so it indicates a filesystem-level problem (permissions, disk space, read-only volume, or the home directory path is not writable by root). The agent throws it to abort user provisioning since the user cannot discover their generated password without this file.

Source

Thrown at pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go:292

	} else if actualUID != uid {
		logrus.Warnf("Requested UID %d for user %#q, but the system assigned UID %d; using the actual UID", uid, u.Name, actualUID)
		uid = actualUID
	}

	// sysadminctl does not create the custom home directory
	if err = populateHomeDir(ctx, uid, homedir); err != nil {
		return fmt.Errorf("failed to populate home directory for user %#q: %w", u.Name, err)
	}

	cmd = exec.CommandContext(ctx, "chmod", "700", homedir)
	logrus.Infof("Executing command: %v", cmd.Args)
	if output, err := cmd.CombinedOutput(); err != nil {
		return fmt.Errorf("failed to execute command %v: %w (output=%#q)", cmd.Args, err, output)
	}

	pwPath := filepath.Join(homedir, "password")
	if err = os.WriteFile(pwPath, []byte(pw+"\n"), 0o400); err != nil {
		return fmt.Errorf("failed to write password file for user %#q: %w", u.Name, err)
	}
	logrus.Infof("Created user %#q. The password is stored in %#q", u.Name, pwPath)

	dotSSHPath := filepath.Join(homedir, ".ssh")
	if err = os.MkdirAll(dotSSHPath, 0o700); err != nil {
		return fmt.Errorf("failed to create .ssh directory for user %#q: %w", u.Name, err)
	}
	authKeysPath := filepath.Join(dotSSHPath, "authorized_keys")
	authKeysContent := strings.Join(u.SSHAuthorizedKeys, "\n")
	if err = os.WriteFile(authKeysPath, []byte(authKeysContent), 0o600); err != nil {
		return fmt.Errorf("failed to write authorized_keys file for user %#q: %w", u.Name, err)
	}
	for _, f := range []string{pwPath, dotSSHPath, authKeysPath} {
		if err = os.Chown(f, uid, -1); err != nil {
			return fmt.Errorf("failed to chown %#q for user %#q: %w", f, u.Name, err)
		}
	}
	if u.Sudo != "" {

View on GitHub (pinned to dd909d0973)

Solutions

1. Check guest disk space (`df -h`) and expand the Lima disk if full
2. Verify the `home` path in the user-data users entry exists and is writable by root
3. Inspect the wrapped error (`%w`) in the log for the exact errno (EACCES, ENOSPC, EROFS)
4. Recreate the instance with `limactl delete` and re-provision if the home directory is in a corrupt state

Example fix

// before (user-data with bad home path)
users:
- name: alice
  home: /nonexistent/ro/alice
// after
users:
- name: alice
  home: /Users/alice

// before provisioning, inside the guest
const home = "/Users/alice"
st, err := os.Stat(home)
if err != nil || !st.IsDir() {
    return fmt.Errorf("home dir %s missing or not a directory: %w", home, err)
}
if f, err := os.Create(home + "/.write_test"); err != nil {
    return fmt.Errorf("home not writable: %w", err)
} else { f.Close(); os.Remove(home + "/.write_test") }

err := processUserData(ctx, data)
var pwErr *os.PathError
if errors.As(err, &pwErr) && strings.Contains(err.Error(), "password file") {
    log.Printf("password file write failed at %s: %v — check disk space/permissions", pwErr.Path, pwErr.Err)
}

When it happens

Trigger: os.WriteFile fails while writing `<homedir>/password` inside createUser, called from processUserData when provisioning cloud-init `users` entries on a macOS (darwin) guest. Typical underlying causes: home directory volume is full, the path is on a read-only mount, APFS/permissions errors, or SIP/MDM restrictions on the home path.

Common situations: VM disk image is full after large provisioning; the user-data sets `home` to a non-standard path on a read-only or non-existent mount; the home directory was created with wrong ownership by populateHomeDir; macOS host restrictions on the chosen directory.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

• failed to enable SSHD: %w
• failed to write file for path %#q: %w
• failed to create symlink from %#q to %#q: %w
• failed to create .ssh directory for user %#q: %w
• failed to write authorized_keys file for user %#q: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/9f685dc27138bea8. Report an issue: GitHub.