field `mounts[%d].mountPoint` must not be a system path such

Error message

field `mounts[%d].mountPoint` must not be a system path such as /etc or /usr

What it means

Guest mountPoint values must not shadow critical system directories of the VM. Validate() rejects mountPoint equal to /, /bin, /dev, /etc, /home, /opt, /sbin, /tmp, /usr, or /var, since mounting over them would break the guest root filesystem.

Source

Thrown at pkg/limayaml/validate.go:148

		loc, err := localpathutil.Expand(f.Location)
		if err != nil {
			errs = errors.Join(errs, fmt.Errorf("field `mounts[%d].location` refers to an unexpandable path: %#q: %w", i, f.Location, err))
		}
		st, err := os.Stat(loc)
		if err != nil {
			if !errors.Is(err, os.ErrNotExist) {
				errs = errors.Join(errs, fmt.Errorf("field `mounts[%d].location` refers to an inaccessible path: %#q: %w", i, f.Location, err))
			}
			if warn {
				logrus.Warnf("field `mounts[%d].location` refers to a non-existent directory: %#q:", i, f.Location)
			}
		} else if !st.IsDir() {
			errs = errors.Join(errs, fmt.Errorf("field `mounts[%d].location` refers to a non-directory path: %#q: %w", i, f.Location, err))
		}

		switch *f.MountPoint {
		case "/", "/bin", "/dev", "/etc", "/home", "/opt", "/sbin", "/tmp", "/usr", "/var":
			errs = errors.Join(errs, fmt.Errorf("field `mounts[%d].mountPoint` must not be a system path such as /etc or /usr", i))
		// home directory defined in "cidata.iso:/user-data"
		case *y.User.Home:
			errs = errors.Join(errs, fmt.Errorf("field `mounts[%d].mountPoint` is the reserved internal home directory %#q", i, *y.User.Home))
		}
		// There is no tilde-expansion for guest filenames
		if strings.HasPrefix(*f.MountPoint, "~") {
			errs = errors.Join(errs, fmt.Errorf("field `mounts[%d].mountPoint` must not start with `~`", i))
		}

		if _, err := units.RAMInBytes(*f.NineP.Msize); err != nil {
			errs = errors.Join(errs, fmt.Errorf("field `msize` has an invalid value: %w", err))
		}
	}

	if *y.SSH.LocalPort != 0 {
		if err := validatePort("ssh.localPort", *y.SSH.LocalPort); err != nil {
			errs = errors.Join(errs, err)
		}

View on GitHub (pinned to dd909d0973)

Solutions

Change mountPoint to a safe location such as `/mnt/host/data` or `~/data`-equivalent guest path (no leading ~)
Access the needed host files from the new mountPoint instead of the system path
Re-validate with `limactl template validate`

Example fix

// before
mounts:
  - location: ~/etc-config
    mountPoint: /etc
// after
mounts:
  - location: ~/etc-config
    mountPoint: /mnt/etc-config

Defensive patterns

Strategy: validation

Validate before calling

const FORBIDDEN = ['/', '/bin', '/dev', '/etc', '/home', '/opt', '/sbin', '/tmp', '/usr', '/var']
function safeMountPoint(mp) { return typeof mp === 'string' && !FORBIDDEN.includes(mp) }

Type guard

function isCustomMountPoint(mp) { return typeof mp === 'string' && mp.startsWith('/mnt/') || /^\/home\/[^/]+\/./.test(mp || '') }

Try / catch

try { await limactl(['template','validate', file]) } catch (e) { if (/mountPoint.*must not be a system path/.test(e.message)) { moveMountPointTo(e, '/mnt/host'); } else throw e }

Prevention

Always use dedicated paths like /mnt/... or /srv/... for guest mountPoints
Never copy mountPoint values from other VM tools without review
Add a config linter rule rejecting the reserved list

When it happens

Trigger: A mounts entry has mountPoint set to one of the forbidden system paths when Validate runs, e.g. `mountPoint: /etc` or `mountPoint: /` (including the default in older configs).

Common situations: Hand-editing mountPoint to expose host files at a familiar guest path; migrating config from other VM tools that allowed /; trying to replace /tmp or /var with a host mount.

Related errors

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/7a0fb57478bf60ba. Report an issue: GitHub.