field `probe[%d].file.url` must be empty during validation (

Error message

field `probe[%d].file.url` must be empty during validation (script should already be embedded)

What it means

By the time config validation runs, probe `file` entries must have their URL content already downloaded and embedded into `probe.script`; Validate() therefore rejects any probe whose file.url is still set. This is an internal invariant: LoadYAML/ensureFile resolution should have replaced file URLs with embedded scripts before validation.

Source

Thrown at pkg/limayaml/validate.go:292

			}
		}
	}
	needsContainerdArchives := (y.Containerd.User != nil && *y.Containerd.User) || (y.Containerd.System != nil && *y.Containerd.System)
	if needsContainerdArchives {
		if len(y.Containerd.Archives) == 0 {
			errs = errors.Join(errs, errors.New("field `containerd.archives` must be provided"))
		}
		for i, f := range y.Containerd.Archives {
			err := validateFileObject(f, fmt.Sprintf("containerd.archives[%d]", i))
			if err != nil {
				errs = errors.Join(errs, err)
			}
		}
	}
	for i, p := range y.Probes {
		if p.File != nil {
			if p.File.URL != "" {
				errs = errors.Join(errs, fmt.Errorf("field `probe[%d].file.url` must be empty during validation (script should already be embedded)", i))
			}
			if p.File.Digest != nil {
				errs = errors.Join(errs, fmt.Errorf("field `probe[%d].file.digest` support is not yet implemented", i))
			}
		}
		if p.Script != nil && !strings.HasPrefix(*p.Script, "#!") {
			errs = errors.Join(errs, fmt.Errorf("field `probe[%d].script` must start with a '#!' line", i))
		}
		switch p.Mode {
		case limatype.ProbeModeReadiness:
		default:
			errs = errors.Join(errs, fmt.Errorf("field `probe[%d].mode` can only be %#q", i, limatype.ProbeModeReadiness))
		}
	}
	for i, rule := range y.PortForwards {
		field := fmt.Sprintf("portForwards[%d]", i)
		if *rule.GuestIPMustBeZero && !rule.GuestIP.Equal(net.IPv4zero) {
			errs = errors.Join(errs, fmt.Errorf("field `%s.guestIPMustBeZero` can only be true when field `%s.guestIP` is 0.0.0.0", field, field))

View on GitHub (pinned to dd909d0973)

Solutions

Use an inline `script` starting with `#!` in the probe instead of `file.url`
If building configs programmatically, run the standard load/resolve pipeline before Validate so file URLs are embedded
Clear the `file.url` field and set the script content directly

Example fix

// before
probes:
- file:
    url: https://example.com/healthcheck.sh
// after
probes:
- script: |
    #!/bin/sh
    curl -f http://localhost/health

Defensive patterns

Strategy: validation

Validate before calling

for i, p := range cfg.Probes {
    if p.File != nil && p.File.URL != "" {
        return fmt.Errorf("probe[%d]: embed script content; file.url must not survive to validation", i)
    }
}

Type guard

func probeHasRawURL(p limatype.Probe) bool {
    return p.File != nil && p.File.URL != ""
}

Prevention

Use inline `script` probes in hand-written lima.yaml
When using the limayaml package, go through the standard load pipeline before Validate
Do not copy file+url patterns from dependency/file-download sections into probes

When it happens

Trigger: Calling limayaml.Validate directly on a config that skipped the URL-resolution step (or a config where a probe.file.url remained unresolved), e.g. custom tooling that unmarshals lima.yaml and calls Validate without the pre-processing limactl performs.

Common situations: Programmatic use of the limayaml package without calling the loader pipeline; writing a probe with a file.url by hand in lima.yaml instead of an inline script.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/988416dcf8bd14bd. Report an issue: GitHub.