field `provision[%d].permissions` must be an octal number: %

Error message

field `provision[%d].permissions` must be an octal number: %w

What it means

Provision entries in data/yq modes write files into the guest, and `permissions` must be an octal mode string (e.g. "0644"). Validate() parses `permissions` with strconv.ParseInt(..., 8, 64); if it is not valid octal (or not set to a value FillDefaults accepts as octal), validation fails. This catches typos like "755" without a base prefix ambiguity or values containing invalid digits such as "0649" or "0o644" style formats that are not plain octal strings.

Source

Thrown at pkg/limayaml/validate.go:233

		// This can lead to fatal Panic if p.Path is nil, better to return an error here
		switch p.Mode {
		case limatype.ProvisionModeData, limatype.ProvisionModeYQ:
			if p.Path == nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].path` must not be empty when mode is %#q", i, p.Mode))
				return errs
			}
			if !path.IsAbs(*p.Path) {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].path` must be an absolute path", i))
			}
			if p.Mode == limatype.ProvisionModeData && p.Content == nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].content` must not be empty when mode is %#q", i, p.Mode))
			}
			if p.Mode == limatype.ProvisionModeYQ && p.Expression == nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].expression` must not be empty when mode is %#q", i, p.Mode))
			}
			// FillDefaults makes sure that p.Permissions is not nil
			if _, err := strconv.ParseInt(*p.Permissions, 8, 64); err != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].permissions` must be an octal number: %w", i, err))
			}
		default:
			if (p.Script == nil || *p.Script == "") && p.Mode != limatype.ProvisionModeAnsible {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].script` must not be empty", i))
			}
			if p.Content != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].content` can only be set when mode is %#q", i, limatype.ProvisionModeData))
			}
			if p.Overwrite != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].overwrite` can only be set when mode is %#q", i, limatype.ProvisionModeData))
			}
			if p.Owner != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].owner` can only be set when mode is %#q", i, limatype.ProvisionModeData))
			}
			if p.Path != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].path` can only be set when mode is %#q, or %#q", i, limatype.ProvisionModeData, limatype.ProvisionModeYQ))
			}
			if p.Permissions != nil {

View on GitHub (pinned to dd909d0973)

Solutions

Set permissions to a plain octal string, e.g. `permissions: "0644"` (quote it so YAML keeps it a string)
Remove the `permissions` field to accept the FillDefaults default
Check each digit is 0-7 and there are no `0o` prefixes or whitespace
Run `limactl validate <file>` to re-check

Example fix

# before
provision:
  - mode: data
    path: /etc/motd
    permissions: 0o644
# after
provision:
  - mode: data
    path: /etc/motd
    permissions: "0644"

Defensive patterns

Strategy: validation

Validate before calling

// Go: verify permissions is octal before Validate
for i, p := range cfg.Provision {
    if p.Permissions != nil {
        if _, err := strconv.ParseInt(*p.Permissions, 8, 64); err != nil {
            return fmt.Errorf("provision[%d].permissions %q is not octal", i, *p.Permissions)
        }
    }
}

Type guard

func isOctalPerm(s string) bool {
    _, err := strconv.ParseInt(s, 8, 64)
    return err == nil
}

Prevention

Quote permission values in YAML ("0644") so they stay strings and keep digits 0-7
Avoid `0o` prefixes; Lima expects plain octal strings
Add a lint rule or schema pattern like ^[0-7]{3,4}$ for permissions

When it happens

Trigger: `provision[x].permissions` set to a string that fails octal parsing (e.g. "6448x", "099", contains decimal digits 8/9) in a provision entry with mode data or yq, during create/start/restart/edit/apply/template validation.

Common situations: Copy-pasting chmod values with stray characters; using "0o644" Go-style prefix; writing decimal permissions like "644" actually is valid octal digits but "684" is not (8 invalid); template variables interpolating non-numeric permissions.

Related errors

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/28c53068dfbd5bb6. Report an issue: GitHub.