What causes "field `tpm` is not supported on WSL2 driver" in lima-vm/lima?

Remove or set `tpm: false` in lima.yaml

field `tpm` is not supported on WSL2 driver

Error message

field `tpm` is not supported on WSL2 driver

What it means

The WSL2 driver does not implement a virtual TPM, so a config with `tpm: true` is rejected during validation. TPM in Lima is used for things like Windows 11 guests and SecureBoot scenarios, none of which apply to wsl2.

Source

Thrown at pkg/driver/wsl2/wsl_driver_windows.go:120

		return fmt.Errorf("field `mountType` must be %#q for WSL2 driver, got %#q", limatype.WSLMount, *cfg.MountType)
	}
	// TODO: revise this list for WSL2
	if cfg.VMType != nil {
		if unknown := reflectutil.UnknownNonEmptyFields(cfg, knownYamlProperties...); len(unknown) > 0 {
			logrus.Warnf("Ignoring: vmType %s: %+v", *cfg.VMType, unknown)
		}
	}

	if cfg.OS != nil && *cfg.OS == limatype.WINDOWS {
		return errors.New("currently Windows guest OS is only supported on QEMU")
	}

	if !limatype.IsNativeArch(*cfg.Arch) {
		return fmt.Errorf("unsupported arch: %#q", *cfg.Arch)
	}

	if cfg.TPM != nil && *cfg.TPM {
		return errors.New("field `tpm` is not supported on WSL2 driver")
	}

	if cfg.VMType != nil {
		if cfg.Images != nil && cfg.Arch != nil {
			// TODO: real filetype checks
			tarFileRegex := regexp.MustCompile(`\.(tar|tgz|txz|tbz2|tzst|tar\.(gz|xz|bz2|zstd|zst))$`)
			unsupportedVMImgRegex := regexp.MustCompile(`\.(qcow2|raw|img|iso|ipsw)(\.(gz|xz|bz2|zstd|zst))?$`)
			squashfsRegex := regexp.MustCompile(`\.squashfs(\.(gz|xz|bz2|zstd|zst))?$`)
			for i, image := range cfg.Images {
				if unknown := reflectutil.UnknownNonEmptyFields(image, "File", "Variant", "ArchVariant"); len(unknown) > 0 {
					logrus.Warnf("Ignoring: vmType %s: images[%d]: %+v", *cfg.VMType, i, unknown)
				}
				if image.Arch == *cfg.Arch {
					location := image.Location
					if !tarFileRegex.MatchString(location) {
						if unsupportedVMImgRegex.MatchString(location) {
							return fmt.Errorf("unsupported image type for %s: %q. %s only supports importing tar archive root filesystems, not standard VM disk images", *cfg.VMType, location, *cfg.VMType)
						}

View on GitHub (pinned to dd909d0973)

Solutions

Remove or set `tpm: false` in lima.yaml
Switch to the qemu driver if a TPM is required
Validate the template with `limactl validate` before creating

Example fix

# before
tpm: true
vmType: wsl2
# after
# remove 'tpm' line, or:
tpm: false
vmType: wsl2

Defensive patterns

Strategy: validation

Validate before calling

func hasTPM(cfg *limatype.LimaYAML) bool {
	return cfg.TPM != nil && *cfg.TPM
}
// reject or clear cfg.TPM before wsl2 Configure

Type guard

func tpmRequested(cfg *limatype.LimaYAML) bool {
	return cfg.TPM != nil && bool(*cfg.TPM)
}

Try / catch

if err := driver.Configure(ctx, cfg); err != nil {
	if strings.Contains(err.Error(), "`tpm` is not supported") {
		cfg.TPM = nil // or switch to qemu driver
		return driver.Configure(ctx, cfg)
	}
	return err
}

Prevention

Only enable tpm for drivers that support it (e.g. qemu)
Do not blindly share Windows-11-style configs with wsl2 users
Run limactl validate on templates before distribution

When it happens

Trigger: `tpm: true` in lima.yaml while vmType is wsl2; validateConfig checks cfg.TPM != nil && *cfg.TPM and returns this error. Reached through Configure/Validate/limactl create/start.

Common situations: Configs shared from QEMU users enabling tpm for Windows 11 or vTPM-based encryption experiments being reused on WSL2; template experimentation.

Related errors

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/ecd75110b44df4b1. Report an issue: GitHub.