lima-vm/lima · error

invalid group %#q: %w

Error message

invalid group %#q: %w

What it means

pkg/networks validates each networks.yaml entry; since the group name is written into a generated sudoers file, it must be a valid identifier. identifiers.Validate(c.Group) failure is wrapped with the offending group name.

Source

Thrown at pkg/networks/validate.go:31

	"runtime"
	"strings"

	"github.com/lima-vm/lima/v2/pkg/identifiers"
	"github.com/lima-vm/lima/v2/pkg/osutil"
)

func (c *Config) Validate() error {
	// The group name and the per-network name/mode/interface are interpolated
	// verbatim into the sudoers file (sudoers.go) and into the socket_vmnet
	// command that reconcile.go runs via sudo after splitting it on spaces
	// (commands.go). A value with whitespace injects an extra argument, and a
	// newline in a network name adds an arbitrary directive to the generated
	// sudoers file, so require them to be valid identifiers. Interface is empty
	// for non-bridged networks, and group defaults to "admin" when unset, so
	// only validate those when a value is actually present.
	if c.Group != "" {
		if err := identifiers.Validate(c.Group); err != nil {
			return fmt.Errorf("invalid group %#q: %w", c.Group, err)
		}
	}
	for name, nw := range c.Networks {
		if err := identifiers.Validate(name); err != nil {
			return fmt.Errorf("invalid network name %#q: %w", name, err)
		}
		if nw.Mode != "" {
			if err := identifiers.Validate(nw.Mode); err != nil {
				return fmt.Errorf("invalid mode %#q for network %#q: %w", nw.Mode, name, err)
			}
		}
		if nw.Interface != "" {
			if err := identifiers.Validate(nw.Interface); err != nil {
				return fmt.Errorf("invalid interface %#q for network %#q: %w", nw.Interface, name, err)
			}
		}
	}

View on GitHub (pinned to dd909d0973)

Solutions

1. Open networks.yaml and correct the `group` value to a plain identifier ([A-Za-z0-9_], no spaces/newlines).
2. Verify with `limactl` startup or the validation call again after editing.
3. If the group is intentionally special, create a plain-named OS group and add the needed users to it instead.
4. Quote-check YAML: ensure the value wasn't split across lines in the YAML file.

Example fix

# before (networks.yaml)
networks:
  lima-user-v2:
    group: "adm in"
# after
networks:
  lima-user-v2:
    group: admin

function validateGroupName(group) {
  if (!group) return null; // empty defaults to admin
  if (!/^[A-Za-z0-9_][A-Za-z0-9._-]*$/.test(group)) {
    return `invalid group: ${group} (must be a plain identifier, no spaces/newlines)`;
  }
  return null;
}
validateGroupName(config.networks['lima-user-v2'].group);

function isValidIdentifier(s) {
  return typeof s === 'string' && /^[A-Za-z0-9_-]+$/.test(s);
}

When it happens

Trigger: Setting `group` for a network in <LIMA_HOME>/_config/networks.yaml to a value containing characters outside valid identifier syntax (spaces, newlines, slashes, quotes, etc.) and then loading/validating the config via networks.Validate().

Common situations: Copy-pasting a group name with a trailing space or shell metacharacters; editing networks.yaml by hand and accidentally introducing a newline; using a group name like 'wheel/admin'.

Related errors

• invalid network name %#q: %w
• invalid mode %#q for network %#q: %w
• invalid interface %#q for network %#q: %w
• path %#q is not an absolute path
• path %#q contains whitespace

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/040880fa56ea1523. Report an issue: GitHub.