lima-vm/lima · error

no SSH key was found, run `ssh-keygen`

Error message

no SSH key was found, run `ssh-keygen`

What it means

templateArgs collects SSH public keys to inject into the guest's cloud-config (authorized_keys). If sshutil.DefaultPubKeys finds zero usable public keys (and loading ~/.ssh pubkeys is enabled), generating the ISO/cloud-config cannot proceed, so this instructive error is thrown telling the user to create a key.

Source

Thrown at pkg/cidata/cidata.go:192

		}
		args.SlirpGateway = usernet.GatewayIP(subnet)
		if *instConfig.VMType == limatype.VZ {
			args.SlirpDNS = usernet.GatewayIP(subnet)
		} else {
			args.SlirpDNS = usernet.DNSIP(subnet)
		}
		args.SlirpIPAddress = networks.SlirpIPAddress
	}

	// change instance id on every boot so network config will be processed again
	args.IID = fmt.Sprintf("iid-%d", time.Now().Unix())

	pubKeys, err := sshutil.DefaultPubKeys(ctx, *instConfig.SSH.LoadDotSSHPubKeys)
	if err != nil {
		return nil, err
	}
	if len(pubKeys) == 0 {
		return nil, errors.New("no SSH key was found, run `ssh-keygen`")
	}
	for _, f := range pubKeys {
		args.SSHPubKeys = append(args.SSHPubKeys, f.Content)
	}

	var fstype string
	switch *instConfig.MountType {
	case limatype.REVSSHFS:
		fstype = "sshfs"
	case limatype.NINEP:
		fstype = "9p"
		if *instConfig.OS == limatype.FREEBSD {
			fstype = "p9fs"
		}
	case limatype.VIRTIOFS:
		fstype = "virtiofs"
	}
	hostHome, err := localpathutil.Expand("~")

View on GitHub (pinned to dd909d0973)

Solutions

1. Run `ssh-keygen -t ed25519` to create a default key pair, then retry
2. Ensure your keys are standard public keys in ~/.ssh (*.pub) readable by the current user
3. Verify $HOME points to the right directory so ~/.ssh is discoverable
4. If you intend other auth, set ssh.loadDotSSHPubKeys: false in lima.yaml and supply keys via another mechanism — otherwise keep it true with at least one key

Example fix

// before: lima.yaml
ssh:
  loadDotSSHPubKeys: true
# shell fix
ssh-keygen -t ed25519 -N '' -f ~/.ssh/id_ed25519

// Go: ensure at least one public key exists before create/start
pubKeys, err := sshutil.DefaultPubKeys(ctx, true)
if err != nil || len(pubKeys) == 0 {
    return errors.New("run `ssh-keygen -t ed25519` before `limactl create`")
}

if err := limainstance.Create(ctx, inst); err != nil {
    if strings.Contains(err.Error(), "no SSH key was found") {
        exec.Command("ssh-keygen", "-t", "ed25519", "-N", "", "-f",
            filepath.Join(home, ".ssh", "id_ed25519")).Run()
        return limainstance.Create(ctx, inst)
    }
    return err
}

When it happens

Trigger: Generating the cidata image (limactl create/start, GenerateCloudConfig, GenerateISO9660, GenerateWindowsISO) when no public keys exist: no ~/.ssh/*.pub, and ssh.LoadDotSSHPubKeys is true (default) with an empty ~/.ssh, or key generation via ssh-keygen is unavailable/failed.

Common situations: Fresh machine or CI container with no ~/.ssh directory; HOME misconfigured so ~/.ssh isn't found; only encrypted/private keys present without .pub files; setting ssh.loadDotSSHPubKeys=false in lima.yaml without providing other auth.

Related errors

• invalid permissions %#q for path %#q: %w
• unsupported shell %#q for Windows guest, must be one of %v
• failed to create the synced workdir in guest instance: %w
• failed to rsync to the guest %w
• failed to sync back the changes from guest instance to host:

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/6defad689d738cef. Report an issue: GitHub.