lima-vm/lima · error

passwordLessSudo error: %w

Error message

passwordLessSudo error: %w

What it means

When no sudoersFile is configured, Lima probes for fully passwordless sudo via passwordLessSudo; this error wraps whatever made that probe fail. It means Lima cannot confirm that network daemons can be launched via sudo non-interactively, so sudo-requiring networks cannot be used.

Source

Thrown at pkg/networks/sudoers.go:94

			return err
		}
		cmd = exec.CommandContext(ctx, "sudo", "--user", user.User, "--group", user.Group, "--non-interactive", "true")
		logrus.Infof("Running: %v", cmd.Args)
		if err := cmd.Run(); err != nil {
			return fmt.Errorf("failed to run %v: %w", cmd.Args, err)
		}
	}
	return nil
}

func (c *Config) VerifySudoAccess(ctx context.Context, sudoersFile string) error {
	if sudoersFile == "" {
		err := c.passwordLessSudo(ctx)
		if err == nil {
			logrus.Debug("sudo doesn't seem to require a password")
			return nil
		}
		return fmt.Errorf("passwordLessSudo error: %w", err)
	}
	hint := fmt.Sprintf("run `%s sudoers >etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima %q`)",
		os.Args[0], sudoersFile)
	b, err := os.ReadFile(sudoersFile)
	if err != nil {
		// Default networks.yaml specifies /etc/sudoers.d/lima file. Don't throw an error when the
		// file doesn't exist, as long as password-less sudo still works.
		if errors.Is(err, os.ErrNotExist) {
			err = c.passwordLessSudo(ctx)
			if err == nil {
				logrus.Debugf("%#q does not exist, but sudo doesn't seem to require a password", sudoersFile)
				return nil
			}
			logrus.Debugf("%#q does not exist; passwordLessSudo error: %s", sudoersFile, err)
		}
		return fmt.Errorf("can't read %#q: %w: (Hint: %s)", sudoersFile, err, hint)
	}
	sudoers, err := Sudoers()

View on GitHub (pinned to dd909d0973)

Solutions

1. Generate and install the Lima sudoers file: limactl sudoers | sudo tee /etc/sudoers.d/lima and point paths.sudoersFile at it in networks.yaml
2. Or grant passwordless sudo to your group in /etc/sudoers (e.g. %admin ALL=(ALL:ALL) NOPASSWD: ALL)
3. Or switch to usernet (ModeUserV2) networks which need no sudo
4. Run the inner command manually to see the real cause: sudo -k && sudo --user <u> --group <g> --non-interactive true

Example fix

// before
$ limactl start  # passwordLessSudo error
// after
$ limactl sudoers | sudo tee /etc/sudoers.d/lima
$ limactl start

if os.Getenv("CI") != "" || !canPromptForPassword() {
    // prefer sudoersFile path or usernet networks over passwordLessSudo probing
}
if err := exec.Command("sudo", "-n", "true").Run(); err != nil {
    return errors.New("passwordless sudo not available; install /etc/sudoers.d/lima")
}

if err := verifySudoAccess(ctx, sudoersFile); err != nil {
    if strings.Contains(err.Error(), "passwordLessSudo error") {
        // fallback: use user-mode (usernet) networks, or install the sudoers file
    }
}

When it happens

Trigger: VerifySudoAccess(ctx, "") runs and passwordLessSudo returns an error — the `sudo -k` flush or the `sudo --user ... --non-interactive true` check failed (see errors 824/825 for inner causes).

Common situations: Default setup with no /etc/sudoers.d/lima file installed and no blanket NOPASSWD rule, headless/CI hosts where sudo prompts cannot be answered, or networks.yaml lacking the sudoersFile path.

Related errors

• failed to run %v: %w
• can't read %#q: %w: (Hint: %s)
• sudoers file %#q is out of sync and must be regenerated (Hin
• failed to install plist to %s: %w
• failed to remove %s: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/2f35739f8d28a81d. Report an issue: GitHub.