lima-vm/lima · error

sudoers file %#q is out of sync and must be regenerated (Hin

Error message

sudoers file %#q is out of sync and must be regenerated (Hint: %s)

What it means

The installed sudoers file exists but its contents no longer match what Lima would generate today, so Lima refuses to use it. This typically happens after upgrading socket_vmnet via Homebrew: the daemon path/version changes and the recorded start/stop commands in the sudoers file become stale.

Source

Thrown at pkg/networks/sudoers.go:118

		// Default networks.yaml specifies /etc/sudoers.d/lima file. Don't throw an error when the
		// file doesn't exist, as long as password-less sudo still works.
		if errors.Is(err, os.ErrNotExist) {
			err = c.passwordLessSudo(ctx)
			if err == nil {
				logrus.Debugf("%#q does not exist, but sudo doesn't seem to require a password", sudoersFile)
				return nil
			}
			logrus.Debugf("%#q does not exist; passwordLessSudo error: %s", sudoersFile, err)
		}
		return fmt.Errorf("can't read %#q: %w: (Hint: %s)", sudoersFile, err, hint)
	}
	sudoers, err := Sudoers()
	if err != nil {
		return err
	}
	if string(b) != sudoers {
		// Happens on upgrading socket_vmnet with Homebrew
		return fmt.Errorf("sudoers file %#q is out of sync and must be regenerated (Hint: %s)", sudoersFile, hint)
	}
	return nil
}

View on GitHub (pinned to dd909d0973)

Solutions

1. Run the Hint command to regenerate and reinstall: limactl sudoers > etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima /etc/sudoers.d/lima
2. Re-run this after every socket_vmnet upgrade (e.g. brew upgrade socket_vmnet)
3. Avoid hand-editing /etc/sudoers.d/lima; always generate it with limactl sudoers
4. If networks.yaml changed (group/daemon paths), regenerate the sudoers file to match

Example fix

// before: stale sudoers after brew upgrade socket_vmnet
// after
$ limactl sudoers > etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima /etc/sudoers.d/lima
$ limactl start

want, err := limactlSudoersOutput() // `limactl sudoers`
if err == nil {
    got, err := os.ReadFile("/etc/sudoers.d/lima")
    if err == nil && string(got) != want {
        // reinstall before starting any socket_vmnet network
    }
}

if err := verifySudoAccess(ctx, sudoersFile); err != nil {
    if strings.Contains(err.Error(), "out of sync") {
        // regenerate: limactl sudoers | sudo tee /etc/sudoers.d/lima
    }
}

When it happens

Trigger: VerifySudoAccess reads sudoersFile successfully but string(b) != Sudoers() — the generated rules (group, daemon user/group, start/stop command lines) differ from the file on disk.

Common situations: Upgrading socket_vmnet with Homebrew (path changes from e.g. /opt/homebrew/Cellar/...), changing the networks.yaml group or daemon settings after installing the sudoers file, or hand-editing /etc/sudoers.d/lima.

Related errors

• failed to run %v: %w
• passwordLessSudo error: %w
• can't read %#q: %w: (Hint: %s)
• socket_vmnet is not installed
• unknown daemon type %#q

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/14df284bd9ff7252. Report an issue: GitHub.