limayaml: do not default containerd.user=true on non-Linux guests by gaurav0107 · Pull Request #5090 · lima-vm/lima

gaurav0107 · 2026-06-06T19:48:55Z

What

FillDefault in pkg/limayaml/defaults.go enabled containerd.user=true whenever the guest architecture was x86_64 or aarch64, with no check on the guest OS. macOS (os: Darwin) and FreeBSD guests therefore defaulted to containerd.user=true even though nerdctl is a Linux-only runtime, causing the ~250 MiB nerdctl archive to be downloaded unnecessarily.

How

Gate the true default on *y.OS == limatype.LINUX:

if y.Containerd.User == nil {
    if *y.OS == limatype.LINUX {
        switch *y.Arch {
        case limatype.X8664, limatype.AARCH64:
            y.Containerd.User = ptr.Of(true)
        default:
            y.Containerd.User = ptr.Of(false)
        }
    } else {
        y.Containerd.User = ptr.Of(false)
    }
}

y.OS is already resolved earlier in FillDefault (line 157 via ResolveOS), so dereferencing is safe.

Behavior

Linux + x86_64 / aarch64 → true (unchanged)
Linux + riscv64 / armv7l / ppc64le / s390x → false (unchanged)
Darwin + any arch → false (was true for x86_64 / aarch64; this is the fix)
FreeBSD + any arch → false (was true for x86_64 / aarch64; this is the fix)
Explicit containerd.user: true in user YAML → preserved (override path runs before this block)

Tests

TestContainerdUserDefaultPerOS — table-driven test covering Linux/Darwin/FreeBSD across x86_64, aarch64, riscv64, armv7l.
TestContainerdUserExplicitOverride — verifies an explicit containerd.user: true is preserved on a Darwin guest.

Existing TestFillDefault already pins Linux + host arch and continues to pass.

ok  github.com/lima-vm/lima/v2/pkg/limayaml  0.342s

Fixes #5037

FillDefault enabled containerd.user=true whenever the guest arch was x86_64 or aarch64, with no check on the guest OS. macOS (os: Darwin) and FreeBSD guests therefore defaulted to containerd.user=true even though nerdctl is a Linux-only runtime, causing the ~250 MiB nerdctl archive to be downloaded unnecessarily. Gate the true default on *y.OS == limatype.LINUX. Behavior for Linux guests is unchanged; non-Linux guests now default to containerd.user=false on every architecture. Explicit containerd.user=true in user YAML is preserved. Add TestContainerdUserDefaultPerOS covering the Linux/Darwin/FreeBSD matrix and TestContainerdUserExplicitOverride to lock the override path. Fixes lima-vm#5037 Signed-off-by: gaurav0107 <gauravdubey0107@gmail.com>

jandubois

Needs an update to templates/default.yaml too:

  # Enable user-scoped (aka rootless) containerd and its dependencies
  # 🟢 Builtin default: true (for x86_64 and aarch64)
  user: null

jandubois · 2026-06-06T21:38:55Z

 }
+
+// TestContainerdUserDefaultPerOS verifies that FillDefault only enables
+// containerd.user=true on Linux guests. nerdctl is a Linux-only runtime,


Suggested change

// containerd.user=true on Linux guests. nerdctl is a Linux-only runtime,

// containerd.user=true on Linux guests for x86_64 and aarch64. nerdctl is a Linux-only runtime,

Applied in 19fab75. Thanks for the review.

@jandubois

Update the doc comment in templates/default.yaml to reflect the behavior change in this PR: the user-scoped containerd default of true now applies only to Linux x86_64 and aarch64 guests; non-Linux guests default to false. Addresses review feedback from @jandubois on PR lima-vm#5090. Signed-off-by: gaurav0107 <gauravdubey0107@gmail.com>

gaurav0107 · 2026-06-08T20:46:42Z

Thanks for the review! Updated templates/default.yaml in 6791581 to reflect the new behavior:

  # Enable user-scoped (aka rootless) containerd and its dependencies
  # 🟢 Builtin default: true for Linux x86_64 and aarch64 guests, false otherwise
  user: null

Followed the wording pattern from 3fc5e85 (vz: disable ssh.overVsock by default for non-Linux guests). PTAL.

jandubois · 2026-06-09T03:34:56Z

Thanks, but please squash commits

@jandubois

Apply review suggestion from @jandubois: tighten the doc comment to state that the default of containerd.user=true is enabled only for x86_64 and aarch64 on Linux guests, matching the actual FillDefault behavior. Addresses review feedback from @jandubois on PR lima-vm#5090. Signed-off-by: gaurav0107 <gauravdubey0107@gmail.com>

gaurav0107 · 2026-06-10T03:49:46Z

@jandubois The templates/default.yaml comment was updated in 6791581 ("limayaml: clarify containerd.user default is Linux-only in default.yaml") earlier in this branch, and the test-comment suggestion is applied in 19fab75. Both review items should be addressed now — please re-review when convenient.

AkihiroSuda

Thanks

AkihiroSuda · 2026-06-10T07:17:00Z

Next time please make sure to squash the commits

@jandubois

Update the doc comment in templates/default.yaml to reflect the behavior change in this PR: the user-scoped containerd default of true now applies only to Linux x86_64 and aarch64 guests; non-Linux guests default to false. Addresses review feedback from @jandubois on PR #5090. Signed-off-by: gaurav0107 <gauravdubey0107@gmail.com> (cherry picked from commit 6791581) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

@jandubois

Apply review suggestion from @jandubois: tighten the doc comment to state that the default of containerd.user=true is enabled only for x86_64 and aarch64 on Linux guests, matching the actual FillDefault behavior. Addresses review feedback from @jandubois on PR #5090. Signed-off-by: gaurav0107 <gauravdubey0107@gmail.com> (cherry picked from commit 19fab75) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [lima-vm/lima](https://github.com/lima-vm/lima) | patch | `v2.1.2` → `v2.1.4` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>lima-vm/lima (lima-vm/lima)</summary> ### [`v2.1.4`](https://github.com/lima-vm/lima/releases/tag/v2.1.4) [Compare Source](lima-vm/lima@v2.1.3...v2.1.4) #### Changes - Cherry-picks from `master` to `release/2.1` - Only add xorrisofs flag to the xorrisofs command ([#5129](lima-vm/lima#5129), thanks to [@afbjorklund](https://github.com/afbjorklund)) - fix(qemu): fallback from hvf to tcg on macOS ([#5137](lima-vm/lima#5137), thanks to [@kavirakesh14](https://github.com/kavirakesh14)) - nerdctl: update from v2.3.3 to [v2.3.4](https://github.com/containerd/nerdctl/releases/tag/v2.3.4) ([#5169](lima-vm/lima#5169)) - templates: update ([#5170](lima-vm/lima#5170)) - templates/freebsd-15: support 9p mounts ([#5172](lima-vm/lima#5172)) - cmd/limactl: include name in network list `--json` output ([#5179](lima-vm/lima#5179), thanks to [@coulof](https://github.com/coulof)) Full changes: <https://github.com/lima-vm/lima/milestone/73?closed=1> #### Usage ```console $ limactl create $ limactl start ... INFO[0029] READY. Run `lima` to open the shell. $ lima uname Linux ``` *** The binaries were built automatically on GitHub Actions. The build log is available for 90 days: <https://github.com/lima-vm/lima/actions/runs/28630554371> The sha256sum of the SHA256SUMS file itself is `8bd82f03bc23acafc7e129fdbcbd9401b50eee2723817b8127f16dee3aebef92` . *** Release manager: [@AkihiroSuda](https://github.com/AkihiroSuda) ### [`v2.1.3`](https://github.com/lima-vm/lima/releases/tag/v2.1.3) [Compare Source](lima-vm/lima@v2.1.2...v2.1.3) - Cherry-picks from `master` to `release/2.1` ([#5131](lima-vm/lima#5131)) - limayaml: do not default containerd.user=true on non-Linux guests ([#5090](lima-vm/lima#5090), thanks to [@gaurav0107](https://github.com/gaurav0107)) - fix(copytool): fallback to scp for remote source and destination in auto mode ([#5097](lima-vm/lima#5097), thanks to [@unsuman](https://github.com/unsuman)) - templates: switch the default image from ubuntu-25.10 to ubuntu-26.04 ([#5106](lima-vm/lima#5106)) - krunkit: disable ssh.overVsock by default ([#5123](lima-vm/lima#5123)) - fix(makefile): propagate build failure for additional drivers ([#5125](lima-vm/lima#5125), thanks to [@unsuman](https://github.com/unsuman)) - templates: update ([#5130](lima-vm/lima#5130)) - nerdctl: update from v2.2.2 to v2.3.3 ([#5134](lima-vm/lima#5134)) - [v2.3.0 release note](https://github.com/containerd/nerdctl/releases/tag/v2.3.0) - [v2.3.1 release note](https://github.com/containerd/nerdctl/releases/tag/v2.3.1) - [v2.3.2 release note](https://github.com/containerd/nerdctl/releases/tag/v2.3.2) - [v2.3.3 release note](https://github.com/containerd/nerdctl/releases/tag/v2.3.3) - nerdctl v2.3.3 contains [containerd v2.3.2](https://github.com/containerd/containerd/releases/tag/v2.3.2), which fixes CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262 - Fix CVE-2026-53657 (GHSA-2j9v-p4xj-cjw2) "An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket" Full changes: <https://github.com/lima-vm/lima/milestone/72> #### Usage ```console $ limactl create $ limactl start ... INFO[0029] READY. Run `lima` to open the shell. $ lima uname Linux ``` *** The binaries were built automatically on GitHub Actions. The build log is available for 90 days: <https://github.com/lima-vm/lima/actions/runs/27824357138> The sha256sum of the SHA256SUMS file itself is `ddaf499316c159493ccf853393e35c93d69e8c1f85cb041f6f7e918157625c6c` . *** Release manager: [@AkihiroSuda](https://github.com/AkihiroSuda) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

gaurav0107 marked this pull request as ready for review June 6, 2026 19:49

jandubois requested changes Jun 6, 2026

View reviewed changes

AkihiroSuda added this to the v2.2.0 milestone Jun 10, 2026

AkihiroSuda approved these changes Jun 10, 2026

View reviewed changes

AkihiroSuda added the cherry-pick/v2.1 label Jun 10, 2026

AkihiroSuda merged commit 9b3195b into lima-vm:master Jun 10, 2026
35 checks passed

AkihiroSuda mentioned this pull request Jun 10, 2026

pkg/store: skip containerd.user default for macOS aarch64 #5041

Closed

AkihiroSuda mentioned this pull request Jun 18, 2026

[release/2.1] Prepare v2.1.3 #5131

Merged

AkihiroSuda added the cherry-pick/done label Jun 18, 2026

Navigation Menu

limayaml: do not default containerd.user=true on non-Linux guests - #5090

limayaml: do not default containerd.user=true on non-Linux guests#5090
AkihiroSuda merged 3 commits into
lima-vm:masterfrom
gaurav0107:fix/5037-filldefault-enables-containerd-user-for

gaurav0107 commented Jun 6, 2026

Uh oh!

jandubois left a comment

Uh oh!

jandubois Jun 6, 2026

Uh oh!

gaurav0107 Jun 10, 2026

Uh oh!

gaurav0107 commented Jun 8, 2026

Uh oh!

jandubois commented Jun 9, 2026

Uh oh!

gaurav0107 commented Jun 10, 2026

Uh oh!

AkihiroSuda left a comment

Uh oh!

Uh oh!

AkihiroSuda commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	// containerd.user=true on Linux guests. nerdctl is a Linux-only runtime,
	// containerd.user=true on Linux guests for x86_64 and aarch64. nerdctl is a Linux-only runtime,

Conversation

gaurav0107 commented Jun 6, 2026

What

How

Behavior

Tests

Uh oh!

jandubois left a comment

Choose a reason for hiding this comment

Uh oh!

jandubois Jun 6, 2026

Choose a reason for hiding this comment

Uh oh!

gaurav0107 Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

gaurav0107 commented Jun 8, 2026

Uh oh!

jandubois commented Jun 9, 2026

Uh oh!

gaurav0107 commented Jun 10, 2026

Uh oh!

AkihiroSuda left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

AkihiroSuda commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants