Lima

Highlights:

• 🪟Experimentally support Windows server 2025 guests
• 🪟Experimentally support Windows 11 guests
• 🐧Experimentally allow opting out from password-less sudo

Changes

• Windows guest support:

  • Experimentally support Windows server 2025 guests (#5138, thanks to LFX mentee @mie313)
  • Experimentally support Windows 11 guests (#5164 #5185 #5244, thanks to LFX mentee @mie313)

• Linux guest support:

  • Experimentally allow opting out from password-less sudo (#5109 etc., thanks to @Aneesh-Hegde)

• Windows host support:

  • Change the default VM driver from wsl2 to qemu (#4788)
  • Remove dependency on cygpath.exe (#5205, thanks to LFX mentee @mie313 with assistance from @jandubois)

• macOS host support:

  • Add LaunchDaemon support for headless macOS servers (#4984, thanks to @resker)

• VM driver infrastructure:

  • Update API (#4877, thanks to @unsuman)

• QEMU:

  • Implement TPM emulation (#5148, thanks to @mie313)

• VZ:

  • Implement virtio-sound interface (#5016, thanks to @Aneesh-Hegde)

• limactl CLI:

  • Add limactl screenshot (#5098, thanks to @trodemaster)
  • Accept limactl edit flags in limactl restart (#5076, thanks to @itsme-ranger)
  • Accept --shell flag in limactl (create|edit|start) (#5194, thanks to @unsuman)

• Networking:

  • Limit socket_vmnet access from %everyone to the %admin group (#5190, thanks to @ekalinin)

• nerdctl:

  • Update from v2.3.4 to v2.3.5 (#5297)

• Templates:

  • almalinux-kitten: Move to experimental/ (#4736)
  • alpine: Support --plain (#3057)
  • debian: Support --image-variant=nocloud (#5159, thanks to @Nachiket-Roy)
  • fedora: support RISC-V 64 (#5201)
  • ubuntu: Support --image-variant=minimal (#5159, thanks to @Nachiket-Roy)
  • k8s: Support version and registry parameters (#4872 #5200, thanks to @afbjorklund)
  • experimental/ubuntu-next: point to ubuntu-26.10 (#5214)

Full changes: https://github.com/lima-vm/lima/milestone/70?closed=1 Thanks to @Aneesh-Hegde @Austin1serb @Nachiket-Roy @Nashit-h @SABITHSAHEB @SAY-5 @afbjorklund @arimu1 @arixmkii @bitalizer @ciderale @coulof @ekalinin @gaurav0107 @itsme-ranger @jandubois @kavirakesh14 @loncharles @mie313 @mvanhorn @opjt @pirate @resker @trodemaster @unsuman

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/29840916918

The sha256sum of the SHA256SUMS file itself is 7da5160ee9b22de8eec4222e581334ee6326881e20d5aa8eb29b22f897312a5f .

---

Release manager: @AkihiroSuda

Highlights:

• 🪟Experimentally support Windows server 2025 guests
• 🪟Experimentally support Windows 11 guests
• 🐧Experimentally allow opting out from password-less sudo

Changes

• Windows guest support:

  • Experimentally support Windows server 2025 guests (#5138, thanks to LFX mentee @mie313)
  • Experimentally support Windows 11 guests (#5164 #5185 #5244, thanks to LFX mentee @mie313)

• Linux guest support:

  • Experimentally allow opting out from password-less sudo (#5109 etc., thanks to @Aneesh-Hegde)

• Windows host support:

  • Change the default VM driver from wsl2 to qemu (#4788)

• macOS host support:

  • Add LaunchDaemon support for headless macOS servers (#4984, thanks to @resker)

• VM driver infrastructure:

  • Update API (#4877, thanks to @unsuman)

• QEMU:

  • Implement TPM emulation (#5148, thanks to @mie313)

• VZ:

  • Implement virtio-sound interface (#5016, thanks to @Aneesh-Hegde)

• limactl CLI:

  • Add limactl screenshot (#5098, thanks to @trodemaster)
  • Accept limactl edit flags in limactl restart (#5076, thanks to @itsme-ranger)
  • Accept --shell flag in limactl (create|edit|start) (#5194, thanks to @unsuman)

• Networking:

  • Limit socket_vmnet access from %everyone to the %admin group (#5190, thanks to @ekalinin)

• Templates:

  • almalinux-kitten: Move to experimental/ (#4736)
  • alpine: Support --plain (#3057)
  • debian: Support --image-variant=nocloud (#5159, thanks to @Nachiket-Roy)
  • fedora: support RISC-V 64 (#5201)
  • ubuntu: Support --image-variant=minimal (#5159, thanks to @Nachiket-Roy)
  • k8s: Support version and registry parameters (#4872 #5200, thanks to @afbjorklund)
  • experimental/ubuntu-next: point to ubuntu-26.10 (#5214)

Full changes: https://github.com/lima-vm/lima/milestone/70?closed=1 Thanks to @Aneesh-Hegde @Nachiket-Roy @SABITHSAHEB @afbjorklund @arixmkii @bitalizer @ciderale @coulof @ekalinin @gaurav0107 @itsme-ranger @jandubois @kavirakesh14 @loncharles @mie313 @pirate @resker @trodemaster @unsuman

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/29470510152

The sha256sum of the SHA256SUMS file itself is 6c4fc48f1b415461272bac7082c8c6564f714638533e9e58b9e9f0846f51376b .

---

Release manager: @AkihiroSuda

Changes

• Cherry-picks from master to release/2.1
  • Only add xorrisofs flag to the xorrisofs command (#5129, thanks to @afbjorklund)
  • fix(qemu): fallback from hvf to tcg on macOS (#5137, thanks to @kavirakesh14)
  • nerdctl: update from v2.3.3 to v2.3.4 (#5169)
  • templates: update (#5170)
  • templates/freebsd-15: support 9p mounts (#5172)
  • cmd/limactl: include name in network list --json output (#5179, thanks to @coulof)

Full changes: https://github.com/lima-vm/lima/milestone/73?closed=1

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/28630554371

The sha256sum of the SHA256SUMS file itself is 8bd82f03bc23acafc7e129fdbcbd9401b50eee2723817b8127f16dee3aebef92 .

---

Release manager: @AkihiroSuda

Changes

• Guest OS support:

  • Experimentally support Windows server 2025 guest (#5138, thanks to @mie313)

• limactl CLI:

  • Add limactl screenshot (#5098, thanks to @trodemaster)

• QEMU:

  • Implement TPM emulation (#5148, thanks to @mie313)

• Templates:

  • Move almalinux-kitten to experimental/ (#4736)

Full changes: https://github.com/lima-vm/lima/milestone/70?closed=1 Thanks to @Aneesh-Hegde @Nachiket-Roy @SABITHSAHEB @afbjorklund @arixmkii @bitalizer @coulof @ekalinin @gaurav0107 @itsme-ranger @jandubois @kavirakesh14 @loncharles @mie313 @pirate @resker @trodemaster @unsuman

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/28587104670

The sha256sum of the SHA256SUMS file itself is 708348bfe3ec40477c864b49dde0e2d4c7056c70e92a4211047c6927eee1b642 .

---

Release manager: @AkihiroSuda

• Cherry-picks from master to release/2.1 (#5131)

  • limayaml: do not default containerd.user=true on non-Linux guests (#5090, thanks to @gaurav0107)
  • fix(copytool): fallback to scp for remote source and destination in auto mode (#5097, thanks to @unsuman)
  • templates: switch the default image from ubuntu-25.10 to ubuntu-26.04 (#5106)
  • krunkit: disable ssh.overVsock by default (#5123)
  • fix(makefile): propagate build failure for additional drivers (#5125, thanks to @unsuman)
  • templates: update (#5130)
  • nerdctl: update from v2.2.2 to v2.3.3 (#5134)
    • v2.3.0 release note
    • v2.3.1 release note
    • v2.3.2 release note
    • v2.3.3 release note
      • nerdctl v2.3.3 contains containerd v2.3.2, which fixes CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262

• Fix CVE-2026-53657 (GHSA-2j9v-p4xj-cjw2) "An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket"

Full changes: https://github.com/lima-vm/lima/milestone/72

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/27824357138

The sha256sum of the SHA256SUMS file itself is ddaf499316c159493ccf853393e35c93d69e8c1f85cb041f6f7e918157625c6c .

---

Release manager: @AkihiroSuda

Changes

• limactl CLI:

  • fix(shell): check if mounts contain hostCurrentDir, not just len > 0 (#4799, thanks to @opjt)
  • limactl: add --param shortcut for template parameters (#4873, thanks to @jandubois)
  • shell: fix path quoting for rsync 3.0.0 through 3.2.3 (#4883, thanks to @Mysterio-17)
  • pkg/store: treat unknown terminal width as unlimited in limactl ls (#4918, thanks to @sahitya-chandra)
  • feat: add tab suggestions for --set flag (#5000, thanks to @Aneesh-Hegde)
  • fix(shell-sync): preserve synced guest changes on TUI interruption (#5002)

• Templates:

  • Update k8s.yaml for bootstrapToken configuration in kubeadm (#4829, thanks to @techthumb)
  • templates: migrate from cpuType to vmOpts.qemu.cpuType (#4834, thanks to @AkihiroSuda)
  • Multi node k8s test updates and related fixes (#4835, thanks to @techthumb)
  • Bump k8s flannel version from 0.27.4 to 0.28.4 (#4843, thanks to @afbjorklund)
  • templates: add ubuntu-26.04 (#4874, thanks to @AkihiroSuda)
  • templates: k8s: pin Kubernetes version to 1.36 (#4882, thanks to @AkihiroSuda)
  • templates: split template:alpine to template:alpine-{3.21,3.22,3.23} (#4897, thanks to @Mysterio-17)
  • feat(templates): add Fedora 44 template; remove Fedora 41 template (#4905, thanks to @valdela1)
  • Missing image and checksum for debian-13 riscv64 (#4978, thanks to @afbjorklund)
  • fix: prevent docker from running as root in rootless environment (#4987, thanks to @Aneesh-Hegde)

• Hostagent:

  • hostagent: close stale GuestAgentClient on reconnect to stop ClientConn leak (#4889, thanks to @mn-ram)
  • hostagent: stop leaking inotify watchers and re-spawn the gRPC stream after guest-agent reconnect (#4895, thanks to @mn-ram)
  • hostagent: stop destroying ga.sock on guest-agent reconnect (#4911, thanks to @mn-ram)
  • hostagent: wait for the guest agent before opening the inotify stream (#4924, thanks to @sahitya-chandra)

• Drivers:

  • Krunkit: support SSHOverVsock and replace SSH-based guestagent connection with vsock (#4822)
  • wsl2: stop spinning in for { <-ctx.Done() } after instance stop (#4892, thanks to @mn-ram)
  • fix: track driver PID to prevent zombie processes (#4939, thanks to @Aneesh-Hegde)
  • fix(darwin): pin main goroutine to OS thread 0 for VZ GUI (#5036, thanks to @trodemaster)

• QEMU:

  • openSUSE dropped the 2MB OVMF images from QEMU in version 202602 (#4910, thanks to @jandubois)
  • QEMU command line: allow kernel-irqchip enabled with WHPX (#4933, thanks to @arixmkii)
  • qemu: fix non-deterministic boot disk with bootindex and s390x support (#4944, thanks to @Soumya-codr)
  • Deprecate _LIMA_QEMU_UEFI_IN_BIOS flag (#4948, thanks to @arixmkii)
  • fix(validate): correct misleading mountType validation error on Windows (#4956, thanks to @InsidiousLion)
  • qemu: pass -vga none for headless guests (#4975, thanks to @jandubois)

• Port Forwarding:

  • portfwd: fix gRPC tunnel connection leak (#5043, thanks to @vasileknik76)

• Guest Support:

  • Fix DNS not propagated from base template (#4803, thanks to @opjt)
  • feat: validate macOS 26+ requirement for macOS guest VMs (#4809, thanks to @sharanrajt)
  • Busybox grep doesn't support the long form options (#4915, thanks to @jandubois)
  • Settle udev between sfdisk and lsblk (#4920, thanks to @jandubois)
  • Add Apparmor's fusermount3 custom rule for reverse SSHFS (#4968, thanks to @mie313)

• Documentation:

  • Fix LIMA_SHELLENV_ALLOW docs to match implementation (#4832, thanks to @jandubois)
  • docs(stargz): drop Rosetta requirement note (#4860, thanks to @mvanhorn)
  • docs: add blogs section with curated CNCF and nttlabs posts (#4863, thanks to @singhvishalkr)
  • docs: add limactl help yq concept guide to explain yqlib limitations (#4886, thanks to @Mysterio-17)
  • docs: add network and disk management guide (#4925, thanks to @alliasgher)
  • docs: add base image update and supply chain guidance (#4963)

Full Changes: https://github.com/lima-vm/lima/milestone/71?closed=1

Thanks to @afbjorklund @AkihiroSuda @alexandear @alliasgher @Aneesh-Hegde @arixmkii @ashwat287 @InsidiousLion @jandubois @kolyshkin @mie313 @mn-ram @mvanhorn @Mysterio-17 @opjt @sahitya-chandra @sharanrajt @singhvishalkr @Soumya-codr @SwarritSrivastava @techthumb @trodemaster @valdela1 @varsha-0007 @vasileknik76 🙏🏻

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/26744671609

The sha256sum of the SHA256SUMS file itself is 84da4b818130a3601c2aafa53bca25a0e8088b4aa9780b451fc9b778f96b994b .

---

Release manager: Ansuman Sahoo (@unsuman)

Changes

• limactl CLI:

  • fix(shell): check if mounts contain hostCurrentDir, not just len > 0 (#4799, thanks to @opjt)
  • limactl: add --param shortcut for template parameters (#4873, thanks to @jandubois)
  • shell: fix path quoting for rsync 3.0.0 through 3.2.3 (#4883, thanks to @Mysterio-17)

• Templates:

  • Update k8s.yaml for bootstrapToken configuration in kubeadm (#4829, thanks to @techthumb)
  • templates: migrate from cpuType to vmOpts.qemu.cpuType (#4834, thanks to @AkihiroSuda)
  • Multi node k8s test updates and related fixes (#4835, thanks to @techthumb)
  • Bump k8s flannel version from 0.27.4 to 0.28.4 (#4843, thanks to @afbjorklund)
  • templates: add ubuntu-26.04 (#4874, thanks to @AkihiroSuda)

• Hostagent:

  • hostagent: close stale GuestAgentClient on reconnect to stop ClientConn leak (#4889, thanks to @mn-ram)

• Guest Support:

  • feat: validate macOS 26+ requirement for macOS guest VMs (#4809, thanks to @sharanrajt)
  • Fix race condition in 04-persistent-data-volume.sh (#4831, thanks to @jandubois)

• Documentation:

  • docs(stargz): drop Rosetta requirement note (#4860, thanks to @mvanhorn)
  • docs: add blogs section with curated CNCF and nttlabs posts (#4863, thanks to @singhvishalkr)

Full Changes: https://github.com/lima-vm/lima/milestone/71?closed=1

Thanks to @afbjorklund @AkihiroSuda @jandubois @mn-ram @mvanhorn @Mysterio-17 @opjt @sharanrajt @singhvishalkr @techthumb 🙏🏻

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/25182777406

The sha256sum of the SHA256SUMS file itself is 8fd6476dfee91b841c3e42add090927ff54b2bd3c13bdc33242e842213d8cea7 .

---

Release manager: Ansuman Sahoo (@unsuman)

Changes

• Binary release:

  • Add Windows artifacts (#4789)

• macOS guest:

  • Allow unusual range of UID (#4171, thanks to @balajiv113)

• vz:

  • Honor audio.device=none (#4762, thanks to @BizerNotNull)

• nerdctl:

  • Update from v2.2.1 to v2.2.2 (#4787)
    • This release of the nerdctl distribution updates BuildKit (0.28.1), CNI plugins (1.9.1), and a few dependencies (#4815). See the release note of BuildKit and CNI plugins for their security updates.

• Templates:

  • almalinux-kitten-10: support riscv64 (#4753)

• Project:

  • MAINTAINERS: promote Ansuman Sahoo (@unsuman) to a Committer (#4765)

Full changes: https://github.com/lima-vm/lima/milestone/69?closed=1 Thanks to @BizerNotNull @balajiv113 @jandubois @lukasfroehlich1 @qeinstein @unsuman

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/23954640668

The sha256sum of the SHA256SUMS file itself is 18c18811309d97c8e94d8612223d7fde510301e57edeb3374359f65ab6461b0d .

---

Release manager: @AkihiroSuda

🎉 Highlights:

• 🍎 Support macOS guests: limactl start template:macos
• 👿 Support FreeBSD guests: limactl start template:freebsd
• 🔄 Add limactl shell --sync to prevent AI agents from breaking the host files

Changes

• Guest OS support:

  • Experimentally support macOS guests (#4595)
  • Experimentally support FreeBSD guests (#4627)

• limactl CLI:

  • Add limactl watch command (#4489, thanks to @IrvingMg)
  • Add limactl shell --sync to prevent AI agents from breaking the host files (#4429, thanks to @unsuman)
  • Add limactl (create|edit|start) --nested-virt as an alias for --set '.nestedVirtualization = true' (#4663)

• Guest home directory:

  • The guest home directory is changed from /home/${USER}.linux to /home/${USER}.guest (#4578). For compatibility, the old path is symlinked to the new one.

• QEMU:

  • Use QEMU by default for non-native architectures (#4725)

• krunkit:

  • Support nested virtualization (#4658, thanks to @abiosoft)

• Hostagent:

  • Add host-to-guest time synchronization (#4527, thanks to @mfenderov)

• Guestagent:

  • Reduce binary footprint (14M -> 6.1M) (#4120, #4536)

• Internal file structure:

  • basedisk and diffdisk are consolidated into a single disk file for efficiency (#4587, thanks to @jandubois). No impact is expected for end users. An instance created with Lima v2.0 or v1.x should continue to boot with Lima v2.1 (but not vice versa).

• Templates:

  • k3s: support creating multi-node clusters (#4505, thanks to @afbjorklund)
  • Restore debian-11 (#4574, thanks to @olamilekan000)
  • Add homebrew-macos (#4737)
  • Add experimental/fedora-rawhide (#4738)

• Project:

  • MAINTAINERS: promote Norio Nomura (@norio-nomura) to a Committer (#4511)

Full changes: https://github.com/lima-vm/lima/milestone/62?closed=1 Thanks to @Harry-kp @IrvingMg @TatsuyaHayashino @abiosoft @afbjorklund @alexandear @arixmkii @bmwiedemann @hekki @jandubois @majiayu000 @mfenderov @ningmingxiao @norio-nomura @olamilekan000 @qeinstein @tharunn0 @tushar1977 @unsuman @xvchris

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/23181461567

The sha256sum of the SHA256SUMS file itself is 2298d66eb040f2793187371f5920a6bce44740a8099b25b8d0ec05a02cf7f1e0 .

---

Release manager: @AkihiroSuda

🎉 Highlights:

• Support macOS guests: limactl start template:macos
• Support FreeBSD guests: limactl start template:freebsd
• Add limactl shell --sync to prevent AI agents from breaking the host files

Changes

• Guest OS support:

  • Experimentally support macOS guests (#4595)
  • Experimentally support FreeBSD guests (#4627)

• limactl CLI:

  • Add limactl watch command (#4489, thanks to @IrvingMg)
  • Add limactl shell --sync to prevent AI agents from breaking the host files (#4429, thanks to @unsuman)
  • Add limactl (create|edit|start) --nested-virt as an alias for --set '.nestedVirtualization = true' (#4663)

• Guest home directory:

  • The guest home directory is changed from /home/${USER}.linux to /home/${USER}.guest (#4578). For compatibility, the old path is symlinked to the new one.

• QEMU:

  • Use QEMU by default for non-native architectures (#4725)

• krunkit:

  • Support nested virtualization (#4658, thanks to @abiosoft)

• Hostagent:

  • Add host-to-guest time synchronization (#4527, thanks to @mfenderov)

• Guestagent:

  • Reduce binary footprint (14M -> 6.1M) (#4120, #4536)

• Internal file structure:

  • basedisk and diffdisk are consolidated into a single disk file for efficiency (#4587, thanks to @jandubois). No impact is expected for end users. An instance created with Lima v2.0 or v1.x should continue to boot with Lima v2.1 (but not vice versa).

• Templates:

  • k3s: support creating multi-node clusters (#4505, thanks to @afbjorklund)
  • Restore debian-11 (#4574, thanks to @olamilekan000)

• Project:

  • MAINTAINERS: promote Norio Nomura (@norio-nomura) to a Committer (#4511)

Full changes: https://github.com/lima-vm/lima/milestone/62?closed=1 @Harry-kp @IrvingMg @TatsuyaHayashino @abiosoft @afbjorklund @alexandear @arixmkii @bmwiedemann @hekki @jandubois @majiayu000 @mfenderov @ningmingxiao @norio-nomura @olamilekan000 @tharunn0 @tushar1977 @unsuman

Usage

$ limactl create
$ limactl start
...
INFO[0029] READY. Run `lima` to open the shell.

$ lima uname
Linux

---

The binaries were built automatically on GitHub Actions. The build log is available for 90 days: https://github.com/lima-vm/lima/actions/runs/23115903481

The sha256sum of the SHA256SUMS file itself is 90f5f673101d51e1f1b4c219d883a34b389cea5fb3f0d65b4b2944b96def4015 .

---

Release manager: @AkihiroSuda