2026-06-18 (Thursday)

[AkihiroSuda]

How to join

• Date: 2026-06-18 (Thursday) 05:30 UTC (Wednesday 22:30 PDT, 07:30 CEST, 11:00 IST, 14:30 JST) - 06:30
• Link: https://zoom-lfx.platform.linuxfoundation.org/meetings/lima
  • Zoom, Video recording, and AI-generated meeting note

The meetings are open to anyone, not just for maintainers and contributors.

Attendees

@AkihiroSuda @unsuman @mie313 @jandubois @afbjorklund

Agenda

Note taker: @AkihiroSuda

LFX Mentorship

• [LFX Mentorship] Improve Windows support (guest and host) #4907

https://github.com/cncf/mentoring/tree/main/programs/lfx-mentorship/2026/02-Jun-Aug

• Schedule:
  • Jun 8 - Aug 31: Program term (Evaluations: Jul 21, Aug 25)

✅ Work done on 17th June:

• Try to run Windows VM on Windows host..
• Fixed the path expression for Windows host..
• Identified QEMU11.0.1 does not activate helper function so Windows VM cannot be started..
• Used QEMU11.0.0 instead.
• Learned that starting Windows VM on Windows host seems infeasible. .
  • The VM had not completed startup even after 3 hours..
  • It is probably because Windows host needs to use qemu64 (or my laptop performance is low?).
• Raise an additional PR for Should log messages use %#q instead of %q? #4898.

🎯 Goals for tomorrow:

• Continue modifying unit tests..
• Randomize password in autounattend.xml.

https://cloud-native.slack.com/archives/C0B1S09N04E/p1781726979048389
https://github.com/mie313/lima/commits/support_for_windows_guest/

KubeCon Japan

• 2026-07-29 Wednesday 12:33 PM Project Lightning Talk: Lima in 5 Minutes: From Containers to AI Sandboxing by @unsuman
  https://kubecon-cloudnativecon-japan-2026.sessionize.com/session/1228175
• 2026-07-30 Thursday 10:45-13:00 Project Table https://events.linuxfoundation.org/kubecon-cloudnativecon-japan/features-add-ons/project-engagement/#project-table-directory

Apple Container Machine - @afbjorklund

• Similar to Lima, but differs (read-write by default, password SSH, ...)
• No automatic setup of containers
• No GUI
• No GPU
• OTOH, WSL2 recently supported containers, they have been also supporting GPUs

Podman Desktop - @afbjorklund

• Lima plugin will be moved out to a separate repo Moving lima out of built-in extension to catalog podman-desktop/podman-desktop#17858
• Podman v6 is delayed
  • podman machine now supports creating multiple VMs, but still only one is runnable at the same time. Still not similar to Lima.

PR reviews

https://github.com/lima-vm/lima/pulls

• Ensure only RAW images in cache(imgconv/raw) while keeping the original image #4637

  • Ready to review and merge. Initially planned to be merged in v2.1.

• Add parameters for Kubernetes installation #4872

  • Introduces 3 params. Could be combined to a single one? -- @AkihiroSuda @jandubois
  • Maybe CSV form release=1.36,channel=stable -- @AkihiroSuda
    • No advantage, a single param is preferrable -- @jandubois
  • Will investigate -- @afbjorklund

• Support import of Kubernetes images from tarball #4876

  • ctr seems to have a regression about loading multi-platform images. seems relevant to build attestations (platform=unknown/unknown) -- @afbjorklund
    • there is an issue in the kind repo, @AkihiroSuda will have to take a look
  • the provisioning script uses / as the working directory -- @afbjorklund
    • Weird -- @AkihiroSuda
  • kube-flannel.yaml can be now mounted from the host filesystem, so it should be located in non-root directory, like /var/lib/SOMETHING
  • Use yq or manipulating YAMLs. yq is embedded in the guestagent binary -- @jandubois

• Windows: support native OpenSSH; no Git for Windows / MSYS2 required #4998

  • Some portions have to be separated out to multiple PRs (gzip, rsync, etc.) -- @AkihiroSuda
  • cygpath.exe part was originally planned to be the part of the LFX mentorship Third-party template discovery #4097 -- @AkihiroSuda
    • cygpath.exe is very small portion of the PR -- @jandubois
    • @mie313 can submit her own version. She can also take a commit from the existing PR Windows: support native OpenSSH; no Git for Windows / MSYS2 required #4998 , review and sign-off it -- @jandubois

• Fix: external driver transport irregularities #4877

  • single persistent gRPC server, shared with hostagent -- @unsuman
  • FillConfig is now merged into Configure() -- @unsuman
  • Review may take some time -- @AkihiroSuda

• feat: allow opting out of passwordless sudo #5109

  • ⚠️ Needs careful security review

• Secure macOS VZ block-device attachment #5117

  • ⚠️ Needs careful security review
    • Having sudoers was a bad idea. Could be a privileged helper? Need to investigate how it could be shipped -- @jandubois
    • Does it need signing the binary with Apple Developer ID? -- @AkihiroSuda → Needs investigation
    • Anyway the PR author plans to support Linux hosts too (blockdevice: support qemu and krunkit backends on all host platforms #5104), so it should remain portable to non-macOS -- @AkihiroSuda

• limactl sudoers: consider avoid allowing %everyone by default #5118

  • Why do we allow %everyone, not just the current user, for running socket_vmnet? -- @AkihiroSuda
    • idk, probably for multi-user shared hosts -- @jandubois
  • Safe to change the default without breaking compatibility for most users? -- @AkihiroSuda
    • safe, most users do not need socket_vmnet. vz users can use its own vmnet -- @jandubois
  • We should plan this in v2.2. This is a breaking change, but trivial enough to avoid bumping up the major version to v3. -- @AkihiroSuda

• writeJolietCommand did not work without xorrisofs. #5128

  • Ideally we should have pure-Go generator for ISO with Joliet extension, but not trivial. So let's keep using xorrisofs. The error message has to be improved -- @AkihiroSuda

Tasks

• @mie313: submit a PR for running Windows
• @afbjorklund: update Add parameters for Kubernetes installation #4872 to combine the 3 params into one
• @afbjorklund: update Support import of Kubernetes images from tarball #4876 to read kube-flannel.yaml from the non-root directory. Consider replacing the sed scripts with yq.
• @AkihiroSuda: take a look at Unable to load docker containerd managed images to cluster kubernetes-sigs/kind#3795 for Support import of Kubernetes images from tarball #4876
• @jandubois: split Windows: support native OpenSSH; no Git for Windows / MSYS2 required #4998 to multiple PRs
• @mie313: Submit a PR to remove cygpath.exe dependency, as a part of the LFX Mentorship program. She may take a commit from @jandubois's PR Windows: support native OpenSSH; no Git for Windows / MSYS2 required #4998
• @AkihiroSuda: submit a PR to disallow %everyone to use socket_vmnet by default (limactl sudoers: consider avoid allowing %everyone by default #5118). This is a breaking change, but not worth bumping up the major version to v3.
• @lima-vm/maintainers: review the PRs. Especially the status/needs-careful-security-review items.

Next meeting

2026-07-16 (Thursday) (tentative)

[afbjorklund]

Short discussion about Apple "container machine", an interface in 1.0.0 to make it more similar to WSL2 and Lima:

• Feature Discussion: `distro` subsystem apple/container#868

• https://github.com/apple/container/blob/main/docs/container-machine.md

It does not run containers (out-of-the-box), and there are no images available (with systemd). But it is very similar:

alias coma='container machine run'

coma -it sudo nerdctl run -it alpine

Moving Lima extension out from Podman Desktop, and the first Release Candidate is available for Podman 6.0

• Moving lima out of built-in extension to catalog podman-desktop/podman-desktop#17858

• https://blog.podman.io/2026/05/podman-6-release-delayed/ (https://fedoraproject.org/wiki/Changes/Podman6)

There are no real changes for users, you can install the plugin from the catalog and podman will appear in Fedora 45

[afbjorklund]

Converting version to string

Instead of CSV v1.36,stable,stable we can use YAML {'release': 'v1.36', 'stability': 'stable', 'version': 'stable'}

But I'm not sure that would make the parameters easier to understand, and then I would need to parse it too... (e.g. with yq)

Note: Ideally I want to use stable/stable/stable

And not have to hardcode a release, like now.

Using some yq incantations

BEFORE

grep image kube-flannel.yml | sed -e "s/ *image: //" | sort -r | uniq

AFTER

lima-guestagent yq .spec.template.spec.initContainers.[].image kube-flannel.yml

[AkihiroSuda]

AI-generated meeting note

Quick Recap

The meeting focused on reviewing progress and discussing updates for the Lima project, including the EduFix LFX Mentorship Program and upcoming KureCon Java Japan conference presentations. Mie Tokunaga shared her progress on running Windows VMs, demonstrating successful implementation of Windows VMs inside WSL2 on Windows, though she encountered difficulties running Windows VMs directly on Windows hosts. Anders presented updates on Apple's new 1.0 version of their developer tool, comparing its features to WSL and Lima, noting that while it starts quickly, it lacks kernel and image support, requires manual setup, and doesn't support containers or rootless operation. The team reviewed several pull requests including configuration parameterization, image import functionality, and Windows support without MSIS MSYS integration. Security-related PRs were discussed, particularly regarding sudo passwordless access and broker device support, with concerns raised about the security implications of modifying sudoers files. The conversation ended with a brief discussion about generating ISO images through guest commands and potential portability issues.

Next Steps

• Mie: Submit a new PR to remove the ShakePass.exe cygpath.exe dependency, based on the relevant commit from Jan's PR, as part of the LFX Mentorship Program.
• Jan: Split out the ShakePass.exe cygpath.exe removal part from the large Windows PR and notify Mie when ready for her to create her own PR.
• Anders: Post a new version of the parameter PR to use a single parameter for specifying the crop Kubernetes version, and improve documentation/logic as discussed.
• Anders: Investigate and open an issue (or continue investigation) regarding the saving/loading image tarball problem, possibly in the not city nerdctl report or continually repro, and coordinate with team on potential CTR/image attestation bugs.
• Anders: Relocate configuration/data from the root directory to a more appropriate location for QVDM (?) and related files.
• Jan: Continue preparing the large Windows (no ~MSYS/~MSIS/Git) PR for 2.2, and coordinate with Arthur for review when ready.
• Ansuman: Address merge conflicts and prepare the driver interface PR for review, ensuring it remains portable to macOS.
  Team (Akihiro, Jan, relevant reviewers): Conduct careful security review of PRs related to sudoers, passwordless sudo, and brok block device handling, ensuring security best practices and portability.
• Anders: Investigate and propose a solution/workaround for the genisoimage/xorriso symlink/portability issue, possibly by checking for genisoimage first and falling back as needed.

Summary

EduFix LFX Mentorship Program Progress Update:
The team discussed progress on the EduFix LFX Mentorship Program, where Mie presented her work on running Windows VMs. Mie demonstrated successfully running Windows VMs inside WSL2 on Windows and shared her screen to show the progress, though she noted performance issues due to low laptop specifications. Akihiro suggested Mie submit a pull request after modifying unit tests and randomizing the initial password, which she agreed to do. The meeting also covered upcoming events including KureCon Java Japan where Ansuma will give a writing talk and host a project table~, and~ . Anders will present topics about Apple Computer Container Machine and Patch my Podman desktop (in this meeting, not in KubeCon Japan).

Apple Developer Tools Release Updates:
Anders discussed Apple's release of their 1.0 version for developers, which includes a machine plugin similar to WSL but lacks kernel, images, container support, and GUI. Akihiro inquired about GPU support in Rosetta 2 macOS, to which Anders confirmed it was not implemented yet. Anders also mentioned that Postman Podman plans to remove third-party extensions from the main repo, affecting tools like Kind and Lima, and decided to close related PRs for Podman Desktop.

Podman Version Updates Discussion:
Anders provided an update on Podman, noting that version 6 was delayed but now has an RC release with deprecations including the removal of Mac (version?) and Windows 10 support, along with changes to VM support. The team discussed reviewing PRs with the 2.2 milestone, with Akihiro suggesting they should merge a particular PR that was originally planned for 2.1. Ansuman agreed with this approach, and they aligned on managing this PR as soon as possible in the 2.2 milestone. (Not relevant to Podman)

Crop Kubernetes Version Configuration Parameter Simplification:
The team discussed simplifying configuration parameters for crop Kubernetes versions, with Akihiro suggesting the use of a single parameter instead of three separate ones. Anders agreed this would be preferable and committed to revising the PR to use a single parameter approach. Jan noted that if parameters are related, combining them into a single parameter would make the mechanism simpler for users, but if they are independent, keeping them separate would be more appropriate.

Software Release and Configuration Issues:
Anders explained that releasing software has become more complicated due to upstream changes that created separate repositories for each release, requiring different package configurations. Anders is investigating image import issues where saving and loading tarballs is failing due to potential platform changes or bugs. The team also discussed concerns about cube-funnel kube-flannel YAML paths, which currently use the root directory instead of the expected current directory, though Anders noted this was already being used for QVDM (?) configuration and needs relocation to a more appropriate directory.

YAML Mounting and Parsing Discussion:
Anders and Akihiro discussed fixing a PR related to mounting YAML files from the host, with Anders suggesting it might be better to make it mountable rather than having it on the VM. Jan recommended using the YQ subcommand in the Lima guest agent instead of grep and sed for parsing YAML files. The team also touched on issues with multiple images and Docker Kubernetes versions, with Anders considering switching to using CTL CTR instead of NERD CTL. Jan suggested using the YQ provisioning script for extracting data if the file is mounted, though it's unclear if this applies to their current situation.

Lima Windows PR Discussion:
Jan discussed a large PR for running Lima on Windows without MSIS MSYS and Git, which is currently in draft and needs further preparation before review. Akihiro and Jan agreed that the PR should likely be split into multiple smaller PRs due to its scope and potential impact on testing. Anders mentioned that Microsoft is now shipping core utils with future Windows versions, which could affect the implementation. The team noted the need to confirm the scope changes for the mentorship program regarding the removal of MSIS MSYS integration. (The scope does not need to be changed)

PR Reviews and Security Updates:
The team discussed several PR reviews and security concerns. Jan agreed to separate out the ShakePass.exe cygpath.exe component from his PR and either create a new PR with Mie or have Mie resubmit it under her own name for the mentorship program. Ansuman presented a significant PR about driver server changes that moves Unix sockets to the instance directory and merges FieldConfig FillConfig into Configure, though it still needs review. The team also addressed security concerns around passwordless sudo and broccoli block device access, with Akihiro noting that PR 5109 needs careful security review as it modifies sudoers files. Anders briefly mentioned a portability issue with genisoimage command replacement that needs a workaround for Fedora systems (not relevant to Fedora?).