2026-09-17 (Thursday)

[AkihiroSuda]

How to join

• Date: 2026-09-17 (Thursday) 05:30 UTC (Wednesday 22:30 PDT, 07:30 CEST, 11:00 IST, 14:30 JST) - 06:30
• Link: https://zoom-lfx.platform.linuxfoundation.org/meetings/lima
  • Zoom, Video recording, and AI-generated meeting note

The meetings are open to anyone, not just for maintainers and contributors.

Attendees

@AkihiroSuda @unsuman @afbjorklund @jandubois @sharanrajt

Agenda

Note taker: @AkihiroSuda

v2.2.1

Right after the release of nerdctl v2.4 (this week)

• v2.4.0 planning containerd/nerdctl#5123

Cherry-pick several PRs https://github.com/lima-vm/lima/pulls?q=is%3Apr+is%3Aopen+label%3Acherry-pick%2Fv2.2

v2.3

• GA around late September? Early October? November (right be fore KubeCon North America) in the worst case
• Maybe after the release of Ubuntu 26.10

PR reviews

https://github.com/lima-vm/lima/pulls

• Several Windows-related PRs from @jandubois

  • cidata: allow apparmor mounts on every Lima mount point #5375
    • Merged, there was discussion about overwriting the apparmor profile or not
  • CI: factor Windows setup into composite actions; add plain-Windows jobs #5342
    • Marked as a draft, depends on several PRs pending merging
  • docs: document the Windows host SSH toolchain #5341
    • Almost ready to merge, just Prerequisite in installation/_index.md needs to be cleaned up
  • copytool: report a bad path instead of a missing tool #5337
    • Almost ready to merge, needs rebasing
  • copytool: support native Windows OpenSSH #5299
    • Needs CI (to be covered in CI: factor Windows setup into composite actions; add plain-Windows jobs #5342)
    • Needs rebasing

• guestSocket forwards die with the SSH ControlMaster and are never re-created (silent on vz) #5420

  • port forwarding in SSH mode could be broken due to the 1024 FD limit (select, not poll)
  • @jandubois reproduced it, will post an update
  • Some people argued that it was related to sleeping the laptop, but unlikely related

• templates: add macos-27 (Golden Gate) #5503

  • The host OS seems to need to be newer than the guest
  • The doc needs to be updated @AkihiroSuda

• feature: support to specify vm instance dir #5497

  • Just move the disk image (older PR feature: support to set vm disk dir #5496) or move the directory (current PR)?
  • Moving the dir may have issues with socket path length? How are symlinks resolved? -- @jandubois
  • Needs to be marked as an experimental -- @AkihiroSuda
  • There should be doc about the socket path length, if we are going to symlink the entire dir -- @AkihiroSuda
  • Just moving the disk image sounds better for covering additional disks. limactl create disk needs to be updated too -- @jandubois
    • limactl rm should just remove the symlink or remove the disk image itself? -- @AkihiroSuda
      • Should also remove the disk image itself -- @jandubois
  • No need to add YAML property -- @AkihiroSuda @jandubois
  • CLI flags: limactl create --disk-path=/path/to/disk.img limactl disk create --disk-path
    • limactl disk create --disk-path could potentially be limactl disk create --path, but that is inconsistent with limactl create --disk-path, so let's adopt --disk-path for both limactl create and limactl disk create -- @jandubois

• Networking PRs from @unsuman

  • networks: add the lima-privileged-net daemon and tap device naming #5484 networks: generate Linux defaults, validation and sudoers rules #5485 networks: enable lima:shared, lima:host and lima:bridged on Linux #5486
  • Almost ready to merge, but needs careful security review
  • networks: generate Linux defaults, validation and sudoers rules #5485 needs trivial fixes
  • @jandubois will run his AI security review tool

• Secure macOS VZ block-device attachment #5117

  • priv helper, similar to the networking PRs above
  • @jandubois will run his AI security review tool

• fix(cidata): resolve AlmaLinux 10 boot failures #5372

  • Need to hear what was the error, or maybe @AkihiroSuda will investigate by himself

• fix: Disable LLMNR to prevent Debian SSH login delay #5399

  • Similar to the hack in Ubuntu 26.04 for cloud-init networking stuff
  • Can be merged -- @afbjorklund
  • DCO error needs to be fixed -- @AkihiroSuda

• Add SBOM artifact using cyclonedx-gomod #5220

  • Did anybody ask for SBOM? -- @jandubois
    • not for now, but will be more important next year https://sbomeurope.eu/ @afbjorklund
  • Eventually cover nerdctl and packages installed during cloud-init -- @AkihiroSuda
  • Merge after confirming that CI passes -- @AkihiroSuda

ARM Mac CI

• macos-15-intel will reach EOL next year [macOS] The additional macOS 15 Sonoma Intel-based image will be available in GitHub Actions actions/runner-images#13045
  • Update: macos-26-intel will survive until Nov 2028 macOS 26 (Tahoe) is now generally available in GitHub Actions actions/runner-images#13739 (comment)
• GitHub may update ARM Mac but they still do not support nested virt for macOS guests
• Needs to ask CNCF for help
• We may get a private runner, but probably not applicable for every PR. Only for vz PRs after reviewing perhaps
• We still almost have a year, can wait for several months to see something is going to change. Otherwise @AkihiroSuda will reach out to CNCF.
• Podman Desktop seems using macos-26-arm64 for E2E testing? Needs investigation @afbjorklund @AkihiroSuda https://github.com/podman-desktop/podman-desktop/blob/main/.github/workflows/e2e-main.yaml

Rewriting socket_vmnet in Go

• Rewrite socket_vmnet in Go and integrate it to lima-privileged-net #5495
  • Likely to land in v2.4, not v2.3

Tasks

• @jandubois update guestSocket forwards die with the SSH ControlMaster and are never re-created (silent on vz) #5420
• @jandubois rebase his PRs, and @AkihiroSuda will merge them
• @AkihiroSuda update docs templates: add macos-27 (Golden Gate) #5503 for older host OS
• @AkihiroSuda post the discussion today to feature: support to specify vm instance dir #5497
• @unsuman update networks: generate Linux defaults, validation and sudoers rules #5485
• @jandubois run his AI security review tool for networks: add the lima-privileged-net daemon and tap device naming #5484 networks: generate Linux defaults, validation and sudoers rules #5485 networks: enable lima:shared, lima:host and lima:bridged on Linux #5486 Secure macOS VZ block-device attachment #5117
• @AkihiroSuda merge Add SBOM artifact using cyclonedx-gomod #5220 after CI passes

Next meeting

2026-10-15 (Thursday)

• Finalize v2.3 planning

[AkihiroSuda]

AI-generated meeting note

Quick Recap

The meeting focused on planning Lima releases 2.2.1, 2.3~, and 2.3.1~, and on reviewing pending PRs. Akihiro and Jan discussed several Windows-related PRs, including changes to AppArmor handling, documentation updates, and CI conflicts. Jan reported on ongoing investigation of SSH port forwarding issues on macOS related to select and file descriptor limits, referencing issue 5420. The group debated a design for moving large instance directories or disk images to other locations, preferring to symlink only the disk file and keep metadata in Lima home, and discussed implications for Lima control disk commands. They reviewed PRs for managing networking on WSL Linux hosts, with security-sensitive changes to sudoers files, and touched on a PR to ignore certain nuclear system systemd (?) failures. They discussed a PR to add an mDNS workaround for SSH on Debian, similar to previous Ubuntu handling. Anders presented the status of SBOM generation for Lima, noting its current limitations and side effects on CI, and the group saw it as low priority for now. The participants also discussed the upcoming deprecation of GitHub’s Intel macOS runners and possible reliance on CNCF or other solutions for macOS CI. They briefly mentioned the plan for BMNet VMNet support and looked at how other CNCF projects handle macOS CI. The conversation ended with a recap of the release context and open PR topics.

Next Steps

• Jan: Address remaining review feedback and finalize Windows PRs for merging before 2.3.
• Jan: Assign GitHub issue guestSocket forwards die with the SSH ControlMaster and are never re-created (silent on vz) #5420 (SSH port forwarding hanging on macOS) to himself and provide an update after further investigation.
• Jan: Run the Daemon PRs (for managing networking on DX Linux hosts) through a security review (e.g., using deep AI review) before merging.
• Jan: Add the WebView2 review (?) for block device PR to his list for review.
• Akihiro: Update the Golden Gate documentation to specify that the host OS must be newer than the guest OS.
• Akihiro: Update the PR for Lima control disk create to reflect the correct subcommand order and clarify the disk props naming.
• Akihiro Jan: Post an update to GitHub issue guestSocket forwards die with the SSH ControlMaster and are never re-created (silent on vz) #5420 regarding SSH port forwarding.
• Akihiro Ansuman: Update the SHA-256 digest computation code as suggested in the Daemon PR.
• Anders: Rebase and address CI failures for the SBOM (Software Bill of Materials) PR before merging.
• Anders: Open separate issues/PRs for GitHub Actions improvements identified during SBOM work.
  Akihiro: Contact CNCF in the future to inquire about macOS CI runners, as GitHub is retiring Intel macOS runners.
• Akihiro: Investigate how other CNCF projects (e.g., Podman, Minikube) handle macOS CI for potential solutions.

Summary

Version 2.3.1 2.2.1 Release Planning:
Akihiro discussed plans for releasing version 2.3.1 2.2.1 after North City nerdctl version 2.4, with a target release in October or November, and mentioned the need to cherry pick several peers PRs and update templates for macOS. Jan requested that his Windows PRs from June and July be merged before version 2.3, particularly highlighting work on app armor and a verbose QEMU-related issue. Akihiro approved Jan's approach to file overwriting and indicated the Windows PR was nearly ready for merge, though they discussed whether to mention the OpenSes OpenSSH client installation requirements.

Code Changes and Technical Issues:
Jan and Akihiro discussed code changes and merge conflicts, with Akihiro noting that a recent merge caused a regression in Copy-R limactl copy -r. Jan reported finding the root cause of SSH port forwarding hanging issues on macOS, attributing it to OpenSSH using select instead of poll for file descriptors over 1024, which causes connections to break. Akihiro asked Jan to assign GitHub issue #5420 to themselves and requested an update on the Golden Gate documentation regarding macOS version compatibility. They also briefly mentioned an upcoming discussion about design changes for version 5.9.0 2.3.0 related to instance directory management in Total Lima Directory.

Lima Disk Management Implementation Discussion:
The team discussed implementing disk management features for Lima, focusing on whether to use symlinks or direct file paths for disk operations. Jan and Akihiro debated the merits of different approaches, with Jan preferring to keep metadata in one location while using symlinks for data storage on additional disks. The group agreed to mark the feature as experimental and document path length limitations, with Akihiro planning to update the Lima control command to support arbitrary paths. They also decided to use "disk props" (???) as the problem name and confirmed the correct command syntax should be "Lima control disk create" rather than "Lima control create disk."

PR Review and Code Updates:
Jan discussed reviewing draft PRs, with Akihiro explaining that some were marked as draft due to dependency issues requiring peer merging. Akihiro suggested refactoring SHA-256 digest computation code and mentioned the need to run WebView2 review (?) for block device. They also discussed a PR related to SSH issues on Tibia Debian, where Akihiro noted that the upstream OpenSSH fix makes the current PR redundant.

Debian Commit Merge Discussion:
Akihiro and Anders discussed merging a commit with a temporary configuration workaround for Debian, similar to issues encountered with Ubuntu. They agreed it was acceptable to merge the commit with the understanding that it would need to be reverted once the upstream bug is fixed, similar to how they handled the Ubuntu upgrade. The temporary configuration would be included in a future update of the Debian template.

SBOM PR and GitHub Runner:
Anders discussed a pending PR for generating SBOM files for Lima, noting that while it's not currently important for 2021 2026, it may become relevant in the future. The team agreed to merge the PR and monitor its impact, with Anders offering to handle any future SBOM-related enhancements. Jan raised concerns about upcoming changes to GitHub's macOS runners, questioning how the team would handle CI on macOS after Intel runners are retired next year.

macOS CI Runner Discontinuation Planning:
The team discussed challenges with macOS CI runners, particularly the upcoming discontinuation of Intel macOS runners by GitHub in August next year. Jan explained that nested virtualization on macOS doesn't support running macOS VMs, requiring physical machines instead, which would need cleaning jobs after each run. The team decided to wait several months before contacting CNCF for help with obtaining physical Mac runners, as they have about a year before the issue becomes urgent. They also briefly discussed plans to register reimplement BMNet VMNet in version 2.4 rather than 2.3, and noted that Fortran Podman 6 has already removed macOS Intel support.