[DNM]: Support for lima:shared, lima:bridged, lima:host on Linux hosts - #5433
Draft
unsuman wants to merge 5 commits into
Draft
[DNM]: Support for lima:shared, lima:bridged, lima:host on Linux hosts#5433unsuman wants to merge 5 commits into
lima:shared, lima:bridged, lima:host on Linux hosts#5433unsuman wants to merge 5 commits into
Conversation
unsuman
added
component/network/vmnet
impact/changelog
host/Linux
unsuman
force-pushed
the
net/linux-networking
branch
2 times, most recently
from
August 20, 2026 18:45
a10bc07 to
df585f5
Compare
Generalize the daemon handling in pkg/networks, which so far assumed that socket_vmnet is the only privileged helper, and describe the Linux helper (lima-net) next to it: - RequiredDaemons() returns the helpers needed on the current host, so the callers no longer have to hardcode socket_vmnet. - paths.limaNet holds the path of the Linux helper, mirroring paths.socketVMNet. - StartCmd() renders the lima-net command line, and TapCmd() the command that attaches an instance to the bridge of a network. - TapName() derives a tap device name that fits into IFNAMSIZ, IsTapName() recognizes it, and TapNamePattern() renders the matching sudoers wildcard. lima-net itself is added in a follow-up commit. Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>
Linux has no equivalent of socket_vmnet, so add lima-net, a small helper that limactl runs via sudo to set up the "shared", "host" and "bridged" networks. `lima-net start` creates (for "shared" and "host") the lima-<name> bridge, assigns the gateway address, spawns dnsmasq for DHCP, and installs the NAT/forwarding rules of the "shared" mode. `lima-net tap` creates the tap device of a single instance, hands it to the calling user, and attaches it to the bridge. Both take all parameters from the command line rather than reading the user-writable networks.yaml, because the arguments are what the sudoers file pins down. The helper tears the network down again when the last instance leaves, and only ever touches bridges and tap devices that follow the Lima naming scheme. Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>
Teach the networks.yaml defaults, the path validation and the sudoers generator about Linux hosts: - The default networks.yaml now points at the lima-net binary in libexec/lima, uses /run/lima and /etc/sudoers.d/lima, picks the "sudo" or "wheel" group, and documents that "bridged" needs an already existing bridge (Lima never enslaves a physical interface). - Validate() checks whichever of paths.socketVMNet / paths.limaNet belongs to the host OS, and tolerates an unreadable /etc/sudoers.d, which is typically 0750 root:root. varRun only has to be daemon-group-writable on macOS, because lima-net runs as root. - Sudoers() iterates over RequiredDaemons() and, for lima-net, additionally allows the tap command, restricted by TapNamePattern() so that no extra arguments can be smuggled in. The mkdir rule stays macOS-only. - `limactl sudoers` is enabled on Linux and only refers users to the socket_vmnet documentation on macOS. Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>
Wire the Linux helper into the instance lifecycle so that the non-usernet networks can actually be used: - reconcile tracks which instances use a network instead of just a boolean, so that it can create one tap device per instance after starting lima-net. The daemon list, the varRun handling and the start retries are derived from RequiredDaemons() rather than from GOOS checks. - The QEMU driver attaches the instance to its tap device (script=no, since the device is already owned by the user and enslaved to the bridge). - limayaml validation accepts the `lima` network field on Linux. Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>
Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>
unsuman
force-pushed
the
net/linux-networking
branch
from
August 21, 2026 12:20
df585f5 to
355f303
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What This PR Changes
This PR adds support for non-userV2 networking support on Linux hosts, through a helper privileged binary
lima-netplaced inside<PREFIX>/libexec/lima/lima-net. It creates a Linux bridge per network and attaches one tap device per instance.Do not merge this PR as I plan to raise these changes as separate PRs for easy reviewing.
Linked Issue (Required in most cases)
Closes #4371
How I Tested This
On my
Fedora Linux 43 (Workstation Edition):lima:sharedlima:hostlima:bridgedCaution
While using this mode, the host is disconnected from the network as the physical interface is hand over to the guest.
AI Usage
Assisted-by: Claude Opus 5