Akihiro Suda
c80fad98ad
gomodjail v2 moves the focus to static analysis: `gomodjail analyze` verifies that the modules annotated `gomodjail:confined` in go.mod cannot reach a denied capability (filesystem, network, process execution, raw syscalls, OS state modification, or cgo). Add gomodjail to ./hack/tools, add a `gomodjail` lint target, and wire it into `make lint` and the "Lints" job. Unlike the legacy dynamic mode, this gate is blocking. The verdicts are platform-dependent, so the gate is pinned to linux/amd64 and linux/arm64. These are the only platforms that can be analyzed from any host: analyzing darwin needs a macOS host, as the "vz" driver requires cgo. The linux verdicts are a superset of the darwin ones anyway. Windows is deliberately left out, as it would unconfine 18 more modules (go-yaml, containerd/log, go-runewidth, ...) and weaken the gate for the other platforms. `gomodjail fix` downgraded 36 modules to `gomodjail:unconfined` to make the gate pass. 65 modules remain confined: 37 clean, 28 warning-only. `make gomodjail-fix` is added for redoing this on dependency bumps, so that the decision stays visible and reviewable in go.mod. The macOS job that exercises the legacy dynamic mode (`gomodjail run`) is kept as an experiment, with its checkout pinned to v2.0.1 instead of HEAD. Assisted-by: Claude Code (Opus 5) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
[🌎Web site]
[📖Documentation]
[👤Slack (#lima)]
Lima: Linux Machines
Lima launches Linux virtual machines with automatic file sharing and port forwarding (similar to WSL2).
The original goal of Lima was to promote containerd including nerdctl (contaiNERD ctl) to Mac users, but Lima can be used for non-container applications as well.
Lima also supports other container engines (Docker, Podman, Kubernetes, etc.) and non-macOS hosts (Linux, NetBSD, etc.).
Getting started
Set up (Homebrew):
brew install lima
limactl start
To run Linux commands:
lima uname -a
To run containers with containerd:
lima nerdctl run --rm hello-world
To run containers with Docker:
limactl start template:docker
export DOCKER_HOST=$(limactl list docker --format 'unix://{{.Dir}}/sock/docker.sock')
docker run --rm hello-world
To run containers with Kubernetes:
limactl start template:k8s
export KUBECONFIG=$(limactl list k8s --format 'unix://{{.Dir}}/copied-from-guest/kubeconfig.yaml')
kubectl apply -f ...
See https://lima-vm.io/docs/ for the further information.
Contributing
We welcome contributions! Please see our Contributing Guide for details on:
- Developer Certificate of Origin (DCO): All commits must be signed off with
git commit -s - Code licensing and pull request guidelines
- Testing requirements
Community
Adopters
Container environments:
- Rancher Desktop: Kubernetes and container management to the desktop
- Colima: Docker (and Kubernetes) on macOS with minimal setup
- Finch: Finch is a command line client for local container development
- Podman Desktop: Podman Desktop GUI has a plug-in for Lima virtual machines
GUI:
- Lima xbar plugin: xbar plugin to start/stop VMs from the menu bar and see their running status.
- lima-gui: Qt GUI for Lima
Communication channels
- GitHub Discussions
#limachannel in the CNCF Slack- New account: https://slack.cncf.io/
- Login: https://cloud-native.slack.com/
- Community meetings on Zoom (tentatively monthly)
- Meeting notes & agenda proposals: https://github.com/lima-vm/lima/discussions/categories/meetings
- Calendar: https://zoom-lfx.platform.linuxfoundation.org/meetings/lima
Social media accounts
Follow us for project updates, release announcements, and community news:
Code of Conduct
Lima follows the CNCF Code of Conduct.
We are a Cloud Native Computing Foundation incubating project.
The Linux Foundation® (TLF) has registered trademarks and uses trademarks. For a list of TLF trademarks, see Trademark Usage.