AI
What Lima Is and Where It Runs
Lima stands for Linux virtual machines, originally built to promote containerd workflows to macOS users. Version 2.1, released the week of this talk, supports macOS guests and FreeBSD guests alongside Linux, with Windows guest support planned. Host support covers macOS, Linux, Windows, NetBSD, and DragonFly BSD. The default container engine is containerd with nerdctl, but Docker, Podman, Kubernetes, and Apptainer are all available. Automatic host filesystem sharing and port forwarding are on by default and can be disabled.
A Community of 20,000 Stars and Third-Party Tools
Lima reached CNCF incubating status last year and now holds 20,000 GitHub stars with close to 170 contributors. Third-party projects built on Lima include Colima (Docker as default engine), Rancher Desktop (combines Lima with K3s and a GUI), and Finch (Amazon’s local development tool with AWS Serverless Application Model support). Podman Desktop ships a plugin to manage Lima instances. Projects like kind, nerdctl, runc, and uutils use Lima in GitHub Actions to test SELinux compatibility on Fedora, AlmaLinux 8, and LXC.
Why AI Agents Need VM-Level Isolation
A Claude Code user posted on Reddit that the agent attempted to remove the home directory of the host machine. Separately, a security researcher found that GitHub Copilot was hijacked when a hidden prompt injection flipped VS Code’s auto-approve execution flag, giving the AI permission to run anything without human consent. Linux landlock and Docker containers provide some isolation, but neither matches a full VM. Lima offers system-level isolation that works for any agent, on any OS, without requiring the agent itself to support sandboxing.
AI Inside and Outside Lima: Two Operating Modes
“AI inside Lima” means installing a coding agent such as Codex, Copilot, or Claude inside the VM and using it there. GPU-accelerated inference is available via the KaKit VM driver: llama.cpp inside the VM calls the Vulkan API, which routes through MoltenVK to Apple Silicon’s Metal API. “AI outside Lima” means the agent runs on the host but receives a set of MCP tools, list directory, read/write file, and run shell command, that execute inside the sandboxed VM. VS Code with Remote SSH and Copilot works with this mode.
Lima 2.1 Sync Mode: Blocking Destructive AI Writes
Standard Lima mounts are live and bidirectional: changes inside the guest immediately appear on the host. Sync mode, new in v2.1, breaks that link. Files sync out only after the user reviews and approves each change. The live demo showed this directly: a simulated malicious AI injected rm -rf --no-preserve-root into a shell script inside the VM. When the user ran lima sync to push files back to the host, Lima displayed the diff and asked yes or no. The user chose no, and the destructive change never reached the host.
Roadmap: Windows Guests, Lima Compose, and Broader AI Support
Planned additions include more VM drivers for IaaS instances, Windows guest support, and a TUI to improve the developer experience. Lima Compose, modeled on Docker Compose, will manage multiple VM instances together. AI workload support currently runs only on Apple Silicon Mac. The team plans to extend GPU acceleration and MCP sandboxing to Linux and Windows hosts. A custom VM driver API already exists via gRPC, so drivers for Firecracker or any other hypervisor can be built without touching Lima’s core.
Q&A
Can Lima run inside an unprivileged container? Yes, but you must pass --device /dev/kvm; running without KVM is possible but slow. ▶ 24:52
Is a Firecracker VM driver planned? No built-in driver exists, but the gRPC plugin API lets anyone implement a Firecracker driver or any other arbitrary VM driver. ▶ 25:38
Notable Quotes
So LMA is no longer just for running containers. Akihiro Suda · ▶ 00:30
it also tried to remove the home directory of the host machine. So yeah it’s uh very scary if you run on your host machine. Ansuman Sahoo · ▶ 15:33
a hidden prompt injection uh made the AI to alter uh local VS code uh flags particularly the auto approve uh execution flag uh which basically meant that uh the AI literally gained uh permission to run anything uh without the consent of the human Ansuman Sahoo · ▶ 16:48
lima can be used as a universal sandbox for any asend because it offers a system level uh isolation. Ansuman Sahoo · ▶ 17:56
About the Speakers
Akihiro Suda is a Distinguished Software Engineer at NTT Corporation and a maintainer of Moby (dockerd), BuildKit, containerd, and runc. He founded both nerdctl and the Lima CNCF project.
Ansuman Sahoo is a pre-final year student at BITS Pilani and a Lima-VM maintainer. He contributed to Lima through Google Summer of Code and focuses on AI sandboxing and cloud-native infrastructure.