Lima
v2.3.0Kubernetes Core2026年11月6日
プラットフォーム対応とオペレーター機能を拡張し、テンプレートの既定値も変更したリリースです。セキュリティ修正が2件含まれているため、アップグレードが必要です。
要対応 (1)
securityQEMU option ROM経由のホストファイル読み取りを修正
GHSA-566x-598w-h7w7 に対応し、
limactlのカレントディレクトリから読み込まれたQEMUの option ROM として、ゲストがホストファイルを読み取れる問題を修正しました。
影響確認 (2)
security
limactl shell --syncにおける未確認変更の適用を修正limactl shell --syncを使用する場合に該当します。GHSA-4wvf-9pjc-cpfp に対応し、ゲストの未確認の変更がホストに適用される
TOCTOUの問題を修正しました。breakingレガシー BIOS 設定の廃止
oraclelinux-8またはcentos-streamを設定している場合に該当します。oraclelinux-8とcentos-streamで、レガシー BIOS の設定を廃止しました。
その他の記録済み変更 38 件すべてadditions 19 · constraints 9 · defaults 6 · value changes 4
additions (19)
- Add
osOpts.to skip the first-login Setup Assistant (#5336, thanks to @trodemaster)darwin. suppressFirstLoginSetup - Support attaching host block devices (
limactl start --block-device) (#5117, thanks to @pirate) - Add
audio.to attach a capture stream (#5462, thanks to @iamstarkov)microphone - Add
networkOpts.to block guest access to the host's loopback services (#5581, thanks to @ranacseruet)hostLoopback - Implement
limactl screenshot(#5478, thanks to @afbjorklund) - Verify the guest VM's SSH host key, even for locally forwarded ports (#5687)
- Add
archVariant(--arch-variant) for selecting x86-64-v2/v3 images (#5335, thanks to @ekalinin) additionalDisks: support custommountPointand optional mounting (#5198, thanks to @ekalinin)copyToHost: addskipIfMissing(#5183, thanks to @afbjorklund)- Add
limactl menu, an experimental TUI for managing instances (#5330 #5629 #5668 ..., thanks to @Soumya-codr et al.) limactl autostart enable: add--keep-alive(#5086, thanks to @resker)limactl shell --sync: add--sync-excludeand support the.file (#4917, thanks to @peschmae)limasyncignore - Show the boot progress with an
(N/total)counter (#4902 #5602, thanks to @mn-ram and @saswatsam786) - Implement the
replacetool for targeted file edits (#5540, thanks to @bonifaido) k8s: Add a parameter for apt-proxy (#5251, thanks to @afbjorklund)k3s: Add parameters for apt-proxy and registry (#5251, #5257 #5377, thanks to @afbjorklund)×2- Add SBOM artifacts (#5220, thanks to @afbjorklund)
- Add the JSON schema of
lima.(#5339 #5380, thanks to @afbjorklund)yaml
constraints (9)
- Experimentally support HCS driver (#5449 #5514, thanks to [LFX mentee](https://lfx.linuxfoundation.org/tools/mentorship/) @mie313, and @unsuman)
- Support native Windows OpenSSH (#5298 #5299 #5300 #5337, thanks to @jandubois)
- Support
provision(#5263, thanks to [LFX mentee](https://lfx.linuxfoundation.org/tools/mentorship/) @mie313) - Support
nestedVirtualizationwith HVF (QEMU >= 11.1) (#5443, thanks to @sharanrajt) - Experimentally support
lima:shared,lima:host, andlima:bridgednetworks on Linux hosts, via the newlima-privileged-nethelper (#5483 #5484 #5485 #5486 #5513 #5669, thanks to @unsuman) additionalDisks: support custommountPointand optional mounting (#5198, thanks to @ekalinin)- Support stopping multiple instances with
limactl stop(#5369, thanks to @MEETNANDA8107) k8s: Allow installing on the minimal image variant (#5385, thanks to @afbjorklund)k8s: Accept anhttps://URL when joining a node (#5559, thanks to @Sarthak-Shreshtha01)
defaults (6)
- Automatically append common tool directories (e.g., QEMU) to
PATH(#5348, thanks to [LFX mentee](https://lfx.linuxfoundation.org/tools/mentorship/) @mie313) limactlwithout arguments now opens the menu on an interactive terminal- Update the default Ubuntu (
default,ubuntu, ...) to 26.10 (#5657) - Update Fedora (
fedora,podman, ...) to 45 (#5694m #5734, thanks to @kolyshin) - Update openSUSE Leap (
opensuse-leap) to 16.1 (#5735, thanks to @e-minguez) k8s: Pin Kubernetes version to 1.37 (#5463, thanks to @afbjorklund)
value changes (4)
- Warn when a read-only mount is requested (#5740)
- Forward Unix sockets over gRPC instead of SSH (#5653, thanks to @KayleMaster)
- Warn when overlapping mounts are detected (#5748)
- Update from v2.4.1 to [v2.4.2](https://github.com/containerd/nerdctl/releases/tag/v2.4.2) (#5703)
Limaをスタックに追加
対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。