Lima v2.3 brings native Windows virtualization and Linux networking

The CNCF Incubating project Lima released version 2.3 on November 6, 2026, marking a significant shift in how local virtual machines operate across different operating systems. This update removes the need for extra dependencies on Windows by leveraging the native Host Compute System, while simultaneously bringing advanced networking capabilities to Linux hosts that were previously exclusive to macOS. The release also introduces a new terminal user interface for easier instance management and enhances security features for AI agent sandboxes.

What happened

Lima, originally designed to help Mac users run containers, has evolved into a cross-platform tool for launching local virtual machines. With version 2.3, the project addresses long-standing gaps in Windows and Linux support. On Windows, users can now run VMs without QEMU or a Unix toolchain by using the new experimental HCS driver. This driver interacts directly with the Windows Host Compute System API, the same underlying technology that powers WSL2. To use it, users must enable virtualization, add their account to the Hyper-V Administrators group, and specify a DNS server explicitly. While functional, this mode currently supports only plain instances, lacks file mounts, and allows only one running instance at a time due to fixed network subnets.

For Linux users, the update bridges a networking gap that existed compared to macOS. Previously, Linux VMs could not easily obtain a real IP address reachable from the host. Version 2.3 introduces lima-privileged-net, a helper tool that creates Linux bridges, manages DHCP and DNS via dnsmasq, and handles NAT rules. This setup requires a one-time configuration of sudoers rules to allow the helper to manage network interfaces securely. Once configured, Linux VMs can use shared, host, or bridged networks just like their macOS counterparts, providing a more consistent development experience across platforms.

MacOS users receive improvements focused on hardware access and guest customization. The update allows VZ guests to attach block devices, such as external SSDs or USB drives, directly without using file shares. This feature requires careful security configuration, including root-owned helpers and specific sudoers rules to prevent unauthorized disk access. Additionally, macOS guests can now skip first-login setup screens for headless automation, and nested virtualization is supported on aarch64 systems with the HVF accelerator, provided QEMU 11.1 and macOS 15 are used.

How it works

The new Windows HCS driver bypasses traditional emulation layers by calling the Windows Host Compute System API directly. This approach eliminates the overhead of QEMU and the need for a Unix compatibility layer, resulting in a more native integration with the Windows kernel. However, because it relies on the HCN network subnet, it currently restricts users to a single concurrent instance and requires manual DNS configuration. The driver is marked as experimental, indicating that while functional, it may still undergo significant changes or have stability limitations.

On Linux, the lima-privileged-net helper operates with elevated privileges to manage network infrastructure. It creates a dedicated bridge for each network definition, assigns gateway addresses, and spawns tap devices for individual VM instances. By running dnsmasq within this controlled environment, it provides DHCP and DNS services to the guests. The helper ensures security by only managing interfaces that follow Lima’s naming scheme and removing network resources when no instances are active. This mechanism mirrors the functionality of socket_vmnet on macOS, providing a uniform networking model for developers working on different host systems.

Key details

• Windows HCS Driver: Enables native VM execution on Windows without QEMU, though it currently supports only plain mode and one instance at a time.
• Linux Networking: The lima-privileged-net helper provides real IP addresses and DHCP/DNS services for Linux VMs, requiring sudoers configuration.
• macOS Block Devices: VZ guests can now attach physical block devices like USB drives, secured via root-owned helpers and per-device sudoers rules.
• Terminal UI: A new limactl menu command offers an interactive interface for starting, stopping, and managing VM instances.
• AI Sandbox Safety: New --sync-exclude flags and .limasyncignore files prevent secrets and heavy directories from syncing into AI agent environments.
• MCP Tools: The Model Context Protocol tools now include a replace function, allowing agents to make targeted file edits to save tokens.

Why it matters

For software engineers building local development environments, this update reduces friction and increases consistency. Windows developers no longer need to maintain separate Unix toolchains or rely on heavier emulation layers for basic VM tasks. Linux developers gain networking parity with macOS, simplifying the setup of multi-service architectures where services need to communicate via stable IP addresses. These changes make Lima a more viable option for teams with heterogeneous operating system preferences, ensuring that local environments behave predictably regardless of the host OS.

The enhancements to AI sandboxing are particularly relevant for teams integrating coding agents into their workflows. By allowing precise control over which files are synced into the VM, developers can prevent accidental exposure of sensitive credentials or large dependency folders. The ability to isolate the guest from host loopback services further secures the environment, ensuring that local databases or dev servers remain inaccessible to potentially untrusted agent code. These features address critical security and performance concerns in modern AI-assisted development pipelines.

What you can do

• Install Lima v2.3 on Windows using winget install Lima.Lima and test the new HCS driver by adding your user to the Hyper-V Administrators group.
• Configure Linux networking by installing dnsmasq, generating sudoers rules with limactl sudoers, and starting a VM with the --network=lima:shared flag.
• Use the new limactl menu command to interactively manage your VM instances instead of typing individual CLI commands.
• Secure your AI sandboxes by creating a .limasyncignore file to exclude sensitive directories like .git and node_modules from syncing.
• On macOS, attach an external drive to a VZ guest using the --block-device flag after configuring the necessary sudoers rules for security.
• Update your MCP tool configurations to utilize the new replace function for more efficient and safer file edits by AI agents.