feat(vz): add osOpts.Darwin.suppressFirstLoginSetup by trodemaster · Pull Request #5336 · lima-vm/lima

trodemaster · 2026-07-25T21:18:38Z

macOS VZ guests boot straight into the Setup Assistant ("mini-buddy") first-login wizard and sit there until someone clicks through it in the VM's GUI window -- Accessibility, Apple Pay, iCloud, Screen Time, Siri, Touch ID, Terms of Address, and more, plus a separate Software Update opt-in/out prompt on the same first login. Neither can currently be skipped, which blocks unattended macOS guest provisioning.

This adds an opt-in osOpts.Darwin.suppressFirstLoginSetup option. When set, fakecloudinit writes the per-user SetupAssistant plist and the system-wide SoftwareUpdate preferences as root during account creation, before the account's first login -- since the preferences exist before first login rather than being changed afterward, macOS treats them as the guest's actual initial state instead of resetting them. The built-in plist template queries sw_vers from inside the guest at provisioning time rather than hardcoding version strings, so it keeps working as the guest OS updates; a custom plist can be supplied instead via the option's plist field for anyone who wants different defaults.

This also switches the guest account-existence check from a filesystem test to an OpenDirectory (dscl) query, since other provisioning steps can pre-create a home directory before the account itself exists, which was making the filesystem check unreliable.

This is a Darwin-guest, VZ-driver-only feature. It's opt-in only; without the setting, guest behavior doesn't change. It targets macOS 15/26 guests; macOS 27+ guests will have native provisioning support via VZMacGuestProvisioningOptions once that API is available on both host and guest, so this fills the gap until then.

Tested go build/go vet/go test/gofmt clean on this branch. Verified the osOpts.Darwin.suppressFirstLoginSetup config path end-to-end through YAML unmarshal into DarwinOpts via a direct test against the real limayaml. Also ran live end-to-end boot tests against real macOS 26.5 and macOS 15.6.1 VZ guests, each built with only this change applied and no other local patches: on both, with the option set, the guest's com.apple.SetupAssistant.plist and system-wide SoftwareUpdate preferences were confirmed written before first login with the guest's actual build/version substituted in, the SetupAssistant process never launched, and the VM booted straight to the standard login window instead of the first-login wizard.

Fixes #5186

Assisted-by: Claude Code (Sonnet 4.7 & Sonnet 5)

AkihiroSuda · 2026-07-25T22:01:44Z

QEMU macOS guests aren't affected

QEMU macOS guests aren't supported in the first place.
Please verify the AI output before submission.

AkihiroSuda

user-data has to conform to the cloud-config spec.

…st-login wizard macOS VZ guests boot straight into the Setup Assistant ("mini-buddy") first-login wizard and sit there until someone clicks through it in the VM's GUI window -- Accessibility, Apple Pay, iCloud, Screen Time, Siri, Touch ID, Terms of Address, and more, plus a separate Software Update opt-in/out prompt on the same first login. Neither can currently be skipped, which blocks unattended macOS guest provisioning. This adds an opt-in osOpts.Darwin.suppressFirstLoginSetup boolean. When set to true, Lima writes a setup-assistant.plist marker file directly onto the cidata volume (like the existing boot.*/provision.*/ ssh_authorized_keys files there), and fakecloudinit writes the per-user SetupAssistant plist and the system-wide SoftwareUpdate preferences as root during account creation, before the account's first login -- since the preferences exist before first login rather than being changed afterward, macOS treats them as the guest's actual initial state instead of resetting them. The built-in plist template queries sw_vers from inside the guest at provisioning time rather than hardcoding version strings, so it keeps working as the guest OS updates; a separate osOpts.Darwin.suppressFirstLoginSetupPlist string option can supply a custom plist instead, for anyone who wants different defaults -- its content is written into the same marker file in place of the built-in template. The feature's enable/disable signal is carried entirely by that marker file's presence, not by any key in the generated user-data -- user-data stays a plain, unmodified cloud-config document. This also switches the guest account-existence check from a filesystem test to an OpenDirectory (dscl) query, since other provisioning steps can pre-create a home directory before the account itself exists, which was making the filesystem check unreliable. This is a Darwin-guest, VZ-driver-only feature -- QEMU macOS guests aren't supported at all, so this doesn't affect anything there. It's opt-in only; without the setting, guest behavior doesn't change. It targets macOS 15/26 guests; macOS 27+ guests will have native provisioning support via VZMacGuestProvisioningOptions once that API is available on both host and guest, so this fills the gap until then. Tested: go build/go vet/go test clean; gofmt clean. Verified the osOpts.Darwin.suppressFirstLoginSetup config path end-to-end through YAML unmarshal into DarwinOpts via a direct test against the real limayaml.Convert call (osOpts is keyed by the capitalized OS enum value, DARWIN = "Darwin", matching the existing osOpts.Windows convention -- no case-normalization exists in the unmarshal/merge path, so this must be capitalized to take effect, same as Windows). Also ran live end-to-end boot tests against real macOS 26.6 (25G70) and macOS 15.6.1 (24G90) VZ guests, each built with only this change applied (no other local patches). On both, with osOpts.Darwin.suppressFirstLoginSetup set, the guest's com.apple.SetupAssistant.plist and system-wide SoftwareUpdate preferences were confirmed written before first login with the guest's actual build/version substituted in, the SetupAssistant process never launched, and the VM booted straight to the standard login window instead of the first-login wizard. Fixes lima-vm#5186 Co-authored-by: Akihiro Suda <suda.kyoto@gmail.com> Assisted-by: Claude Code (Sonnet 4.7 & Sonnet 5) Signed-off-by: Blake Garner <blake@netjibbing.com>

AkihiroSuda added component/vz guest/macOS labels Jul 25, 2026