Lima v2.1: AI Agent Sandboxing and macOS Guest Support

Lima v2.1 is a quiet but important release. The CNCF project (Incubating since October 2025) now supports macOS guest VMs and hardened AI agent sandboxing. If you are running AI coding agents on your laptop, this is how you keep them from destroying your system.

What Is Lima?

Lima (Linux Machines) creates local VMs with a single command:

brew install lima
limactl start

Originally built for running containerd on macOS, Lima now supports a broader range of workloads including AI agent isolation.

macOS Guests (Experimental)

The most requested feature: run macOS VMs inside macOS:

limactl start template:macos
limactl shell macos

This enables:

• macOS CI/CD testing without dedicated hardware
• Isolated macOS build environments
• Platform-specific development and debugging

AI Agent Sandboxing

This is the feature that matters for 2026. AI coding agents (Cursor, Claude Code, OpenClaw) execute arbitrary code on your machine. Lima provides isolation:

• Filesystem isolation — agents cannot access your home directory
• Network controls — restrict outbound connections
• Resource limits — CPU and memory constraints
• Snapshot/rollback — reset to clean state after agent runs

Example: Sandbox an AI Agent

# Create an isolated VM for AI agent work
limactl start --name ai-sandbox \
  --cpus 4 \
  --memory 8GiB \
  --disk 50GiB

# Run agent inside the sandbox
limactl shell ai-sandbox -- \
  openclaw gateway start

The agent has full access inside the VM but cannot touch your host filesystem, network, or other VMs.

Why This Matters

As AI agents become more autonomous, the attack surface grows. An AI agent that can:

• Read your SSH keys
• Access your cloud credentials
• Modify system files
• Exfiltrate data over the network

…is a security incident waiting to happen. Lima provides the isolation boundary that operating systems do not have natively for AI workloads.

Related Resources

• Kubescape 4.0: AI Agent Security
• Docker Security Best Practices
• Container Security with Trivy
• DevSecOps Pipeline

About the Author

I am Luca Berton, AI and Cloud Advisor. I help teams secure their AI development environments. Book a consultation.