Repository: lima-vm/lima
Pull request #3180 (2025-01-30 21:18:03)

limactl disk: Do not use qemu-img for raw disks
Fix `limactl disk create` and `limactl disk resize` to use nativeimgutil for creating and resizing disks using raw format.

There are special cases (using direct I/O on certain file systems) when creating a raw image should be done with qemu-img, but these are not relevant to lima on macOS.

With this change we have no dependency on qemu when using VZ instance.

This change does not fix the issue of default "qcow2" disk format. Users must specify the disk format when creating additional disks for VZ instance:

    limactl disk create --format raw

Unfinished:
- Needs tests for nativeimgutil and disk command

Fixes: #2853


Patch:
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 0551d9b7..527ac2c2 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -32,7 +32,7 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d  # v3.28.10
+      uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a  # v3.28.8
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -48,6 +48,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d  # v3.28.10
+      uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a  # v3.28.8
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 32bd197b..ba726040 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,11 +39,11 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Make darwin artifacts
       run: make artifacts-darwin
     - name: "Upload artifacts"
-      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1  # v4.6.1
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  # v4.6.0
       with:
         name: artifacts-darwin
         path: _artifacts/
@@ -60,13 +60,13 @@ jobs:
       attestations: write  # for provenances
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
       with:
         name: artifacts-darwin
         path: _artifacts/
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Install gcc-x86-64-linux-gnu
       run: |
         sudo apt-get update
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 31ed2b5c..e4bb6586 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
         persist-credentials: false
 
     - name: "Run analysis"
-      uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186  # v2.4.1
+      uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46  # v2.4.0
       with:
         results_file: results.sarif
         results_format: sarif
@@ -51,7 +51,7 @@ jobs:
     # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
     # format to the repository Actions tab.
     - name: "Upload artifact"
-      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1  # v3.pre.node20
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  # v3.pre.node20
       with:
         name: SARIF file
         path: results.sarif
@@ -60,6 +60,6 @@ jobs:
     # Upload the results to GitHub's code scanning dashboard (optional).
     # Commenting out will disable upload of results to your repo's Code Scanning dashboard
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d  # v3.28.10
+      uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a  # v3.28.8
       with:
         sarif_file: results.sarif
diff --git a/.golangci.yml b/.golangci.yml
index 66afda8a..da0eb215 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -84,8 +84,6 @@ linters-settings:
         deny:
         - pkg: "golang.org/x/net/context"
           desc: "use the 'context' package from the standard library"
-        - pkg: "math/rand$"
-          desc: "use the 'math/rand/v2' package"
   forbidigo:
     analyze-types: true
     forbid:
diff --git a/Makefile b/Makefile
index be201c71..71bea6e4 100644
--- a/Makefile
+++ b/Makefile
@@ -46,12 +46,7 @@ PACKAGE := github.com/lima-vm/lima
 VERSION := $(shell git describe --match 'v[0-9]*' --dirty='.m' --always --tags)
 VERSION_TRIMMED := $(VERSION:v%=%)
 
-KEEP_SYMBOLS ?=
-GO_BUILD_LDFLAGS_S := true
-ifeq ($(KEEP_SYMBOLS),1)
-	GO_BUILD_LDFLAGS_S = false
-endif
-GO_BUILD_LDFLAGS := -ldflags="-s=$(GO_BUILD_LDFLAGS_S) -w -X $(PACKAGE)/pkg/version.Version=$(VERSION)"
+GO_BUILD_LDFLAGS := -ldflags="-s -w -X $(PACKAGE)/pkg/version.Version=$(VERSION)"
 # `go -version -m` returns -tags with comma-separated list, because space-separated list is deprecated in go1.13.
 # converting to comma-separated list is useful for comparing with the output of `go version -m`.
 GO_BUILD_FLAG_TAGS := $(addprefix -tags=,$(shell echo "$(GO_BUILDTAGS)"|tr " " "\n"|paste -sd "," -))
@@ -73,15 +68,7 @@ help:
 	@echo  '  binaries        - Build all binaries'
 	@echo  '  manpages        - Build manual pages'
 	@echo
-	@echo  '  help-variables  - Show Makefile variables'
-	@echo  '  help-targets    - Show additional Makefile targets'
-
-.PHONY: help-varaibles
-help-variables:
-	@echo  '# Variables that can be overridden.'
-	@echo
-	@echo  '- PREFIX       (directory)  : Installation prefix (default: /usr/local)'
-	@echo  '- KEEP_SYMBOLS (1 or 0)     : Whether to keep symbols (default: 0)'
+	@echo  "  Use 'make help-targets' to see additional targets."
 
 .PHONY: help-targets
 help-targets:
@@ -93,10 +80,10 @@ help-targets:
 	@echo  '- helpers                   : Copy nerdctl.lima, apptainer.lima, docker.lima, podman.lima, and kubectl.lima'
 	@echo
 	@echo  'Targets for files in _output/share/lima/:'
-	@echo  '- guestagents               : Build guestagents for archs enabled by CONFIG_GUESTAGENT_ARCH_*'
+	@echo  '- guestagents               : Build guestagents for archs enabled by CONFIG_GUESTAGENT_ARCHS_*'
 	@echo  '- native-guestagent         : Build guestagent for native arch'
 	@echo  '- additional-guestagents    : Build guestagents for archs other than native arch'
-	@echo  '- <arch>-guestagent         : Build guestagent for <arch>: $(sort $(LINUX_GUESTAGENT_ARCHS))'
+	@echo  '- <arch>-guestagent         : Build guestagent for <arch>: $(sort $(GUESTAGENT_ARCHS))'
 	@echo
 	@echo  'Targets for files in _output/share/lima/templates/:'
 	@echo  '- templates                 : Copy templates'
@@ -236,7 +223,7 @@ endif
 #
 # The hostagent must be compiled with CGO_ENABLED=1 so that net.LookupIP() in the DNS server
 # calls the native resolver library and not the simplistic version in the Go library.
-ENVS__output/bin/limactl$(exe) = CGO_ENABLED=1 GOOS="$(GOOS)" GOARCH="$(GOARCH)" CC="$(CC)"
+ENVS__output/bin/limactl$(exe) = CGO_ENABLED=1 GOOS=$(GOOS) GOARCH=$(GOARCH) CC=$(CC)
 
 _output/bin/limactl$(exe): $(LIMACTL_DEPS) $$(call force_build,$$@)
 # If the previous cross-compilation was for GOOS=windows, limactl.exe might still be present.
@@ -269,12 +256,10 @@ LINUX_GUESTAGENT_PATH_COMMON = _output/share/lima/lima-guestagent.Linux-
 
 # How to add architecture specific guestagent:
 # 1. Add the architecture to GUESTAGENT_ARCHS
-# 2. Add ENVS_$(*_GUESTAGENT_PATH_COMMON)<arch> to set GOOS, GOARCH, and other necessary environment variables
-LINUX_GUESTAGENT_ARCHS = aarch64 armv7l riscv64 x86_64
+# 2. Add ENVS_$(LINUX_GUESTAGENT_PATH_COMMON)<arch> to set GOOS, GOARCH, and other necessary environment variables
+GUESTAGENT_ARCHS = aarch64 armv7l riscv64 x86_64
 
-ifeq ($(CONFIG_GUESTAGENT_OS_LINUX),y)
-ALL_GUESTAGENTS_NOT_COMPRESSED += $(addprefix $(LINUX_GUESTAGENT_PATH_COMMON),$(LINUX_GUESTAGENT_ARCHS))
-endif
+ALL_GUESTAGENTS_NOT_COMPRESSED = $(addprefix $(LINUX_GUESTAGENT_PATH_COMMON),$(GUESTAGENT_ARCHS))
 ifeq ($(CONFIG_GUESTAGENT_COMPRESS),y)
 $(info Guestagents are unzipped each time to check the build configuration; they may be gunzipped afterward.)
 gz=.gz
@@ -282,17 +267,16 @@ endif
 
 ALL_GUESTAGENTS = $(addsuffix $(gz),$(ALL_GUESTAGENTS_NOT_COMPRESSED))
 
-# guestagent path for the given platform. it may has .gz extension if CONFIG_GUESTAGENT_COMPRESS is enabled.
-# $(1): operating system (os)
-# $(2): list of architectures
-guestagent_path = $(foreach arch,$(2),$($(1)_GUESTAGENT_PATH_COMMON)$(arch)$(gz))
+# guestagent path for the given architectures. it may has .gz extension if CONFIG_GUESTAGENT_COMPRESS is enabled.
+# $(1): list of architectures
+guestaget_path = $(foreach arch,$(1),$(LINUX_GUESTAGENT_PATH_COMMON)$(arch)$(gz))
 
-ifeq ($(CONFIG_GUESTAGENT_OS_LINUX),y)
 NATIVE_GUESTAGENT_ARCH = $(shell uname -m | sed -e s/arm64/aarch64/)
-NATIVE_GUESTAGENT = $(call guestagent_path,LINUX,$(NATIVE_GUESTAGENT_ARCH))
-ADDITIONAL_GUESTAGENT_ARCHS = $(filter-out $(NATIVE_GUESTAGENT_ARCH),$(LINUX_GUESTAGENT_ARCHS))
-ADDITIONAL_GUESTAGENTS = $(call guestagent_path,LINUX,$(ADDITIONAL_GUESTAGENT_ARCHS))
-endif
+NATIVE_GUESTAGENT = $(call guestaget_path,$(NATIVE_GUESTAGENT_ARCH))
+ADDITIONAL_GUESTAGENT_ARCHS = $(filter-out $(NATIVE_GUESTAGENT_ARCH),$(GUESTAGENT_ARCHS))
+ADDITIONAL_GUESTAGENTS = $(call guestaget_path,$(ADDITIONAL_GUESTAGENT_ARCHS))
+
+ifeq ($(CONFIG_GUESTAGENT_OS_LINUX),y)
 
 # config_guestagent_arch returns expanded value of CONFIG_GUESTAGENT_ARCH_<arch>
 # $(1): architecture
@@ -301,11 +285,10 @@ config_guestagent_arch = $(filter y,$(CONFIG_GUESTAGENT_ARCH_$(shell echo $(1)|t
 
 # guestagent_path_enabled_by_config returns the path to the guestagent binary for the given architecture,
 # or an empty string if the CONFIG_GUESTAGENT_ARCH_<arch> is not set.
-guestagent_path_enabled_by_config = $(if $(call config_guestagent_arch,$(2)),$(call guestagent_path,$(1),$(2)))
+guestagent_path_enabled_by_config = $(if $(call config_guestagent_arch,$(1)),$(call guestaget_path,$(1)))
 
-ifeq ($(CONFIG_GUESTAGENT_OS_LINUX),y)
 # apply CONFIG_GUESTAGENT_ARCH_*
-GUESTAGENTS += $(foreach arch,$(LINUX_GUESTAGENT_ARCHS),$(call guestagent_path_enabled_by_config,LINUX,$(arch)))
+GUESTAGENTS = $(foreach arch,$(GUESTAGENT_ARCHS),$(call guestagent_path_enabled_by_config,$(arch)))
 endif
 
 .PHONY: guestagents native-guestagent additional-guestagents
@@ -313,7 +296,7 @@ guestagents: $(GUESTAGENTS)
 native-guestagent: $(NATIVE_GUESTAGENT)
 additional-guestagents: $(ADDITIONAL_GUESTAGENTS)
 %-guestagent:
-	@[ "$(findstring $(*),$(LINUX_GUESTAGENT_ARCHS))" == "$(*)" ] && make $(call guestagent_path,LINUX,$*)
+	@[ "$(findstring $(*),$(GUESTAGENT_ARCHS))" == "$(*)" ] && make $(call guestaget_path,$*)
 
 # environment variables for linx-guestagent. these variable are used for checking force build.
 ENVS_$(LINUX_GUESTAGENT_PATH_COMMON)aarch64 = CGO_ENABLED=0 GOOS=linux GOARCH=arm64
diff --git a/cmd/limactl/disk.go b/cmd/limactl/disk.go
index dafd601a..21fb2272 100644
--- a/cmd/limactl/disk.go
+++ b/cmd/limactl/disk.go
@@ -9,6 +9,7 @@ import (
 	"text/tabwriter"
 
 	"github.com/docker/go-units"
+	"github.com/lima-vm/lima/pkg/nativeimgutil"
 	"github.com/lima-vm/lima/pkg/qemu"
 	"github.com/lima-vm/lima/pkg/store"
 	"github.com/sirupsen/logrus"
@@ -101,7 +102,13 @@ func diskCreateAction(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	if err := qemu.CreateDataDisk(diskDir, format, int(diskSize)); err != nil {
+	// qemu may not be available, use it only if needed.
+	if format == "raw" {
+		err = nativeimgutil.CreateRawDataDisk(diskDir, int(diskSize))
+	} else {
+		err = qemu.CreateDataDisk(diskDir, format, int(diskSize))
+	}
+	if err != nil {
 		rerr := os.RemoveAll(diskDir)
 		if rerr != nil {
 			err = errors.Join(err, fmt.Errorf("failed to remove a directory %q: %w", diskDir, rerr))
@@ -390,9 +397,17 @@ func diskResizeAction(cmd *cobra.Command, args []string) error {
 			}
 		}
 	}
-	if err := qemu.ResizeDataDisk(disk.Dir, disk.Format, int(diskSize)); err != nil {
+
+	// qemu may not be available, use it only if needed.
+	if disk.Format == "raw" {
+		err = nativeimgutil.ResizeRawDataDisk(disk.Dir, int(diskSize))
+	} else {
+		err = qemu.ResizeDataDisk(disk.Dir, disk.Format, int(diskSize))
+	}
+	if err != nil {
 		return fmt.Errorf("failed to resize disk %q: %w", diskName, err)
 	}
+
 	logrus.Infof("Resized disk %q (%q)", diskName, disk.Dir)
 	return nil
 }
diff --git a/go.mod b/go.mod
index 3bce68c6..f3a86da1 100644
--- a/go.mod
+++ b/go.mod
@@ -1,59 +1,58 @@
-// gomodjail:confined
 module github.com/lima-vm/lima
 
-go 1.23.0
+go 1.22.0
 
 require (
 	al.essio.dev/pkg/shellescape v1.5.1
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/Code-Hex/vz/v3 v3.6.0 // gomodjail:unconfined
-	github.com/Microsoft/go-winio v0.6.2 // gomodjail:unconfined
+	github.com/Code-Hex/vz/v3 v3.6.0
+	github.com/Microsoft/go-winio v0.6.2
 	github.com/apparentlymart/go-cidr v1.1.0
 	github.com/balajiv113/fd v0.0.0-20230330094840-143eec500f3e
-	github.com/cheggaaa/pb/v3 v3.1.6 // gomodjail:unconfined
+	github.com/cheggaaa/pb/v3 v3.1.6
 	github.com/containerd/containerd v1.7.25
 	github.com/containerd/continuity v0.4.5
-	github.com/containers/gvisor-tap-vsock v0.8.3 // gomodjail:unconfined
+	github.com/containers/gvisor-tap-vsock v0.8.2
 	github.com/coreos/go-semver v0.3.1
 	github.com/cpuguy83/go-md2man/v2 v2.0.6
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/digitalocean/go-qemu v0.0.0-20221209210016-f035778c97f7
-	github.com/diskfs/go-diskfs v1.5.1 // gomodjail:unconfined
+	github.com/diskfs/go-diskfs v1.4.1
 	github.com/docker/go-units v0.5.0
 	github.com/elastic/go-libaudit/v2 v2.6.1
 	github.com/foxcpp/go-mockdns v1.1.0
-	github.com/goccy/go-yaml v1.15.23
-	github.com/google/go-cmp v0.7.0
-	github.com/google/yamlfmt v0.16.0
+	github.com/goccy/go-yaml v1.15.15
+	github.com/google/go-cmp v0.6.0
+	github.com/google/yamlfmt v0.15.0
 	github.com/invopop/jsonschema v0.13.0
 	github.com/lima-vm/go-qcow2reader v0.6.0
-	github.com/lima-vm/sshocker v0.3.5 // gomodjail:unconfined
+	github.com/lima-vm/sshocker v0.3.5
 	github.com/mattn/go-isatty v0.0.20
 	github.com/mattn/go-shellwords v1.0.12
-	github.com/mdlayher/vsock v1.2.1 // gomodjail:unconfined
-	github.com/miekg/dns v1.1.63 // gomodjail:unconfined
+	github.com/mdlayher/vsock v1.2.1
+	github.com/miekg/dns v1.1.63
 	github.com/mikefarah/yq/v4 v4.45.1
-	github.com/nxadm/tail v1.4.11 // gomodjail:unconfined
+	github.com/nxadm/tail v1.4.11
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58
 	github.com/rjeczalik/notify v0.9.3
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1
 	github.com/sethvargo/go-password v0.3.1
 	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af
-	github.com/spf13/cobra v1.9.1 // gomodjail:unconfined
-	github.com/spf13/pflag v1.0.6
+	github.com/spf13/cobra v1.8.1
+	github.com/spf13/pflag v1.0.5
 	github.com/wk8/go-ordered-map/v2 v2.1.8
-	golang.org/x/net v0.35.0
-	golang.org/x/sync v0.11.0
-	golang.org/x/sys v0.30.0 // gomodjail:unconfined
-	golang.org/x/text v0.22.0
+	golang.org/x/net v0.34.0
+	golang.org/x/sync v0.10.0
+	golang.org/x/sys v0.29.0
+	golang.org/x/text v0.21.0
 	google.golang.org/grpc v1.70.0
-	google.golang.org/protobuf v1.36.5 // gomodjail:unconfined
+	google.golang.org/protobuf v1.36.4
 	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473
-	gotest.tools/v3 v3.5.2
-	k8s.io/api v0.32.2
-	k8s.io/apimachinery v0.32.2
-	k8s.io/client-go v0.32.2
+	gotest.tools/v3 v3.5.1
+	k8s.io/api v0.31.4
+	k8s.io/apimachinery v0.31.4
+	k8s.io/client-go v0.31.4
 )
 
 require (
@@ -61,36 +60,36 @@ require (
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/a8m/envsubst v1.4.2 // indirect
 	github.com/alecthomas/participle/v2 v2.1.1 // indirect
+	github.com/areYouLazy/libhosty v1.1.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect
-	github.com/braydonk/yaml v0.9.0 // indirect
+	github.com/braydonk/yaml v0.7.0 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/digitalocean/go-libvirt v0.0.0-20220804181439-8648fbde413e // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
 	github.com/djherbis/times v1.6.0 // indirect
 	github.com/elliotchance/orderedmap v1.7.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	// gomodjail:unconfined
 	github.com/fsnotify/fsnotify v1.8.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/jsonreference v0.21.0 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
 	github.com/goccy/go-json v0.10.4 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/btree v1.1.3 // indirect
+	github.com/google/btree v1.1.2 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/gopacket v1.1.19 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	// gomodjail:unconfined
 	github.com/insomniacslk/dhcp v0.0.0-20240710054256-ddd8a41251c9 // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -99,43 +98,45 @@ require (
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/linuxkit/virtsock v0.0.0-20220523201153-1a23e78aa7a2 // indirect
 	github.com/magiconair/properties v1.8.9 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/mdlayher/socket v0.5.1 // indirect
+	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
-	github.com/pierrec/lz4/v4 v4.1.22 // indirect
+	github.com/pierrec/lz4/v4 v4.1.17 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.7 // indirect
+	github.com/qdm12/dns/v2 v2.0.0-rc6 // indirect
+	github.com/qdm12/gosettings v0.4.1 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
-	// gomodjail:unconfined
 	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yuin/gopher-lua v1.1.1 // indirect
-	golang.org/x/crypto v0.35.0 // indirect
+	golang.org/x/crypto v0.32.0 // indirect
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
 	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/oauth2 v0.24.0 // indirect
-	golang.org/x/term v0.29.0 // indirect
-	golang.org/x/time v0.7.0 // indirect
+	golang.org/x/term v0.28.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.28.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	// gomodjail:unconfined
 	gvisor.dev/gvisor v0.0.0-20240916094835-a174eb65023f // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.5.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 2dea7589..36f0df57 100644
--- a/go.sum
+++ b/go.sum
@@ -22,14 +22,16 @@ github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU=
 github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
+github.com/areYouLazy/libhosty v1.1.0 h1:kO6UTk9z72cHW28A/V1kKi7C8iKQGqINiVGXp+05Eao=
+github.com/areYouLazy/libhosty v1.1.0/go.mod h1:dV4ir3feRrTbWdcJ21mt3MeZlASg0sc8db6nimL9GOA=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/balajiv113/fd v0.0.0-20230330094840-143eec500f3e h1:IdMhFPEfTZQU971tIHx3UhY4l+yCeynprnINrDTSrOc=
 github.com/balajiv113/fd v0.0.0-20230330094840-143eec500f3e/go.mod h1:aXGMJsd3XrnUFTuyf/pTGg5jG6CY8JMZ5juywvShjgQ=
 github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0CXv75Q=
 github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
-github.com/braydonk/yaml v0.9.0 h1:ewGMrVmEVpsm3VwXQDR388sLg5+aQ8Yihp6/hc4m+h4=
-github.com/braydonk/yaml v0.9.0/go.mod h1:hcm3h581tudlirk8XEUPDBAimBPbmnL0Y45hCRl47N4=
+github.com/braydonk/yaml v0.7.0 h1:ySkqO7r0MGoCNhiRJqE0Xe9yhINMyvOAB3nFjgyJn2k=
+github.com/braydonk/yaml v0.7.0/go.mod h1:hcm3h581tudlirk8XEUPDBAimBPbmnL0Y45hCRl47N4=
 github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
 github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/cheggaaa/pb/v3 v3.1.6 h1:h0x+vd7EiUohAJ29DJtJy+SNAc55t/elW3jCD086EXk=
@@ -38,16 +40,18 @@ github.com/containerd/containerd v1.7.25 h1:khEQOAXOEJalRO228yzVsuASLH42vT7DIo9S
 github.com/containerd/containerd v1.7.25/go.mod h1:tWfHzVI0azhw4CT2vaIjsb2CoV4LJ9PrMPaULAr21Ok=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
-github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
-github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
+github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containers/gvisor-tap-vsock v0.8.3 h1:Am3VdjXTn8Mn+dNhgkiRcCFOTSM8u9aWKLW3KTHOGjk=
-github.com/containers/gvisor-tap-vsock v0.8.3/go.mod h1:46MvrqNuRNbjV4ZsZ3mHVJjR2Eh+fpyRh72EvWWFFjU=
+github.com/containers/gvisor-tap-vsock v0.8.2 h1:uQMBCCHlIIj62fPjbvgm6AL5EzsP6TP5eviByOJEsOg=
+github.com/containers/gvisor-tap-vsock v0.8.2/go.mod h1:EMRe2o63ddq2zxcP0hTysmxCf/5JlaNEg8/gpzP0ox4=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
 github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
@@ -62,8 +66,8 @@ github.com/digitalocean/go-qemu v0.0.0-20221209210016-f035778c97f7 h1:3OVJAbR131
 github.com/digitalocean/go-qemu v0.0.0-20221209210016-f035778c97f7/go.mod h1:K4+o74YGNjOb9N6yyG+LPj1NjHtk+Qz0IYQPvirbaLs=
 github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
-github.com/diskfs/go-diskfs v1.5.1 h1:Mnzgx3ERI+lzGzDAV+ejFLj/Uz9Cs/7wDkaAXwH1RMk=
-github.com/diskfs/go-diskfs v1.5.1/go.mod h1:bRFumZeGFCO8C2KNswrQeuj2m1WCVr4Ms5IjWMczMDk=
+github.com/diskfs/go-diskfs v1.4.1 h1:iODgkzHLmvXS+1VDztpW53T+dQm8GQzi20y9yUd5UCA=
+github.com/diskfs/go-diskfs v1.4.1/go.mod h1:+tOkQs8CMMog6Nvljg8DGIxEXrgL48iyT3OM3IlSz74=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
@@ -78,8 +82,8 @@ github.com/elliotchance/orderedmap v1.7.1 h1:8SR2DB391dw0HVI9572ElrY+KU0Q89OCXYw
 github.com/elliotchance/orderedmap v1.7.1/go.mod h1:wsDwEaX5jEoyhbs7x93zk2H/qv0zwuhg4inXhDkYqys=
 github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab h1:h1UgjJdAAhj+uPL68n7XASS6bU+07ZX1WJvVS2eyoeY=
 github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab/go.mod h1:GLo/8fDswSAniFG+BFIaiSPcK610jyzgEhWYPQwuQdw=
-github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
-github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
@@ -93,48 +97,51 @@ github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
-github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
+github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
 github.com/goccy/go-json v0.10.4/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.15.23 h1:WS0GAX1uNPDLUvLkNU2vXq6oTnsmfVFocjQ/4qA48qo=
-github.com/goccy/go-yaml v1.15.23/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-yaml v1.15.15 h1:5turdzAlutS2Q7/QR/9R99Z1K0J00qDb4T0pHJcZ5ew=
+github.com/goccy/go-yaml v1.15.15/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
-github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
+github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
 github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
+github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/yamlfmt v0.16.0 h1:5auoxqdx2CxOb022XGBElFFVH8uE/lAJDCWKRMq4mT8=
-github.com/google/yamlfmt v0.16.0/go.mod h1:/fF8jQmFopG3InQoWYG3gTORPXqLwNkcBqAT4UA4ab0=
+github.com/google/yamlfmt v0.15.0 h1:8VqeHp87EEyfAeCTp3QpV/8bnhDh04jKN6EeifiTM70=
+github.com/google/yamlfmt v0.15.0/go.mod h1:MPmHSVetV8ofpKmeiEZAh2p4jbDapC+FNqilNN7JQVk=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/insomniacslk/dhcp v0.0.0-20240710054256-ddd8a41251c9 h1:LZJWucZz7ztCqY6Jsu7N9g124iJ2kt/O62j3+UchZFg=
@@ -157,8 +164,11 @@ github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW
 github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lima-vm/go-qcow2reader v0.6.0 h1:dNstUGQxEUPbmiiVnu/cek2x7scrHe2VJy5JseLLflo=
@@ -169,8 +179,8 @@ github.com/linuxkit/virtsock v0.0.0-20220523201153-1a23e78aa7a2 h1:DZMFueDbfz6PN
 github.com/linuxkit/virtsock v0.0.0-20220523201153-1a23e78aa7a2/go.mod h1:SWzULI85WerrFt3u+nIm5F9l7EvxZTKQvd0InF3nmgM=
 github.com/magiconair/properties v1.8.9 h1:nWcCbLq1N2v/cpNsy5WvQ37Fb+YElfq20WJ/a8RkpQM=
 github.com/magiconair/properties v1.8.9/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
-github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
@@ -183,8 +193,8 @@ github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebG
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mdlayher/packet v1.1.2 h1:3Up1NG6LZrsgDVn6X4L9Ge/iyRyxFEFD9o6Pr3Q1nQY=
 github.com/mdlayher/packet v1.1.2/go.mod h1:GEu1+n9sG5VtiRE4SydOmX5GTwyyYlteZiFU+x0kew4=
-github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
-github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
+github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
+github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
 github.com/mdlayher/vsock v1.2.1 h1:pC1mTJTvjo1r9n9fbm7S1j04rCgCzhCOS5DY0zqHlnQ=
 github.com/mdlayher/vsock v1.2.1/go.mod h1:NRfCibel++DgeMD8z/hP+PPTjlNJsdPOmxcnENvE+SE=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
@@ -207,8 +217,8 @@ github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
 github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
-github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
+github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
 github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
 github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -217,8 +227,8 @@ github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 h1:onHthvaw9LFnH4t2D
 github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58/go.mod h1:DXv8WO4yhMYhSNPKjeNKa5WY9YCIEBRbNzFFPJbWO6Y=
 github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
 github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
-github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
-github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pierrec/lz4/v4 v4.1.17 h1:kV4Ip+/hUBC+8T6+2EgburRtkE9ef4nbY3f4dFhGjMc=
+github.com/pierrec/lz4/v4 v4.1.17/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -230,6 +240,10 @@ github.com/pkg/xattr v0.4.9/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6kt
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/qdm12/dns/v2 v2.0.0-rc6 h1:h5KpuqZ3IMoSbz2a0OkHzIVc9/jk2vuIm9RoKJuaI78=
+github.com/qdm12/dns/v2 v2.0.0-rc6/go.mod h1:Oh34IJIG55BgHoACOf+cgZCgDiFuiJZ6r6gQW58FN+k=
+github.com/qdm12/gosettings v0.4.1 h1:c7+14jO1Y2kFXBCUfS2+QE2NgwTKfzcdJzGEFRItCI8=
+github.com/qdm12/gosettings v0.4.1/go.mod h1:uItKwGXibJp2pQ0am6MBKilpjfvYTGiH+zXHd10jFj8=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rjeczalik/notify v0.9.3 h1:6rJAzHTGKXGj76sbRgDiDcYj/HniypXmSJo1SWakZeY=
@@ -246,17 +260,19 @@ github.com/sethvargo/go-password v0.3.1 h1:WqrLTjo7X6AcVYfC6R7GtSyuUQR9hGyAj/f1P
 github.com/sethvargo/go-password v0.3.1/go.mod h1:rXofC1zT54N7R8K/h1WDUdkf9BOx5OptoxrMBcrXzvs=
 github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
 github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8RaCKgVpHZnecvArXvPXcFkM=
@@ -291,8 +307,10 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
-golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
+golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -316,8 +334,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
-golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
-golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
+golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
+golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
 golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -329,8 +347,8 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180926160741-c2ed4eda69e7/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -352,8 +370,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -362,8 +380,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -372,10 +390,10 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
-golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
-golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
@@ -396,8 +414,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
 google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
 google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
+google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -409,28 +427,32 @@ gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 h1:6D+BvnJ/j6e222UW
 gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473/go.mod h1:N1eN2tsCx0Ydtgjl4cqmbRCsY4/+z4cYDeqwZTk6zog=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
-gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
+gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
 gvisor.dev/gvisor v0.0.0-20240916094835-a174eb65023f h1:O2w2DymsOlM/nv2pLNWCMCYOldgBBMkD7H0/prN5W2k=
 gvisor.dev/gvisor v0.0.0-20240916094835-a174eb65023f/go.mod h1:sxc3Uvk/vHcd3tj7/DHVBoR5wvWT/MmRq2pj7HRJnwU=
-k8s.io/api v0.32.2 h1:bZrMLEkgizC24G9eViHGOPbW+aRo9duEISRIJKfdJuw=
-k8s.io/api v0.32.2/go.mod h1:hKlhk4x1sJyYnHENsrdCWw31FEmCijNGPJO5WzHiJ6Y=
-k8s.io/apimachinery v0.32.2 h1:yoQBR9ZGkA6Rgmhbp/yuT9/g+4lxtsGYwW6dR6BDPLQ=
-k8s.io/apimachinery v0.32.2/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
-k8s.io/client-go v0.32.2 h1:4dYCD4Nz+9RApM2b/3BtVvBHw54QjMFUl1OLcJG5yOA=
-k8s.io/client-go v0.32.2/go.mod h1:fpZ4oJXclZ3r2nDOv+Ux3XcJutfrwjKTCHz2H3sww94=
+k8s.io/api v0.31.4 h1:I2QNzitPVsPeLQvexMEsj945QumYraqv9m74isPDKhM=
+k8s.io/api v0.31.4/go.mod h1:d+7vgXLvmcdT1BCo79VEgJxHHryww3V5np2OYTr6jdw=
+k8s.io/apimachinery v0.31.4 h1:8xjE2C4CzhYVm9DGf60yohpNUh5AEBnPxCryPBECmlM=
+k8s.io/apimachinery v0.31.4/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+k8s.io/client-go v0.31.4 h1:t4QEXt4jgHIkKKlx06+W3+1JOwAFU/2OPiOo7H92eRQ=
+k8s.io/client-go v0.31.4/go.mod h1:kvuMro4sFYIa8sulL5Gi5GFqUPvfH2O/dXuKstbaaeg=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
-k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/structured-merge-diff/v4 v4.5.0 h1:nbCitCK2hfnhyiKo6uf2HxUPTCodY6Qaf85SbDIaMBk=
-sigs.k8s.io/structured-merge-diff/v4 v4.5.0/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
+k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
+k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot/02-wsl2-setup.sh b/pkg/cidata/cidata.TEMPLATE.d/boot/02-wsl2-setup.sh
index 68391712..e3059ea2 100755
--- a/pkg/cidata/cidata.TEMPLATE.d/boot/02-wsl2-setup.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot/02-wsl2-setup.sh
@@ -12,5 +12,6 @@ sudo chown "${LIMA_CIDATA_USER}" "${LIMA_CIDATA_HOME}"/.ssh/authorized_keys
 # add $LIMA_CIDATA_USER to sudoers
 echo "${LIMA_CIDATA_USER} ALL=(ALL) NOPASSWD:ALL" | sudo tee -a /etc/sudoers.d/99_lima_sudoers
 
-# symlink CIDATA to the hardcoded path for requirement checks (TODO: make this not hardcoded)
-sudo ln -sfFn "${LIMA_CIDATA_MNT}" /mnt/lima-cidata
+# copy some CIDATA to the hardcoded path for requirement checks (TODO: make this not hardcoded)
+sudo mkdir -p /mnt/lima-cidata
+sudo cp "${LIMA_CIDATA_MNT}"/meta-data /mnt/lima-cidata/meta-data
diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot/05-rosetta-volume.sh b/pkg/cidata/cidata.TEMPLATE.d/boot/05-rosetta-volume.sh
index 42bc069b..8be8420d 100755
--- a/pkg/cidata/cidata.TEMPLATE.d/boot/05-rosetta-volume.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot/05-rosetta-volume.sh
@@ -8,7 +8,7 @@ fi
 
 if [ -f /etc/alpine-release ]; then
 	rc-service procfs start --ifnotstarted
-	rc-service qemu-binfmt stop --ifexists --ifstarted
+	rc-service qemu-binfmt stop --ifstarted
 fi
 
 binfmt_entry=/proc/sys/fs/binfmt_misc/rosetta
diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot/40-install-containerd.sh b/pkg/cidata/cidata.TEMPLATE.d/boot/40-install-containerd.sh
index 3ab3df4e..4bff2898 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/boot/40-install-containerd.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot/40-install-containerd.sh
@@ -103,9 +103,7 @@ EOF
 			echo "Temporarily disabling SELinux, during installing containerd units"
 			setenforce 0
 		fi
-		if [ "$(sudo -iu "${LIMA_CIDATA_USER}" sh -ec 'systemctl --user show --property=RefuseManualStart --value dbus')" != "yes" ]; then
-			sudo -iu "${LIMA_CIDATA_USER}" "XDG_RUNTIME_DIR=/run/user/${LIMA_CIDATA_UID}" systemctl --user enable --now dbus
-		fi
+		sudo -iu "${LIMA_CIDATA_USER}" "XDG_RUNTIME_DIR=/run/user/${LIMA_CIDATA_UID}" systemctl --user enable --now dbus
 		sudo -iu "${LIMA_CIDATA_USER}" "XDG_RUNTIME_DIR=/run/user/${LIMA_CIDATA_UID}" "PATH=${PATH}" containerd-rootless-setuptool.sh install
 		sudo -iu "${LIMA_CIDATA_USER}" "XDG_RUNTIME_DIR=/run/user/${LIMA_CIDATA_UID}" "PATH=${PATH}" \
 			"CONTAINERD_NAMESPACE=${CONTAINERD_NAMESPACE}" "CONTAINERD_SNAPSHOTTER=${CONTAINERD_SNAPSHOTTER}" \
diff --git a/pkg/cidata/cidata.TEMPLATE.d/lima.env b/pkg/cidata/cidata.TEMPLATE.d/lima.env
index b1720f0d..b4d00673 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/lima.env
+++ b/pkg/cidata/cidata.TEMPLATE.d/lima.env
@@ -4,7 +4,6 @@ LIMA_CIDATA_USER={{ .User }}
 LIMA_CIDATA_UID={{ .UID }}
 LIMA_CIDATA_COMMENT={{ .Comment }}
 LIMA_CIDATA_HOME={{ .Home}}
-LIMA_CIDATA_SHELL={{ .Shell }}
 LIMA_CIDATA_HOSTHOME_MOUNTPOINT={{ .HostHomeMountPoint }}
 LIMA_CIDATA_MOUNTS={{ len .Mounts }}
 {{- range $i, $val := .Mounts}}
diff --git a/pkg/cidata/cidata.TEMPLATE.d/user-data b/pkg/cidata/cidata.TEMPLATE.d/user-data
index 3842f8d4..13a98c78 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/user-data
+++ b/pkg/cidata/cidata.TEMPLATE.d/user-data
@@ -34,7 +34,7 @@ users:
     gecos: {{ printf "%q" .Comment }}
 {{- end }}
     homedir: "{{.Home}}"
-    shell: {{.Shell}}
+    shell: /bin/bash
     sudo: ALL=(ALL) NOPASSWD:ALL
     lock_passwd: true
     ssh-authorized-keys:
diff --git a/pkg/cidata/cidata.go b/pkg/cidata/cidata.go
index abd2ccf4..2030a9a8 100644
--- a/pkg/cidata/cidata.go
+++ b/pkg/cidata/cidata.go
@@ -125,7 +125,6 @@ func templateArgs(bootScripts bool, instDir, name string, instConfig *limayaml.L
 		User:               *instConfig.User.Name,
 		Comment:            *instConfig.User.Comment,
 		Home:               *instConfig.User.Home,
-		Shell:              *instConfig.User.Shell,
 		UID:                *instConfig.User.UID,
 		GuestInstallPrefix: *instConfig.GuestInstallPrefix,
 		UpgradePackages:    *instConfig.UpgradePackages,
diff --git a/pkg/cidata/template.go b/pkg/cidata/template.go
index b2287f6e..92460df1 100644
--- a/pkg/cidata/template.go
+++ b/pkg/cidata/template.go
@@ -62,7 +62,6 @@ type TemplateArgs struct {
 	User                            string // user name
 	Comment                         string // user information
 	Home                            string // home directory
-	Shell                           string // login shell
 	UID                             uint32
 	SSHPubKeys                      []string
 	Mounts                          []Mount
@@ -110,9 +109,6 @@ func ValidateTemplateArgs(args *TemplateArgs) error {
 	if args.Home == "" {
 		return errors.New("field Home must be set")
 	}
-	if args.Shell == "" {
-		return errors.New("field Shell must be set")
-	}
 	if len(args.SSHPubKeys) == 0 {
 		return errors.New("field SSHPubKeys must be set")
 	}
diff --git a/pkg/instance/start.go b/pkg/instance/start.go
index 80b4dc44..899f07c7 100644
--- a/pkg/instance/start.go
+++ b/pkg/instance/start.go
@@ -339,6 +339,7 @@ type watchHostAgentEventsTimeoutKey = struct{}
 // WithWatchHostAgentTimeout sets the value of the timeout to use for
 // watchHostAgentEvents in the given Context.
 func WithWatchHostAgentTimeout(ctx context.Context, timeout time.Duration) context.Context {
+	//nolint:staticcheck // SA1029: should not use empty anonymous struct as key for value; define your own type to avoid collisions (staticcheck)
 	return context.WithValue(ctx, watchHostAgentEventsTimeoutKey{}, timeout)
 }
 
diff --git a/pkg/iso9660util/iso9660util.go b/pkg/iso9660util/iso9660util.go
index 149b3d41..74ef0bbe 100644
--- a/pkg/iso9660util/iso9660util.go
+++ b/pkg/iso9660util/iso9660util.go
@@ -4,8 +4,9 @@ import (
 	"io"
 	"os"
 	"path"
+	"path/filepath"
+	"runtime"
 
-	"github.com/diskfs/go-diskfs/backend/file"
 	"github.com/diskfs/go-diskfs/filesystem"
 	"github.com/diskfs/go-diskfs/filesystem/iso9660"
 	"github.com/sirupsen/logrus"
@@ -26,16 +27,19 @@ func Write(isoPath, label string, layout []Entry) error {
 		return err
 	}
 
-	backendFile := file.New(isoFile, false)
 	defer isoFile.Close()
 
 	workdir, err := os.MkdirTemp("", "diskfs_iso")
 	if err != nil {
 		return err
 	}
+	if runtime.GOOS == "windows" {
+		// go-embed unfortunately needs unix path
+		workdir = filepath.ToSlash(workdir)
+	}
 	logrus.Debugf("Creating iso file %s", isoFile.Name())
 	logrus.Debugf("Using %s as workspace", workdir)
-	fs, err := iso9660.Create(backendFile, 0, 0, 0, workdir)
+	fs, err := iso9660.Create(isoFile, 0, 0, 0, workdir)
 	if err != nil {
 		return err
 	}
@@ -77,12 +81,11 @@ func IsISO9660(imagePath string) (bool, error) {
 		return false, err
 	}
 	defer imageFile.Close()
-	backendFile := file.New(imageFile, true)
 
 	fileInfo, err := imageFile.Stat()
 	if err != nil {
 		return false, err
 	}
-	_, err = iso9660.Read(backendFile, fileInfo.Size(), 0, 0)
+	_, err = iso9660.Read(imageFile, fileInfo.Size(), 0, 0)
 	return err == nil, nil
 }
diff --git a/pkg/limayaml/defaults.go b/pkg/limayaml/defaults.go
index 1f1f2a86..cd3f8158 100644
--- a/pkg/limayaml/defaults.go
+++ b/pkg/limayaml/defaults.go
@@ -56,7 +56,7 @@ var (
 
 func defaultCPUType() CPUType {
 	cpuType := map[Arch]string{
-		AARCH64: "cortex-a76", // available since QEMU 7.1 (Aug 2022)
+		AARCH64: "cortex-a72",
 		ARMV7L:  "cortex-a7",
 		// Since https://github.com/lima-vm/lima/pull/494, we use qemu64 cpu for better emulation of x86_64.
 		X8664:   "qemu64",
@@ -209,9 +209,6 @@ func FillDefault(y, d, o *LimaYAML, filePath string, warn bool) {
 	if y.User.Home == nil {
 		y.User.Home = d.User.Home
 	}
-	if y.User.Shell == nil {
-		y.User.Shell = d.User.Shell
-	}
 	if y.User.UID == nil {
 		y.User.UID = d.User.UID
 	}
@@ -224,9 +221,6 @@ func FillDefault(y, d, o *LimaYAML, filePath string, warn bool) {
 	if o.User.Home != nil {
 		y.User.Home = o.User.Home
 	}
-	if o.User.Shell != nil {
-		y.User.Shell = o.User.Shell
-	}
 	if o.User.UID != nil {
 		y.User.UID = o.User.UID
 	}
@@ -242,9 +236,6 @@ func FillDefault(y, d, o *LimaYAML, filePath string, warn bool) {
 		y.User.Home = ptr.Of(osutil.LimaUser(existingLimaVersion, warn).HomeDir)
 		warn = false
 	}
-	if y.User.Shell == nil {
-		y.User.Shell = ptr.Of("/bin/bash")
-	}
 	if y.User.UID == nil {
 		uidString := osutil.LimaUser(existingLimaVersion, warn).Uid
 		if uid, err := strconv.ParseUint(uidString, 10, 32); err == nil {
@@ -1203,18 +1194,13 @@ func HasHostCPU() bool {
 	switch runtime.GOOS {
 	case "darwin":
 		if hasSMEDarwin() {
-			// [2025-02-05]
-			// SME is available since Apple M4 running macOS 15.2, but it was broken on macOS 15.2.
-			// It has been fixed in 15.3.
+			// SME is available since Apple M4 running macOS 15.2.
+			//
+			// However, QEMU is not ready to handle SME yet.
 			//
 			// https://github.com/lima-vm/lima/issues/3032
 			// https://gitlab.com/qemu-project/qemu/-/issues/2665
 			// https://gitlab.com/qemu-project/qemu/-/issues/2721
-
-			// [2025-02-12]
-			// SME got broken again after upgrading QEMU from 9.2.0 to 9.2.1 (Homebrew bottle).
-			// Possibly this regression happened in some build process rather than in QEMU itself?
-			// https://github.com/lima-vm/lima/issues/3226
 			return false
 		}
 		return true
diff --git a/pkg/limayaml/limayaml.go b/pkg/limayaml/limayaml.go
index 3f4e8520..6927fab2 100644
--- a/pkg/limayaml/limayaml.go
+++ b/pkg/limayaml/limayaml.go
@@ -88,7 +88,6 @@ type User struct {
 	Name    *string `yaml:"name,omitempty" json:"name,omitempty" jsonschema:"nullable"`
 	Comment *string `yaml:"comment,omitempty" json:"comment,omitempty" jsonschema:"nullable"`
 	Home    *string `yaml:"home,omitempty" json:"home,omitempty" jsonschema:"nullable"`
-	Shell   *string `yaml:"shell,omitempty" json:"shell,omitempty" jsonschema:"nullable"`
 	UID     *uint32 `yaml:"uid,omitempty" json:"uid,omitempty" jsonschema:"nullable"`
 }
 
diff --git a/pkg/limayaml/validate.go b/pkg/limayaml/validate.go
index e60e3740..2bc8ad4b 100644
--- a/pkg/limayaml/validate.go
+++ b/pkg/limayaml/validate.go
@@ -152,6 +152,14 @@ func Validate(y *LimaYAML, warn bool) error {
 		if err != nil {
 			return fmt.Errorf("field `mounts[%d].location` refers to an unexpandable path: %q: %w", i, f.Location, err)
 		}
+		switch loc {
+		case "/", "/bin", "/dev", "/etc", "/home", "/opt", "/sbin", "/tmp", "/usr", "/var":
+			return fmt.Errorf("field `mounts[%d].location` must not be a system path such as /etc or /usr", i)
+		// home directory defined in "cidata.iso:/user-data"
+		case *y.User.Home:
+			return fmt.Errorf("field `mounts[%d].location` is the reserved internal home directory", i)
+		}
+
 		st, err := os.Stat(loc)
 		if err != nil {
 			if !errors.Is(err, os.ErrNotExist) {
@@ -161,14 +169,6 @@ func Validate(y *LimaYAML, warn bool) error {
 			return fmt.Errorf("field `mounts[%d].location` refers to a non-directory path: %q: %w", i, f.Location, err)
 		}
 
-		switch *f.MountPoint {
-		case "/", "/bin", "/dev", "/etc", "/home", "/opt", "/sbin", "/tmp", "/usr", "/var":
-			return fmt.Errorf("field `mounts[%d].mountPoint` must not be a system path such as /etc or /usr", i)
-		// home directory defined in "cidata.iso:/user-data"
-		case *y.User.Home:
-			return fmt.Errorf("field `mounts[%d].mountPoint` is the reserved internal home directory %q", i, *y.User.Home)
-		}
-
 		if _, err := units.RAMInBytes(*f.NineP.Msize); err != nil {
 			return fmt.Errorf("field `msize` has an invalid value: %w", err)
 		}
diff --git a/pkg/nativeimgutil/nativeimgutil.go b/pkg/nativeimgutil/nativeimgutil.go
index 3f2a368a..c79d6f47 100644
--- a/pkg/nativeimgutil/nativeimgutil.go
+++ b/pkg/nativeimgutil/nativeimgutil.go
@@ -2,21 +2,44 @@
 package nativeimgutil
 
 import (
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
 
-	"github.com/containerd/continuity/fs"
+	containerdfs "github.com/containerd/continuity/fs"
 	"github.com/docker/go-units"
 	"github.com/lima-vm/go-qcow2reader"
 	"github.com/lima-vm/go-qcow2reader/convert"
 	"github.com/lima-vm/go-qcow2reader/image/qcow2"
 	"github.com/lima-vm/go-qcow2reader/image/raw"
 	"github.com/lima-vm/lima/pkg/progressbar"
+	"github.com/lima-vm/lima/pkg/store/filenames"
 	"github.com/sirupsen/logrus"
 )
 
+// CreateRawDataDisk creates an empty raw data disk.
+func CreateRawDataDisk(dir string, size int) error {
+	dataDisk := filepath.Join(dir, filenames.DataDisk)
+	if _, err := os.Stat(dataDisk); err == nil || !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	f, err := os.Create(dataDisk)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	return f.Truncate(int64(size))
+}
+
+// ResizeRawDataDisk resizes a raw data disk.
+func ResizeRawDataDisk(dir string, size int) error {
+	dataDisk := filepath.Join(dir, filenames.DataDisk)
+	return os.Truncate(dataDisk, int64(size))
+}
+
 // ConvertToRaw converts a source disk into a raw disk.
 // source and dest may be same.
 // ConvertToRaw is a NOP if source == dest, and no resizing is needed.
@@ -106,7 +129,7 @@ func ConvertToRaw(source, dest string, size *int64, allowSourceWithBackingFile b
 func convertRawToRaw(source, dest string, size *int64) error {
 	if source != dest {
 		// continuity attempts clonefile
-		if err := fs.CopyFile(dest, source); err != nil {
+		if err := containerdfs.CopyFile(dest, source); err != nil {
 			return fmt.Errorf("failed to copy %q into %q: %w", source, dest, err)
 		}
 	}
diff --git a/pkg/networks/networks.TEMPLATE.yaml b/pkg/networks/networks.TEMPLATE.yaml
index 811ccdf5..b98e3db7 100644
--- a/pkg/networks/networks.TEMPLATE.yaml
+++ b/pkg/networks/networks.TEMPLATE.yaml
@@ -22,6 +22,8 @@ networks:
     mode: user-v2
     gateway: 192.168.104.1
     netmask: 255.255.255.0
+    # user-v2 network is experimental network mode which supports all functionalities of default usernet network and also allows vm -> vm communication.
+    # Doesn't support configuration of custom gateway; hardcoded to 192.168.5.0/24
   shared:
     mode: shared
     gateway: 192.168.105.1
diff --git a/pkg/osutil/osversion_darwin.go b/pkg/osutil/osversion_darwin.go
index 6c72c983..9a9338dc 100644
--- a/pkg/osutil/osversion_darwin.go
+++ b/pkg/osutil/osversion_darwin.go
@@ -4,13 +4,12 @@ import (
 	"fmt"
 	"os/exec"
 	"strings"
-	"sync"
 
 	"github.com/coreos/go-semver/semver"
 )
 
 // ProductVersion returns the macOS product version like "12.3.1".
-var ProductVersion = sync.OnceValues(func() (*semver.Version, error) {
+func ProductVersion() (*semver.Version, error) {
 	cmd := exec.Command("sw_vers", "-productVersion")
 	// output is like "12.3.1\n"
 	b, err := cmd.Output()
@@ -27,4 +26,4 @@ var ProductVersion = sync.OnceValues(func() (*semver.Version, error) {
 		return nil, fmt.Errorf("failed to parse macOS version %q: %w", verTrimmed, err)
 	}
 	return verSem, nil
-})
+}
diff --git a/pkg/qemu/qemu.go b/pkg/qemu/qemu.go
index 13cb263e..9bd5a8c5 100644
--- a/pkg/qemu/qemu.go
+++ b/pkg/qemu/qemu.go
@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"io/fs"
 	"os"
 	"os/exec"
@@ -42,7 +41,6 @@ type Config struct {
 	InstanceDir  string
 	LimaYAML     *limayaml.LimaYAML
 	SSHLocalPort int
-	SSHAddress   string
 }
 
 // MinimumQemuVersion is the minimum supported QEMU version.
@@ -599,44 +597,26 @@ func Cmdline(ctx context.Context, cfg Config) (exe string, args []string, err er
 	}
 	if !legacyBIOS {
 		var firmware string
-		firmwareInBios := runtime.GOOS == "windows"
-		if envVar := os.Getenv("LIMA_QEMU_UEFI_IN_BIOS"); envVar != "" {
-			b, err := strconv.ParseBool(os.Getenv("LIMA_QEMU_UEFI_IN_BIOS"))
-			if err != nil {
-				logrus.WithError(err).Warnf("invalid LIMA_QEMU_UEFI_IN_BIOS value %q", envVar)
-			} else {
-				firmwareInBios = b
-			}
-		}
-		firmwareInBios = firmwareInBios && *y.Arch == limayaml.X8664
 		downloadedFirmware := filepath.Join(cfg.InstanceDir, filenames.QemuEfiCodeFD)
-		firmwareWithVars := filepath.Join(cfg.InstanceDir, filenames.QemuEfiFullFD)
-		if firmwareInBios {
-			if _, stErr := os.Stat(firmwareWithVars); stErr == nil {
-				firmware = firmwareWithVars
-				logrus.Infof("Using existing firmware (%q)", firmware)
-			}
-		} else {
-			if _, stErr := os.Stat(downloadedFirmware); errors.Is(stErr, os.ErrNotExist) {
-			loop:
-				for _, f := range y.Firmware.Images {
-					switch f.VMType {
-					case "", limayaml.QEMU:
-						if f.Arch == *y.Arch {
-							if _, err = fileutils.DownloadFile(ctx, downloadedFirmware, f.File, true, "UEFI code "+f.Location, *y.Arch); err != nil {
-								logrus.WithError(err).Warnf("failed to download %q", f.Location)
-								continue loop
-							}
-							firmware = downloadedFirmware
-							logrus.Infof("Using firmware %q (downloaded from %q)", firmware, f.Location)
-							break loop
+		if _, stErr := os.Stat(downloadedFirmware); errors.Is(stErr, os.ErrNotExist) {
+		loop:
+			for _, f := range y.Firmware.Images {
+				switch f.VMType {
+				case "", limayaml.QEMU:
+					if f.Arch == *y.Arch {
+						if _, err = fileutils.DownloadFile(ctx, downloadedFirmware, f.File, true, "UEFI code "+f.Location, *y.Arch); err != nil {
+							logrus.WithError(err).Warnf("failed to download %q", f.Location)
+							continue loop
 						}
+						firmware = downloadedFirmware
+						logrus.Infof("Using firmware %q (downloaded from %q)", firmware, f.Location)
+						break loop
 					}
 				}
-			} else {
-				firmware = downloadedFirmware
-				logrus.Infof("Using existing firmware (%q)", firmware)
 			}
+		} else {
+			firmware = downloadedFirmware
+			logrus.Infof("Using existing firmware (%q)", firmware)
 		}
 		if firmware == "" {
 			firmware, err = getFirmware(exe, *y.Arch)
@@ -644,44 +624,9 @@ func Cmdline(ctx context.Context, cfg Config) (exe string, args []string, err er
 				return "", nil, err
 			}
 			logrus.Infof("Using system firmware (%q)", firmware)
-			if firmwareInBios {
-				firmwareVars, err := getFirmwareVars(exe, *y.Arch)
-				if err != nil {
-					return "", nil, err
-				}
-				logrus.Infof("Using system firmware vars (%q)", firmwareVars)
-				varsFile, err := os.Open(firmwareVars)
-				if err != nil {
-					return "", nil, err
-				}
-				defer varsFile.Close()
-				codeFile, err := os.Open(firmware)
-				if err != nil {
-					return "", nil, err
-				}
-				defer codeFile.Close()
-				resultFile, err := os.OpenFile(firmwareWithVars, os.O_CREATE|os.O_WRONLY, 0o644)
-				if err != nil {
-					return "", nil, err
-				}
-				defer resultFile.Close()
-				_, err = io.Copy(resultFile, varsFile)
-				if err != nil {
-					return "", nil, err
-				}
-				_, err = io.Copy(resultFile, codeFile)
-				if err != nil {
-					return "", nil, err
-				}
-				firmware = firmwareWithVars
-			}
 		}
 		if firmware != "" {
-			if firmwareInBios {
-				args = append(args, "-bios", firmware)
-			} else {
-				args = append(args, "-drive", fmt.Sprintf("if=pflash,format=raw,readonly=on,file=%s", firmware))
-			}
+			args = append(args, "-drive", fmt.Sprintf("if=pflash,format=raw,readonly=on,file=%s", firmware))
 		}
 	}
 
@@ -771,8 +716,8 @@ func Cmdline(ctx context.Context, cfg Config) (exe string, args []string, err er
 	// Configure default usernetwork with limayaml.MACAddress(driver.Instance.Dir) for eth0 interface
 	firstUsernetIndex := limayaml.FirstUsernetIndex(y)
 	if firstUsernetIndex == -1 {
-		args = append(args, "-netdev", fmt.Sprintf("user,id=net0,net=%s,dhcpstart=%s,hostfwd=tcp:%s:%d-:22",
-			networks.SlirpNetwork, networks.SlirpIPAddress, cfg.SSHAddress, cfg.SSHLocalPort))
+		args = append(args, "-netdev", fmt.Sprintf("user,id=net0,net=%s,dhcpstart=%s,hostfwd=tcp:127.0.0.1:%d-:22",
+			networks.SlirpNetwork, networks.SlirpIPAddress, cfg.SSHLocalPort))
 	} else {
 		qemuSock, err := usernet.Sock(y.Networks[firstUsernetIndex].Lima, usernet.QEMUSock)
 		if err != nil {
@@ -1175,11 +1120,9 @@ func getFirmware(qemuExe string, arch limayaml.Arch) (string, error) {
 	userLocalDir := filepath.Join(currentUser.HomeDir, ".local") // "$HOME/.local"
 
 	relativePath := fmt.Sprintf("share/qemu/edk2-%s-code.fd", qemuEdk2Arch(arch))
-	relativePathWin := fmt.Sprintf("share/edk2-%s-code.fd", qemuEdk2Arch(arch))
 	candidates := []string{
 		filepath.Join(userLocalDir, relativePath), // XDG-like
 		filepath.Join(localDir, relativePath),     // macOS (homebrew)
-		filepath.Join(binDir, relativePathWin),    // Windows installer
 	}
 
 	switch arch {
@@ -1216,45 +1159,7 @@ func getFirmware(qemuExe string, arch limayaml.Arch) (string, error) {
 	}
 
 	if arch == limayaml.X8664 {
-		return "", fmt.Errorf("could not find firmware for %q (hint: try setting `firmware.legacyBIOS` to `true`)", arch)
+		return "", fmt.Errorf("could not find firmware for %q (hint: try setting `firmware.legacyBIOS` to `true`)", qemuExe)
 	}
-	qemuArch := strings.TrimPrefix(filepath.Base(qemuExe), "qemu-system-")
-	return "", fmt.Errorf("could not find firmware for %q (hint: try copying the \"edk-%s-code.fd\" firmware to $HOME/.local/share/qemu/)", arch, qemuArch)
-}
-
-func getFirmwareVars(qemuExe string, arch limayaml.Arch) (string, error) {
-	var targetArch string
-	switch arch {
-	case limayaml.X8664:
-		targetArch = "i386" // vars are unified between i386 and x86_64 and normally only former is bundled
-	default:
-		return "", fmt.Errorf("unexpected architecture: %q", arch)
-	}
-
-	currentUser, err := user.Current()
-	if err != nil {
-		return "", err
-	}
-
-	binDir := filepath.Dir(qemuExe)                              // "/usr/local/bin"
-	localDir := filepath.Dir(binDir)                             // "/usr/local"
-	userLocalDir := filepath.Join(currentUser.HomeDir, ".local") // "$HOME/.local"
-
-	relativePath := fmt.Sprintf("share/qemu/edk2-%s-vars.fd", qemuEdk2Arch(targetArch))
-	relativePathWin := fmt.Sprintf("share/edk2-%s-vars.fd", qemuEdk2Arch(targetArch))
-	candidates := []string{
-		filepath.Join(userLocalDir, relativePath), // XDG-like
-		filepath.Join(localDir, relativePath),     // macOS (homebrew)
-		filepath.Join(binDir, relativePathWin),    // Windows installer
-	}
-
-	logrus.Debugf("firmware vars candidates = %v", candidates)
-
-	for _, f := range candidates {
-		if _, err := os.Stat(f); err == nil {
-			return f, nil
-		}
-	}
-
-	return "", fmt.Errorf("could not find firmware vars for %q", arch)
+	return "", fmt.Errorf("could not find firmware for %q (hint: try copying the \"edk-%s-code.fd\" firmware to $HOME/.local/share/qemu/)", arch, qemuExe)
 }
diff --git a/pkg/qemu/qemu_driver.go b/pkg/qemu/qemu_driver.go
index 23b75488..f33151aa 100644
--- a/pkg/qemu/qemu_driver.go
+++ b/pkg/qemu/qemu_driver.go
@@ -72,7 +72,6 @@ func (l *LimaQemuDriver) Start(ctx context.Context) (chan error, error) {
 		InstanceDir:  l.Instance.Dir,
 		LimaYAML:     l.Instance.Config,
 		SSHLocalPort: l.SSHLocalPort,
-		SSHAddress:   l.Instance.SSHAddress,
 	}
 	qExe, qArgs, err := Cmdline(ctx, qCfg)
 	if err != nil {
diff --git a/pkg/store/filenames/filenames.go b/pkg/store/filenames/filenames.go
index ebb76a0c..c02f6e4f 100644
--- a/pkg/store/filenames/filenames.go
+++ b/pkg/store/filenames/filenames.go
@@ -57,7 +57,6 @@ const (
 	VzIdentifier         = "vz-identifier"
 	VzEfi                = "vz-efi"           // efi variable store
 	QemuEfiCodeFD        = "qemu-efi-code.fd" // efi code; not always created
-	QemuEfiFullFD        = "qemu-efi-full.fd" // concatenated efi vars and code; not always created
 	AnsibleInventoryYAML = "ansible-inventory.yaml"
 
 	// SocketDir is the default location for forwarded sockets with a relative paths in HostSocket.
diff --git a/pkg/windows/registry_windows.go b/pkg/windows/registry_windows.go
index 76a77132..10bbbb9a 100644
--- a/pkg/windows/registry_windows.go
+++ b/pkg/windows/registry_windows.go
@@ -2,7 +2,7 @@ package windows
 
 import (
 	"fmt"
-	"math/rand/v2"
+	"math/rand"
 	"slices"
 	"sort"
 	"strconv"
@@ -168,7 +168,7 @@ func GetRandomFreeVSockPort(min, max int) (int, error) {
 		}
 	}
 
-	v := rand.IntN(max - min + 1 - len(used))
+	v := rand.Intn(max - min + 1 - len(used))
 
 	for len(tree) > 1 {
 		m := len(tree) / 2
diff --git a/pkg/yqutil/yqutil.go b/pkg/yqutil/yqutil.go
index 1b0a6ab9..31e62025 100644
--- a/pkg/yqutil/yqutil.go
+++ b/pkg/yqutil/yqutil.go
@@ -93,6 +93,9 @@ func EvaluateExpression(expression string, content []byte) ([]byte, error) {
 }
 
 func Join(yqExprs []string) string {
+	if len(yqExprs) == 0 {
+		return ""
+	}
 	return strings.Join(yqExprs, " | ")
 }
 
diff --git a/templates/archlinux.yaml b/templates/archlinux.yaml
index 04e44a70..55dd6acb 100644
--- a/templates/archlinux.yaml
+++ b/templates/archlinux.yaml
@@ -2,9 +2,9 @@
 images:
 # Try to use yyyyMMdd.REV image if available. Note that yyyyMMdd.REV will be removed after several months.
 
-- location: "https://geo.mirror.pkgbuild.com/images/v20250201.304316/Arch-Linux-x86_64-cloudimg-20250201.304316.qcow2"
+- location: "https://geo.mirror.pkgbuild.com/images/v20250115.298549/Arch-Linux-x86_64-cloudimg-20250115.298549.qcow2"
   arch: "x86_64"
-  digest: "sha256:05af480ff2850e66b6a39b005c80464e045f2330b27a2350b1fbafc9c34f92b3"
+  digest: "sha256:595fece1cd1c91c4dca2c796bd8a32c0932dd0be3996fce156ebb9433a4e11a3"
 - location: "https://github.com/mcginty/arch-boxes-arm/releases/download/v20220323/Arch-Linux-aarch64-cloudimg-20220323.0.qcow2"
   arch: "aarch64"
   digest: "sha512:27524910bf41cb9b3223c8749c6e67fd2f2fdb8b70d40648708e64d6b03c0b4a01b3c5e72d51fefd3e0c3f58487dbb400a79ca378cde2da341a3a19873612be8"
diff --git a/templates/centos-stream-10.yaml b/templates/centos-stream-10.yaml
index 1d985ee4..25b02292 100644
--- a/templates/centos-stream-10.yaml
+++ b/templates/centos-stream-10.yaml
@@ -2,12 +2,12 @@
 
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
-- location: "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-10-20250210.0.x86_64.qcow2"
+- location: "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-10-20250113.0.x86_64.qcow2"
   arch: "x86_64"
-  digest: "sha256:8f89d44d57fe892a14c312ed6b9321debd289af509c128027812aee4e26b296e"
-- location: "https://cloud.centos.org/centos/10-stream/aarch64/images/CentOS-Stream-GenericCloud-10-20250210.0.aarch64.qcow2"
+  digest: "sha256:7dd01792318cfb4ad226933c4fd8f194ecf4144b5c767852bc750b526b825634"
+- location: "https://cloud.centos.org/centos/10-stream/aarch64/images/CentOS-Stream-GenericCloud-10-20250113.0.aarch64.qcow2"
   arch: "aarch64"
-  digest: "sha256:996cdea7be4e13b04a71a45e89215e85c2909d5e08d6f1a8faaa66e7e2f93cbb"
+  digest: "sha256:736392a8cc7a25d54d3560be9e7446425a884bc319c3be388b30abce6a434f9b"
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 - location: "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-10-latest.x86_64.qcow2"
diff --git a/templates/centos-stream-9.yaml b/templates/centos-stream-9.yaml
index 277a3052..972df731 100644
--- a/templates/centos-stream-9.yaml
+++ b/templates/centos-stream-9.yaml
@@ -2,12 +2,12 @@
 
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
-- location: "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20250210.0.x86_64.qcow2"
+- location: "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20250113.0.x86_64.qcow2"
   arch: "x86_64"
-  digest: "sha256:6b7d6f10407c33c6a3ce152ecc12e7cd940b934587a57eefa2e1f5aba9bfc2a0"
-- location: "https://cloud.centos.org/centos/9-stream/aarch64/images/CentOS-Stream-GenericCloud-9-20250210.0.aarch64.qcow2"
+  digest: "sha256:ac08cba677bf0b544ce657615a333656d873f1bdde516793bf8e675b4ef246fa"
+- location: "https://cloud.centos.org/centos/9-stream/aarch64/images/CentOS-Stream-GenericCloud-9-20250113.0.aarch64.qcow2"
   arch: "aarch64"
-  digest: "sha256:507f3e49c8a62eed63e73887b7cdb97a4a1382f6a20ded1eb5eed69c18d9197f"
+  digest: "sha256:777f4cf256c3fd89fd873de2ab90c8fc480ce8038a451080f03769d2223875ae"
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 - location: "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-latest.x86_64.qcow2"
diff --git a/templates/debian-12.yaml b/templates/debian-12.yaml
index 0a9cd6a2..4459f6ea 100644
--- a/templates/debian-12.yaml
+++ b/templates/debian-12.yaml
@@ -1,12 +1,12 @@
 # This template requires Lima v0.7.0 or later
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
-- location: "https://cloud.debian.org/images/cloud/bookworm/20250210-2019/debian-12-genericcloud-amd64-20250210-2019.qcow2"
+- location: "https://cloud.debian.org/images/cloud/bookworm/20250115-1993/debian-12-genericcloud-amd64-20250115-1993.qcow2"
   arch: "x86_64"
-  digest: "sha512:a58d86525d75fd8e139a2302531ce5d2ab75ef0273cfe78f9d53aada4b23efd45f8433b4806fa4570cfe981c8fae26f5e5e855cbd66ba2198862f28125fd2d45"
-- location: "https://cloud.debian.org/images/cloud/bookworm/20250210-2019/debian-12-genericcloud-arm64-20250210-2019.qcow2"
+  digest: "sha512:9d2e5968e2d0bc0a3f40d89a652516e4aa06ebbe8a4bb728737b3588f4ff11e028de2a5582309bf948a673e8dc4c1ceb47708bf6e1bb4a8953e3b577ee6eaaf2"
+- location: "https://cloud.debian.org/images/cloud/bookworm/20250115-1993/debian-12-genericcloud-arm64-20250115-1993.qcow2"
   arch: "aarch64"
-  digest: "sha512:a17a462acbc3412ef195390fb60dffba2134fef1a276d500ca50a06036c488035657409fcd02f2f70d1e7a91776ca4249cfbceabeb90e74cb123b9971381c72a"
+  digest: "sha512:54a2e3534d698442b8f2ad9776be687bacabed05be6b6093ec9b25dd688ea830a46dec9f8d738db790f2c09d20c5ab60b24b751ffc23b94d93371a047284570a"
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 - location: "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2"
diff --git a/templates/default.yaml b/templates/default.yaml
index 471c9661..3eee29a3 100644
--- a/templates/default.yaml
+++ b/templates/default.yaml
@@ -20,18 +20,18 @@ arch: null
 # 🔵 This file: Ubuntu images
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
-- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250129/ubuntu-24.10-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250110/ubuntu-24.10-server-cloudimg-amd64.img"
   arch: "x86_64"
-  digest: "sha256:8831f96c39b987d4b793f44af0176890a5527ab89997da4a1eac979413e57631"
-- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250129/ubuntu-24.10-server-cloudimg-arm64.img"
+  digest: "sha256:6a97773f28cdb5e2461ad13f4f959d4ff4b2705a1f150830b6f30360f1a2c435"
+- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250110/ubuntu-24.10-server-cloudimg-arm64.img"
   arch: "aarch64"
-  digest: "sha256:d0237f183fb83cab4779e6f84099fea748ec3c8a14eec2be9392026da7ffd3d0"
-- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250129/ubuntu-24.10-server-cloudimg-riscv64.img"
+  digest: "sha256:34c1b8c2fe220f67faa351a240d199987db52c574d1a100548386998641434c4"
+- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250110/ubuntu-24.10-server-cloudimg-riscv64.img"
   arch: "riscv64"
-  digest: "sha256:5bd81f36bbb37265ccb02b1c93c1a714d6dd3e6c83c92821ae4cc03649ba96af"
-- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250129/ubuntu-24.10-server-cloudimg-armhf.img"
+  digest: "sha256:171bf2612cc04f0a5fae7519c621184122a9ce262b18d7f1c405d5edbea56bf5"
+- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250110/ubuntu-24.10-server-cloudimg-armhf.img"
   arch: "armv7l"
-  digest: "sha256:6a1ca78f06227ba060d11a88009cc9b65bdd42e17b84d444d204cb5c80f81552"
+  digest: "sha256:f1b5414467a84eb62c0da6e06c16fe5bf7a10111493460ae6b5e67592f657070"
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 - location: "https://cloud-images.ubuntu.com/releases/24.10/release/ubuntu-24.10-server-cloudimg-amd64.img"
@@ -294,9 +294,6 @@ user:
   # It can use the following template variables: {{.Name}}, {{.Hostname}}, {{.UID}}, {{.User}}, and {{.Param.Key}}.
   # 🟢 Builtin default: "/home/{{.User}}.linux"
   home: null
-  # Shell. Needs to be an absolute path.
-  # 🟢 Builtin default: "/bin/bash"
-  shell: null
 
 vmOpts:
   qemu:
@@ -314,7 +311,7 @@ os: null
 # Setting of instructions is supported like this: "qemu64,+ssse3".
 # 🟢 Builtin default: hard-coded arch map with type (see the output of `limactl info | jq .defaultTemplate.cpuType`)
 cpuType:
-#   aarch64: "cortex-a76" # (or "host" when running on aarch64 host)
+#   aarch64: "cortex-a72" # (or "host" when running on aarch64 host)
 #   armv7l: "cortex-a7" # (or "host" when running on armv7l host)
 #   riscv64: "rv64" # (or "host" when running on riscv64 host)
 #   x86_64: "qemu64" # (or "host,-pdpe1gb" when running on x86_64 host)
diff --git a/templates/ubuntu-20.04.yaml b/templates/ubuntu-20.04.yaml
index cd0041f2..262f46ab 100644
--- a/templates/ubuntu-20.04.yaml
+++ b/templates/ubuntu-20.04.yaml
@@ -1,15 +1,15 @@
 # This template requires Lima v0.7.0 or later.
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
-- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250127/ubuntu-20.04-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250109/ubuntu-20.04-server-cloudimg-amd64.img"
   arch: "x86_64"
-  digest: "sha256:fd820773da1f02cba36f6b1dea08d4b354d084bf636839400817cda34d905d14"
-- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250127/ubuntu-20.04-server-cloudimg-arm64.img"
+  digest: "sha256:f7381c60041dd53e7525d2be13b8ede7db79419af511005c5c3a7c658c1f62e8"
+- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250109/ubuntu-20.04-server-cloudimg-arm64.img"
   arch: "aarch64"
-  digest: "sha256:72a91dc2f0492326e7c875ccc006b76149525b8bcc167dcc1c6e41c208a5b65c"
-- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250127/ubuntu-20.04-server-cloudimg-armhf.img"
+  digest: "sha256:e568a681d6bfc1c7c91a86d81be974783c517403cbf3bf7a885cbfe1bfe84d4d"
+- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250109/ubuntu-20.04-server-cloudimg-armhf.img"
   arch: "armv7l"
-  digest: "sha256:027579b19db39e989a95129440fbbc495d9d7426fedde7548851dac1693f8312"
+  digest: "sha256:c0feced93ce5a1acc1e864b74fc14ba654e9342cdf8aa701737f36d92d1fff8f"
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 - location: "https://cloud-images.ubuntu.com/releases/focal/release/ubuntu-20.04-server-cloudimg-amd64.img"
diff --git a/templates/ubuntu-22.04.yaml b/templates/ubuntu-22.04.yaml
index c25956ed..b73904d1 100644
--- a/templates/ubuntu-22.04.yaml
+++ b/templates/ubuntu-22.04.yaml
@@ -1,18 +1,18 @@
 minimumLimaVersion: "1.0.0"
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
-- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20250128/ubuntu-22.04-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20250108/ubuntu-22.04-server-cloudimg-amd64.img"
   arch: "x86_64"
-  digest: "sha256:b6e1e8795c310106e0f73208fcbb25eaa8ab7b748d111d19d2b4eaa11872d1e7"
-- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20250128/ubuntu-22.04-server-cloudimg-arm64.img"
+  digest: "sha256:610e1d37fe06fa23db2ff34d1c03711e55d73b7c3e4482503f50c4d2f9b9d06d"
+- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20250108/ubuntu-22.04-server-cloudimg-arm64.img"
   arch: "aarch64"
-  digest: "sha256:e3b5bff5687a224f73c2c5955fd650c5edc2e3805ac58d6ff24e721391bb4714"
-- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20250128/ubuntu-22.04-server-cloudimg-riscv64.img"
+  digest: "sha256:65a95b38656abec67ce037e6dbceb47721f672a21882fbd12999639d18f9a283"
+- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20250108/ubuntu-22.04-server-cloudimg-riscv64.img"
   arch: "riscv64"
-  digest: "sha256:28b147c8691d4c4cd9d243b1085081f3a6196dbc4455ec44577582f6b15ec697"
-- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20250128/ubuntu-22.04-server-cloudimg-armhf.img"
+  digest: "sha256:60b5b9a51d70068412ae319421e2e0846e2840fe29ac12d4932e8a1e79f83ca4"
+- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20250108/ubuntu-22.04-server-cloudimg-armhf.img"
   arch: "armv7l"
-  digest: "sha256:2a3fce7f82426204b1aa44312c3cfb2a107de2204eea6a0bf1221c2541ee7f3f"
+  digest: "sha256:5207ce3f99c25556f1731a44a2b837cc9c8a12ccc8cec4ce969595e422bb1172"
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 - location: "https://cloud-images.ubuntu.com/releases/22.04/release/ubuntu-22.04-server-cloudimg-amd64.img"
diff --git a/templates/ubuntu-24.10.yaml b/templates/ubuntu-24.10.yaml
index 9be2249f..d7cc2821 100644
--- a/templates/ubuntu-24.10.yaml
+++ b/templates/ubuntu-24.10.yaml
@@ -1,18 +1,18 @@
 minimumLimaVersion: "1.0.0"
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
-- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250129/ubuntu-24.10-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250110/ubuntu-24.10-server-cloudimg-amd64.img"
   arch: "x86_64"
-  digest: "sha256:8831f96c39b987d4b793f44af0176890a5527ab89997da4a1eac979413e57631"
-- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250129/ubuntu-24.10-server-cloudimg-arm64.img"
+  digest: "sha256:6a97773f28cdb5e2461ad13f4f959d4ff4b2705a1f150830b6f30360f1a2c435"
+- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250110/ubuntu-24.10-server-cloudimg-arm64.img"
   arch: "aarch64"
-  digest: "sha256:d0237f183fb83cab4779e6f84099fea748ec3c8a14eec2be9392026da7ffd3d0"
-- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250129/ubuntu-24.10-server-cloudimg-riscv64.img"
+  digest: "sha256:34c1b8c2fe220f67faa351a240d199987db52c574d1a100548386998641434c4"
+- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250110/ubuntu-24.10-server-cloudimg-riscv64.img"
   arch: "riscv64"
-  digest: "sha256:5bd81f36bbb37265ccb02b1c93c1a714d6dd3e6c83c92821ae4cc03649ba96af"
-- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250129/ubuntu-24.10-server-cloudimg-armhf.img"
+  digest: "sha256:171bf2612cc04f0a5fae7519c621184122a9ce262b18d7f1c405d5edbea56bf5"
+- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20250110/ubuntu-24.10-server-cloudimg-armhf.img"
   arch: "armv7l"
-  digest: "sha256:6a1ca78f06227ba060d11a88009cc9b65bdd42e17b84d444d204cb5c80f81552"
+  digest: "sha256:f1b5414467a84eb62c0da6e06c16fe5bf7a10111493460ae6b5e67592f657070"
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 - location: "https://cloud-images.ubuntu.com/releases/24.10/release/ubuntu-24.10-server-cloudimg-amd64.img"
diff --git a/website/content/en/docs/config/environment-variables.md b/website/content/en/docs/config/environment-variables.md
index b769e95a..745fb82e 100644
--- a/website/content/en/docs/config/environment-variables.md
+++ b/website/content/en/docs/config/environment-variables.md
@@ -66,14 +66,3 @@ This page documents the environment variables used in Lima.
   ```sh
   export LIMA_USERNET_RESOLVE_IP_ADDRESS_TIMEOUT=5
   ```
-
-### `LIMA_QEMU_UEFI_IN_BIOS`
-
-- **Description**: Commands QEMU to load x86_64 UEFI images using `-bios` instead of `pflash` drives.
-- **Default**: `false` on Unix like hosts and `true` on Windows hosts
-- **Usage**: 
-  ```sh
-  export LIMA_QEMU_UEFI_IN_BIOS=true
-  ```
-- **Note**: It is expected that this variable will be set to `false` by default in future
-  when QEMU supports `pflash` UEFI for accelerated guests on Windows.
diff --git a/website/content/en/docs/config/network/vmnet.md b/website/content/en/docs/config/network.md
similarity index 57%
rename from website/content/en/docs/config/network/vmnet.md
rename to website/content/en/docs/config/network.md
index 3ec2b90b..a281f3b4 100644
--- a/website/content/en/docs/config/network/vmnet.md
+++ b/website/content/en/docs/config/network.md
@@ -1,11 +1,104 @@
 ---
-title: VMNet networks
-weight: 33
-
+title: Network
+weight: 30
 ---
 
-| ⚡ Requirement    | macOS |
-|-------------------|-------|
+See the following flowchart to choose the best network for you:
+```mermaid
+flowchart
+  connect_to_vm_via{"Connect to the VM via"} -- "localhost" --> default["Default"]
+  connect_to_vm_via -- "IP" --> connect_from{"Connect to the VM IP from"}
+  connect_from -- "Host" --> vm{"VM type"}
+  vm -- "vz" --> vzNAT["vzNAT"]
+  vm -- "qemu" --> shared["socket_vmnet (shared)"]
+  connect_from -- "Other VMs" --> userV2["user-v2"]
+  connect_from -- "Other hosts" --> bridged["socket_vmnet (bridged)"]
+```
+
+## Default user-mode network (192.168.5.0/24)
+
+By default Lima only enables the user-mode networking aka "slirp".
+
+### Guest IP (192.168.5.15)
+
+The guest IP address is set to `192.168.5.15`.
+
+This IP address is not accessible from the host by design.
+
+Use VMNet (see below) to allow accessing the guest IP from the host and other guests.
+
+### Host IP (192.168.5.2)
+
+The loopback addresses of the host is `192.168.5.2` and is accessible from the guest as `host.lima.internal`.
+
+### DNS (192.168.5.3)
+
+If `hostResolver.enabled` in `lima.yaml` is true, then the hostagent is going to run a DNS server over tcp and udp - each on a separate randomly selected free port. This server does a local lookup using the native host resolver, so it will deal correctly with VPN configurations and split-DNS setups, as well as mDNS, local `/etc/hosts` etc. For this the hostagent has to be compiled with `CGO_ENABLED=1` as default Go resolver is [broken](https://github.com/golang/go/issues/12524).
+
+These tcp and udp ports are then forwarded via iptables rules to `192.168.5.3:53`, overriding the DNS provided by QEMU via slirp.
+
+Currently following request types are supported:
+
+- A
+- AAAA
+- CNAME
+- TXT
+- NS
+- MX
+- SRV
+
+For all other queries hostagent will redirect the query to the nameservers specified in `/etc/resolv.conf` (or, if that fails - to `8.8.8.8` and `1.1.1.1`).
+
+DNS over tcp is rarely used. It is usually only used either when user explicitly requires it, or when request+response can't fit into a single UDP packet (most likely in case of DNSSEC), or in the case of certain management operations such as domain transfers. Neither DNSSEC nor management operations are currently supported by a hostagent, but on the off chance that the response may contain an unusually long list of records - hostagent will also listen for the tcp traffic.
+
+During initial cloud-init bootstrap, `iptables` may not yet be installed. In that case the repo server is determined using the slirp DNS. After `iptables` has been installed, the forwarding rule is applied, switching over to the hostagent DNS.
+
+If `hostResolver.enabled` is false, then DNS servers can be configured manually in `lima.yaml` via the `dns` setting. If that list is empty, then Lima will either use the slirp DNS (on Linux), or the nameservers from the first host interface in service order that has an assigned IPv4 address (on macOS).
+
+## Lima user-v2 network
+
+| ⚡ Requirement | Lima >= 0.16.0 |
+|-------------------|----------------|
+
+user-v2 network provides a user-mode networking similar to the [default user-mode network](#user-mode-network--1921685024-) and also provides support for `vm -> vm` communication.
+
+To enable this network mode, define a network with `mode: user-v2` in networks.yaml
+
+By default, the below network configuration is already applied (Since v0.18).
+
+```yaml
+...
+networks:
+  user-v2:
+    mode: user-v2
+    gateway: 192.168.104.1
+    netmask: 255.255.255.0
+...
+```
+
+Instances can then reference these networks from their `lima.yaml` file:
+
+{{< tabpane text=true >}}
+{{% tab header="CLI" %}}
+```bash
+limactl start --network=lima:user-v2
+```
+{{% /tab %}}
+{{% tab header="YAML" %}}
+```yaml
+networks:
+   - lima: user-v2
+```
+{{% /tab %}}
+{{< /tabpane >}}
+
+An instance's IP address is resolvable from another instance as `lima-<NAME>.internal.` (e.g., `lima-default.internal.`).
+
+_Note_
+
+- Enabling this network will disable the [default user-mode network](#user-mode-network--1921685024-)
+
+## VMNet networks
 
 VMNet assigns a "real" IP address that is reachable from the host.
 
@@ -13,12 +106,12 @@ The configuration steps are different for each network type:
 - [vzNAT](#vzNAT)
 - [socket_vmnet](#socket_vmnet)
 
-## vzNAT
+### vzNAT
 
 | ⚡ Requirement | Lima >= 0.14, macOS >= 13.0 |
 |-------------------|-----------------------------|
 
-For [VZ]({{< ref "/docs/config/vmtype#vz" >}}) instances, the "vzNAT" network can be configured as follows:
+For [VZ](../vmtype/#vz) instances, the "vzNAT" network can be configured as follows:
 {{< tabpane text=true >}}
 {{% tab header="CLI" %}}
 ```bash
@@ -37,8 +130,8 @@ The range of the IP address is not specifiable.
 
 The "vzNAT" network does not need the `socket_vmnet` binary and the `sudoers` file.
 
-## socket_vmnet
-### Managed (192.168.105.0/24)
+### socket_vmnet
+#### Managed (192.168.105.0/24)
 
 [`socket_vmnet`](https://github.com/lima-vm/socket_vmnet) can be used for adding another guest IP that is accessible from the host and other guests,
 without depending on vz.
@@ -169,7 +262,7 @@ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/libexec/bootpd
 sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblock /usr/libexec/bootpd
 ```
 
-### Unmanaged
+#### Unmanaged
 Lima can also connect to "unmanaged" networks addressed by "socket". This
 means that the daemons will not be controlled by Lima, but must be started
 before the instance.  The interface type (host, shared, or bridged) is
diff --git a/website/content/en/docs/config/network/_index.md b/website/content/en/docs/config/network/_index.md
deleted file mode 100644
index 78a05871..00000000
--- a/website/content/en/docs/config/network/_index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: Network
-weight: 30
----
-
-See the following flowchart to choose the best network for you:
-```mermaid
-flowchart
-connect_to_vm_via{"Connect to the VM via"} -- "localhost" --> default["Default"]
-  connect_to_vm_via -- "IP" --> connect_from{"Connect to the VM IP from"}
-  connect_from -- "Host" --> vm{"VM type"}
-  vm -- "vz" --> vzNAT["vzNAT (see the VMNet page)"]
-  vm -- "qemu" --> shared["socket_vmnet (shared)"]
-  connect_from -- "Other VMs" --> userV2["user-v2"]
-  connect_from -- "Other hosts" --> bridged["socket_vmnet (bridged)"]
-```
diff --git a/website/content/en/docs/config/network/user-v2.md b/website/content/en/docs/config/network/user-v2.md
deleted file mode 100644
index c4710fd4..00000000
--- a/website/content/en/docs/config/network/user-v2.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-title: user-v2 network
-weight: 32
----
-
-| ⚡ Requirement | Lima >= 0.16.0 |
-|-------------------|----------------|
-
-user-v2 network provides a user-mode networking similar to the [default user-mode network](#user-mode-network--1921685024-) and also provides support for `vm -> vm` communication.
-
-To enable this network mode, define a network with `mode: user-v2` in networks.yaml
-
-By default, the below network configuration is already applied (Since v0.18).
-
-```yaml
-...
-networks:
-  user-v2:
-    mode: user-v2
-    gateway: 192.168.104.1
-    netmask: 255.255.255.0
-...
-```
-
-Instances can then reference these networks from their `lima.yaml` file:
-
-{{< tabpane text=true >}}
-{{% tab header="CLI" %}}
-```bash
-limactl start --network=lima:user-v2
-```
-{{% /tab %}}
-{{% tab header="YAML" %}}
-```yaml
-networks:
-   - lima: user-v2
-```
-{{% /tab %}}
-{{< /tabpane >}}
-
-An instance's IP address is resolvable from another instance as `lima-<NAME>.internal.` (e.g., `lima-default.internal.`).
-
-_Note_
-
-- Enabling this network will disable the [default user-mode network]({{< ref "/docs/config/network/user" >}})
diff --git a/website/content/en/docs/config/network/user.md b/website/content/en/docs/config/network/user.md
deleted file mode 100644
index 1dd23fde..00000000
--- a/website/content/en/docs/config/network/user.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-title: Default user-mode network
-weight: 30
-
----
-
-By default Lima only enables the user-mode networking aka "slirp".
-
-The subnet is hard-coded to `192.168.5.0/24`.
-Use [`user-v2`]]({{< ref "/docs/config/network/user-v2" >}}) network to customize the subnet.
-
-## Guest IP (192.168.5.15)
-
-The guest IP address is set to `192.168.5.15`.
-
-This IP address is not accessible from the host by design.
-
-Use [VMNet]]({{< ref "/docs/config/network/vmnet" >}}) to allow accessing the guest IP from the host and other guests.
-
-## Host IP (192.168.5.2)
-
-The loopback addresses of the host is `192.168.5.2` and is accessible from the guest as `host.lima.internal`.
-
-## DNS (192.168.5.3)
-
-If `hostResolver.enabled` in `lima.yaml` is true, then the hostagent is going to run a DNS server over tcp and udp - each on a separate randomly selected free port. This server does a local lookup using the native host resolver, so it will deal correctly with VPN configurations and split-DNS setups, as well as mDNS, local `/etc/hosts` etc. For this the hostagent has to be compiled with `CGO_ENABLED=1` as default Go resolver is [broken](https://github.com/golang/go/issues/12524).
-
-These tcp and udp ports are then forwarded via iptables rules to `192.168.5.3:53`, overriding the DNS provided by QEMU via slirp.
-
-Currently following request types are supported:
-
-- A
-- AAAA
-- CNAME
-- TXT
-- NS
-- MX
-- SRV
-
-For all other queries hostagent will redirect the query to the nameservers specified in `/etc/resolv.conf` (or, if that fails - to `8.8.8.8` and `1.1.1.1`).
-
-DNS over tcp is rarely used. It is usually only used either when user explicitly requires it, or when request+response can't fit into a single UDP packet (most likely in case of DNSSEC), or in the case of certain management operations such as domain transfers. Neither DNSSEC nor management operations are currently supported by a hostagent, but on the off chance that the response may contain an unusually long list of records - hostagent will also listen for the tcp traffic.
-
-During initial cloud-init bootstrap, `iptables` may not yet be installed. In that case the repo server is determined using the slirp DNS. After `iptables` has been installed, the forwarding rule is applied, switching over to the hostagent DNS.
-
-If `hostResolver.enabled` is false, then DNS servers can be configured manually in `lima.yaml` via the `dns` setting. If that list is empty, then Lima will either use the slirp DNS (on Linux), or the nameservers from the first host interface in service order that has an assigned IPv4 address (on macOS).
diff --git a/website/content/en/docs/dev/internals.md b/website/content/en/docs/dev/internals.md
index 48aa0b08..bce899a7 100644
--- a/website/content/en/docs/dev/internals.md
+++ b/website/content/en/docs/dev/internals.md
@@ -181,7 +181,6 @@ The volume label is "cidata", as defined by [cloud-init NoCloud](https://docs.cl
 - `LIMA_CIDATA_UID`: the numeric UID
 - `LIMA_CIDATA_COMMENT`: the full name or comment string
 - `LIMA_CIDATA_HOME`: the guest home directory
-- `LIMA_CIDATA_SHELL`: the guest login shell
 - `LIMA_CIDATA_HOSTHOME_MOUNTPOINT`: the mount point of the host home directory, or empty if not mounted
 - `LIMA_CIDATA_MOUNTS`: the number of the Lima mounts
 - `LIMA_CIDATA_MOUNTS_%d_MOUNTPOINT`: the N-th mount point of Lima mounts (N=0, 1, ...)
diff --git a/website/content/en/docs/examples/_index.md b/website/content/en/docs/examples/_index.md
index 5d7a5e3d..b67916a7 100644
--- a/website/content/en/docs/examples/_index.md
+++ b/website/content/en/docs/examples/_index.md
@@ -38,14 +38,6 @@ docker run -d --name nginx -p 127.0.0.1:8080:80 nginx:alpine
 ```
 {{% /tab %}}
 
-{{% tab header="Podman" %}}
-```bash
-limactl start template://podman
-export DOCKER_HOST=$(limactl list podman --format 'unix://{{.Dir}}/sock/podman.sock')
-docker run -d --name nginx -p 127.0.0.1:8080:80 nginx:alpine
-```
-{{% /tab %}}
-
 {{% tab header="Kubernetes" %}}
 ```bash
 limactl start template://k8s
diff --git a/website/content/en/docs/installation/_index.md b/website/content/en/docs/installation/_index.md
index a72ca708..9ccc2a87 100644
--- a/website/content/en/docs/installation/_index.md
+++ b/website/content/en/docs/installation/_index.md
@@ -9,7 +9,7 @@ Supported host OS:
 - Windows (untested)
 
 Prerequisite:
-- QEMU 7.1 or later (Required, only if QEMU driver is used)
+- QEMU 7.0 or later (Required, only if QEMU driver is used)
 
 {{< tabpane text=true >}}
 
@@ -60,8 +60,6 @@ make install
 
 The installation directory (`$PREFIX`) defaults to `/usr/local`.
 
-Run `make help-variables` to show other Makefile variables.
-
 #### Advanced configuration with Kconfig tools
 (This step is not needed for most users)
 


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 156c4d8f..66dfde66 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,7 +31,7 @@ jobs:
         fetch-depth: 0
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Install protoc
       run: |
         sudo apt-get update
@@ -39,9 +39,9 @@ jobs:
     - name: Verify generated files
       run: make install-tools generate check-generated
     - name: Run golangci-lint
-      uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837  # v6.5.0
+      uses: golangci/golangci-lint-action@ec5d18412c0aeab7936cb16880d708ba2a64e1ae  # v6.2.0
       with:
-        version: v1.64.2
+        version: v1.62.0
         args: --verbose --timeout=10m
     - name: Run yamllint
       run: yamllint .
@@ -67,13 +67,6 @@ jobs:
       # the allow list corresponds to https://github.com/cncf/foundation/blob/e5db022a0009f4db52b89d9875640cf3137153fe/allowed-third-party-license-policy.md
       run: go-licenses check --include_tests  ./... --allowed_licenses=Apache-2.0,BSD-2-Clause,BSD-2-Clause-FreeBSD,BSD-3-Clause,MIT,ISC,Python-2.0,PostgreSQL,X11,Zlib
 
-  security:
-    name: "Vulncheck"
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-    - uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee  # v1.0.4
-
   spell:
     name: "Spell check"
     runs-on: ubuntu-24.04
@@ -96,7 +89,7 @@ jobs:
       fail-fast: false
       matrix:
         # For non-Homebrew we have to support an old release of Go
-        go-version: ["1.23.x", "1.24.x"]
+        go-version: ["1.22.x", "1.23.x"]
     steps:
     - name: Install test dependencies
       run: |
@@ -155,7 +148,7 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Unit tests
       run: go test -v ./...
     - name: Make
@@ -188,7 +181,7 @@ jobs:
         fetch-depth: 0
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Unit tests
       run: go test -v ./...
     - name: Make
@@ -218,7 +211,7 @@ jobs:
     - name: "Show cache"
       run: ./hack/debug-cache.sh
     - name: "Test default.yaml"
-      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
+      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
       with:
         timeout_minutes: 30
         retry_on: error
@@ -259,7 +252,7 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Make
       run: make
     - name: Install
@@ -282,7 +275,7 @@ jobs:
     - name: "Show cache"
       run: ./hack/debug-cache.sh
     - name: "Test"
-      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
+      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
       with:
         timeout_minutes: 30
         retry_on: error
@@ -310,8 +303,8 @@ jobs:
         ref: ${{ github.event.pull_request.head.sha }}
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
-    - uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f  # v4.2.1
+        go-version: 1.23.x
+    - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57  # v4.2.0
       with:
         path: ~/.cache/lima/download
         key: ${{ runner.os }}-colima-${{ matrix.colima-version }}
@@ -336,7 +329,7 @@ jobs:
     - name: "Show cache"
       run: ./hack/debug-cache.sh
     - name: "Test"
-      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
+      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
       with:
         timeout_minutes: 30
         retry_on: error
@@ -355,7 +348,7 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Make
       run: make
     - name: Install
@@ -388,7 +381,7 @@ jobs:
       # Set -count=1 to disable cache
       run: go test -v -count=1 ./pkg/networks/...
     - name: Test socket_vmnet
-      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
+      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
       with:
         timeout_minutes: 30
         retry_on: error
@@ -418,7 +411,7 @@ jobs:
         filter: tree:0
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Cache image used by ${{ matrix.oldver }}/examples/ubuntu-lts.yaml
       uses: ./.github/actions/setup_cache_for_template
       with:
@@ -430,7 +423,7 @@ jobs:
         # We revert back to 8.2.1, which seems to work fine
         ./hack/brew-install-version.sh qemu 8.2.1
     - name: Test
-      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
+      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
       with:
         timeout_minutes: 30
         retry_on: error
@@ -455,7 +448,7 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.24.x
+        go-version: 1.23.x
     - name: Make
       run: make
     - name: Install
@@ -476,35 +469,3 @@ jobs:
       uses: ./.github/actions/upload_failure_logs_if_exists
       with:
         suffix: ${{ matrix.template }}
-
-  # gomodjail is a library sandbox for Go
-  # https://github.com/AkihiroSuda/gomodjail
-  #
-  # This is an early experiment.
-  # CI failures that only occurs with gomodjail shall not block merging PRs.
-  gomodjail:
-    name: "gomodjail (experimental; failures shall not block merging PRs)"
-    runs-on: macos-15-large  # Intel
-    timeout-minutes: 30
-    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-      with:
-        fetch-depth: 1
-    - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
-      with:
-        go-version: 1.24.x
-    - name: Install gomodjail
-      run: |
-        set -eux -o pipefail
-        git clone https://github.com/AkihiroSuda/gomodjail
-        cd gomodjail
-        make binaries install
-    - name: Install Lima
-      # gomodjail depends on symbols
-      run: make KEEP_SYMBOLS=1 binaries install
-    - name: Cache image used by templates/default.yaml
-      uses: ./.github/actions/setup_cache_for_template
-      with:
-        template: templates/default.yaml
-    - name: Smoke test
-      run: gomodjail run --go-mod=./go.mod -- limactl start --tty=false
diff --git a/hack/test-templates.sh b/hack/test-templates.sh
index 26e064b5..8dfe2e24 100755
--- a/hack/test-templates.sh
+++ b/hack/test-templates.sh
@@ -192,11 +192,10 @@ if [ "$got" != "$expected" ]; then
 fi
 
 INFO "Testing limactl copy command"
-tmpdir="$(mktemp -d "${TMPDIR:-/tmp}"/lima-test-templates.XXXXXX)"
-defer "rm -rf \"$tmpdir\""
-tmpfile="$tmpdir/lima-hostname"
+tmpfile="$HOME/lima-hostname"
 rm -f "$tmpfile"
 limactl cp "$NAME":/etc/hostname "$tmpfile"
+defer "rm -f \"$tmpfile\""
 expected="$(limactl shell "$NAME" cat /etc/hostname)"
 got="$(cat "$tmpfile")"
 INFO "/etc/hostname: expected=${expected}, got=${got}"
diff --git a/pkg/cidata/template_test.go b/pkg/cidata/template_test.go
index 79be8a95..e05abd3e 100644
--- a/pkg/cidata/template_test.go
+++ b/pkg/cidata/template_test.go
@@ -17,7 +17,6 @@ func TestConfig(t *testing.T) {
 		UID:     501,
 		Comment: "Foo",
 		Home:    "/home/foo.linux",
-		Shell:   "/bin/bash",
 		SSHPubKeys: []string{
 			"ssh-rsa dummy foo@example.com",
 		},
@@ -36,7 +35,6 @@ func TestConfigCACerts(t *testing.T) {
 		UID:     501,
 		Comment: "Foo",
 		Home:    "/home/foo.linux",
-		Shell:   "/bin/bash",
 		SSHPubKeys: []string{
 			"ssh-rsa dummy foo@example.com",
 		},
@@ -53,11 +51,10 @@ func TestConfigCACerts(t *testing.T) {
 
 func TestTemplate(t *testing.T) {
 	args := &TemplateArgs{
-		Name:  "default",
-		User:  "foo",
-		UID:   501,
-		Home:  "/home/foo.linux",
-		Shell: "/bin/bash",
+		Name: "default",
+		User: "foo",
+		UID:  501,
+		Home: "/home/foo.linux",
 		SSHPubKeys: []string{
 			"ssh-rsa dummy foo@example.com",
 		},
@@ -89,11 +86,10 @@ func TestTemplate(t *testing.T) {
 
 func TestTemplate9p(t *testing.T) {
 	args := &TemplateArgs{
-		Name:  "default",
-		User:  "foo",
-		UID:   501,
-		Home:  "/home/foo.linux",
-		Shell: "/bin/bash",
+		Name: "default",
+		User: "foo",
+		UID:  501,
+		Home: "/home/foo.linux",
 		SSHPubKeys: []string{
 			"ssh-rsa dummy foo@example.com",
 		},
diff --git a/pkg/limayaml/defaults_test.go b/pkg/limayaml/defaults_test.go
index 1a2f91b8..03b7ff80 100644
--- a/pkg/limayaml/defaults_test.go
+++ b/pkg/limayaml/defaults_test.go
@@ -117,7 +117,6 @@ func TestFillDefault(t *testing.T) {
 			Name:    ptr.Of(user.Username),
 			Comment: ptr.Of(user.Name),
 			Home:    ptr.Of(user.HomeDir),
-			Shell:   ptr.Of("/bin/bash"),
 			UID:     ptr.Of(uint32(uid)),
 		},
 	}
@@ -442,7 +441,6 @@ func TestFillDefault(t *testing.T) {
 			Name:    ptr.Of("xxx"),
 			Comment: ptr.Of("Foo Bar"),
 			Home:    ptr.Of("/tmp"),
-			Shell:   ptr.Of("/bin/tcsh"),
 			UID:     ptr.Of(uint32(8080)),
 		},
 	}
@@ -666,7 +664,6 @@ func TestFillDefault(t *testing.T) {
 			Name:    ptr.Of("foo"),
 			Comment: ptr.Of("foo bar baz"),
 			Home:    ptr.Of("/override"),
-			Shell:   ptr.Of("/bin/sh"),
 			UID:     ptr.Of(uint32(1122)),
 		},
 	}
diff --git a/pkg/yqutil/yqutil_test.go b/pkg/yqutil/yqutil_test.go
index e1055435..fb9b17a8 100644
--- a/pkg/yqutil/yqutil_test.go
+++ b/pkg/yqutil/yqutil_test.go
@@ -120,39 +120,3 @@ foo:
 	assert.NilError(t, err)
 	assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(string(out)))
 }
-
-func TestJoin(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    []string
-		expected string
-	}{
-		{
-			name:     "multiple values",
-			input:    []string{"foo", "bar", "baz"},
-			expected: "foo | bar | baz",
-		},
-		{
-			name:     "one value",
-			input:    []string{"foo"},
-			expected: "foo",
-		},
-		{
-			name:     "empty values",
-			input:    []string{},
-			expected: "",
-		},
-		{
-			name:     "nil values",
-			input:    nil,
-			expected: "",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := Join(test.input)
-			assert.Equal(t, test.expected, actual)
-		})
-	}
-}