Repository: lima-vm/lima
Pull request #3539 (2025-05-14 02:24:36)

feat: add resize disk guide
## Documentation Update:

This pull request introduces a new documentation page to guide users on resizing the disk size of a Lima VM running on macOS. The guide provides a step-by-step process, including prerequisites, commands for successful resizing.

### Issue resolve: #3418

Sonichigo: I have resolved the comments and squashed my commits. Do let me know if there's any changes/suggestions.

Patch:
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 12cc69f2..afce2a7c 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -32,7 +32,7 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.18
+      uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b  # v3.28.17
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -48,6 +48,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.18
+      uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b  # v3.28.17
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 8d9c7438..f5bb9107 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
     # Upload the results to GitHub's code scanning dashboard (optional).
     # Commenting out will disable upload of results to your repo's Code Scanning dashboard
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.18
+      uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b  # v3.28.17
       with:
         sarif_file: results.sarif
diff --git a/cmd/limactl/info.go b/cmd/limactl/info.go
index 73ef5c1b..8aafa714 100644
--- a/cmd/limactl/info.go
+++ b/cmd/limactl/info.go
@@ -7,7 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/lima-vm/lima/pkg/limainfo"
+	"github.com/lima-vm/lima/pkg/infoutil"
 	"github.com/spf13/cobra"
 )
 
@@ -23,7 +23,7 @@ func newInfoCommand() *cobra.Command {
 }
 
 func infoAction(cmd *cobra.Command, _ []string) error {
-	info, err := limainfo.New()
+	info, err := infoutil.GetInfo()
 	if err != nil {
 		return err
 	}
diff --git a/cmd/limactl/list.go b/cmd/limactl/list.go
index b55d96f7..0df97476 100644
--- a/cmd/limactl/list.go
+++ b/cmd/limactl/list.go
@@ -134,11 +134,11 @@ func listAction(cmd *cobra.Command, args []string) error {
 		logrus.Warnf("The directory %q does not look like a valid Lima directory: %v", store.Directory(), err)
 	}
 
-	allInstances, err := store.Instances()
+	allinstances, err := store.Instances()
 	if err != nil {
 		return err
 	}
-	if len(args) == 0 && len(allInstances) == 0 {
+	if len(allinstances) == 0 {
 		logrus.Warn("No instance found. Run `limactl create` to create an instance.")
 		return nil
 	}
@@ -147,7 +147,7 @@ func listAction(cmd *cobra.Command, args []string) error {
 	unmatchedInstances := false
 	if len(args) > 0 {
 		for _, arg := range args {
-			matches := instanceMatches(arg, allInstances)
+			matches := instanceMatches(arg, allinstances)
 			if len(matches) > 0 {
 				instanceNames = append(instanceNames, matches...)
 			} else {
@@ -156,7 +156,7 @@ func listAction(cmd *cobra.Command, args []string) error {
 			}
 		}
 	} else {
-		instanceNames = allInstances
+		instanceNames = allinstances
 	}
 
 	if quiet {
diff --git a/cmd/limactl/start.go b/cmd/limactl/start.go
index c09aaa85..6c65a013 100644
--- a/cmd/limactl/start.go
+++ b/cmd/limactl/start.go
@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"path"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -119,7 +118,8 @@ func loadOrCreateInstance(cmd *cobra.Command, args []string, createOnly bool) (*
 		return nil, err
 	}
 	if isTemplateURL, templateURL := limatmpl.SeemsTemplateURL(arg); isTemplateURL {
-		templateName := path.Join(templateURL.Host, templateURL.Path)
+		// No need to use SecureJoin here. https://github.com/lima-vm/lima/pull/805#discussion_r853411702
+		templateName := filepath.Join(templateURL.Host, templateURL.Path)
 		switch templateName {
 		case "experimental/vz":
 			logrus.Warn("template://experimental/vz was merged into the default template in Lima v1.0. See also <https://lima-vm.io/docs/config/vmtype/>.")
diff --git a/go.mod b/go.mod
index ad48c336..d179fe91 100644
--- a/go.mod
+++ b/go.mod
@@ -16,6 +16,7 @@ require (
 	github.com/containers/gvisor-tap-vsock v0.8.6 // gomodjail:unconfined
 	github.com/coreos/go-semver v0.3.1
 	github.com/cpuguy83/go-md2man/v2 v2.0.7
+	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/digitalocean/go-qemu v0.0.0-20221209210016-f035778c97f7
 	github.com/diskfs/go-diskfs v1.6.0 // gomodjail:unconfined
 	github.com/docker/go-units v0.5.0
@@ -46,13 +47,13 @@ require (
 	golang.org/x/sync v0.14.0
 	golang.org/x/sys v0.33.0 // gomodjail:unconfined
 	golang.org/x/text v0.25.0
-	google.golang.org/grpc v1.72.1
+	google.golang.org/grpc v1.72.0
 	google.golang.org/protobuf v1.36.6 // gomodjail:unconfined
 	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473
 	gotest.tools/v3 v3.5.2
-	k8s.io/api v0.32.5
-	k8s.io/apimachinery v0.32.5
-	k8s.io/client-go v0.32.5
+	k8s.io/api v0.32.4
+	k8s.io/apimachinery v0.32.4
+	k8s.io/client-go v0.32.4
 )
 
 require (
diff --git a/go.sum b/go.sum
index 30c2aadf..80411568 100644
--- a/go.sum
+++ b/go.sum
@@ -51,6 +51,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
 github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
+github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -414,8 +416,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a h1:51aaUVRocpvUOSQKM6Q7VuoaktNIaMCLuhZB6DKksq4=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a/go.mod h1:uRxBH1mhmO8PGhU89cMcHaXKZqO+OfakD8QQO0oYwlQ=
-google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
-google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/grpc v1.72.0 h1:S7UkcVa60b5AAQTaO6ZKamFp1zMZSU0fGDK2WZLbBnM=
+google.golang.org/grpc v1.72.0/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -436,12 +438,12 @@ gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 gvisor.dev/gvisor v0.0.0-20240916094835-a174eb65023f h1:O2w2DymsOlM/nv2pLNWCMCYOldgBBMkD7H0/prN5W2k=
 gvisor.dev/gvisor v0.0.0-20240916094835-a174eb65023f/go.mod h1:sxc3Uvk/vHcd3tj7/DHVBoR5wvWT/MmRq2pj7HRJnwU=
-k8s.io/api v0.32.5 h1:uqjjsYo1kTJr5NIcoIaP9F+TgXgADH7nKQx91FDAhtk=
-k8s.io/api v0.32.5/go.mod h1:bXXFU3fGCZ/eFMZvfHZC69PeGbXEL4zzjuPVzOxHF64=
-k8s.io/apimachinery v0.32.5 h1:6We3aJ6crC0ap8EhsEXcgX3LpI6SEjubpiOMXLROwPM=
-k8s.io/apimachinery v0.32.5/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
-k8s.io/client-go v0.32.5 h1:huFmQMzgWu0z4kbWsuZci+Gt4Fo72I4CcrvhToZ/Qp0=
-k8s.io/client-go v0.32.5/go.mod h1:Qchw6f9WIVrur7DKojAHpRgGLcANT0RLIvF39Jz58xA=
+k8s.io/api v0.32.4 h1:kw8Y/G8E7EpNy7gjB8gJZl3KJkNz8HM2YHrZPtAZsF4=
+k8s.io/api v0.32.4/go.mod h1:5MYFvLvweRhyKylM3Es/6uh/5hGp0dg82vP34KifX4g=
+k8s.io/apimachinery v0.32.4 h1:8EEksaxA7nd7xWJkkwLDN4SvWS5ot9g6Z/VZb3ju25I=
+k8s.io/apimachinery v0.32.4/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
+k8s.io/client-go v0.32.4 h1:zaGJS7xoYOYumoWIFXlcVrsiYioRPrXGO7dBfVC5R6M=
+k8s.io/client-go v0.32.4/go.mod h1:k0jftcyYnEtwlFW92xC7MTtFv5BNcZBr+zn9jPlT9Ic=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
diff --git a/hack/update-template-almalinux-kitten.sh b/hack/update-template-almalinux-kitten.sh
index 5ab33a5f..9a54fb24 100755
--- a/hack/update-template-almalinux-kitten.sh
+++ b/hack/update-template-almalinux-kitten.sh
@@ -12,7 +12,7 @@ set -eu -o pipefail
 # - Use 'shopt -s inherit_errexit' (Bash 4.4+) to avoid repeated 'set -e' in all '$(...)'.
 shopt -s inherit_errexit || error_exit "inherit_errexit not supported. Please use bash 4.4 or later."
 
-function almalinux_kitten_print_help() {
+function almalinux_print_help() {
 	cat <<HELP
 $(basename "${BASH_SOURCE[0]}"): Update the AlmaLinux Kitten image location in the specified templates
 
@@ -54,7 +54,7 @@ HELP
 }
 
 # print the URL spec for the given location
-function almalinux_kitten_url_spec_from_location() {
+function almalinux_url_spec_from_location() {
 	local location=$1 jq_filter url_spec
 	jq_filter='capture(
 		"^https://kitten\\.repo\\.almalinux\\.org/(?<path_version>\\d+)-kitten/cloud/(?<path_arch>[^/]+)/images/" +
@@ -69,35 +69,35 @@ function almalinux_kitten_url_spec_from_location() {
 	echo "${url_spec}"
 }
 
-readonly almalinux_kitten_jq_filter_directory='"https://kitten.repo.almalinux.org/\(.path_version)-kitten/cloud/\(.path_arch)/images/"'
-readonly almalinux_kitten_jq_filter_filename='"AlmaLinux-Kitten-\(.target_vendor)-\(.major_version)-\(if .date then .date + ".0" else "latest" end).\(.arch).\(.file_extension)"'
+readonly almalinux_jq_filter_directory='"https://kitten.repo.almalinux.org/\(.path_version)-kitten/cloud/\(.path_arch)/images/"'
+readonly almalinux_jq_filter_filename='"AlmaLinux-Kitten-\(.target_vendor)-\(.major_version)-\(if .date then .date + ".0" else "latest" end).\(.arch).\(.file_extension)"'
 
 # print the location for the given URL spec
-function almalinux_kitten_location_from_url_spec() {
+function almalinux_location_from_url_spec() {
 	local -r url_spec=$1
-	jq -e -r "${almalinux_kitten_jq_filter_directory} + ${almalinux_kitten_jq_filter_filename}" <<<"${url_spec}" ||
+	jq -e -r "${almalinux_jq_filter_directory} + ${almalinux_jq_filter_filename}" <<<"${url_spec}" ||
 		error_exit "Failed to get the location for ${url_spec}"
 }
 
-function almalinux_kitten_image_directory_from_url_spec() {
+function almalinux_image_directory_from_url_spec() {
 	local -r url_spec=$1
-	jq -e -r "${almalinux_kitten_jq_filter_directory}" <<<"${url_spec}" ||
+	jq -e -r "${almalinux_jq_filter_directory}" <<<"${url_spec}" ||
 		error_exit "Failed to get the image directory for ${url_spec}"
 }
 
-function almalinux_kitten_image_filename_from_url_spec() {
+function almalinux_image_filename_from_url_spec() {
 	local -r url_spec=$1
-	jq -e -r "${almalinux_kitten_jq_filter_filename}" <<<"${url_spec}" ||
+	jq -e -r "${almalinux_jq_filter_filename}" <<<"${url_spec}" ||
 		error_exit "Failed to get the image filename for ${url_spec}"
 }
 
 #
-function almalinux_kitten_latest_image_entry_for_url_spec() {
+function almalinux_latest_image_entry_for_url_spec() {
 	local url_spec=$1 arch major_version_url_spec major_version_image_directory downloaded_page links_in_page latest_minor_version_info
 	arch=$(jq -r '.arch' <<<"${url_spec}")
 	# to detect minor version updates, we need to get the major version URL
 	major_version_url_spec=$(jq -e -r '.path_version = .major_version' <<<"${url_spec}")
-	major_version_image_directory=$(almalinux_kitten_image_directory_from_url_spec "${major_version_url_spec}")
+	major_version_image_directory=$(almalinux_image_directory_from_url_spec "${major_version_url_spec}")
 	downloaded_page=$(download_to_cache "${major_version_image_directory}")
 	if command -v htmlq >/dev/null; then
 		links_in_page=$(htmlq 'pre a' --attribute href <"${downloaded_page}")
@@ -122,34 +122,34 @@ function almalinux_kitten_latest_image_entry_for_url_spec() {
 	local newer_url_spec location directory checksum_location downloaded_sha256sum filename digest
 	# prefer the major_minor_version in the path
 	newer_url_spec=$(jq -e -r ". + ${latest_minor_version_info} | .path_version = .major_minor_version" <<<"${url_spec}")
-	location=$(almalinux_kitten_location_from_url_spec "${newer_url_spec}")
-	directory=$(almalinux_kitten_image_directory_from_url_spec "${newer_url_spec}")
+	location=$(almalinux_location_from_url_spec "${newer_url_spec}")
+	directory=$(almalinux_image_directory_from_url_spec "${newer_url_spec}")
 	checksum_location="${directory}CHECKSUM"
 	downloaded_sha256sum=$(download_to_cache "${checksum_location}")
-	filename=$(almalinux_kitten_image_filename_from_url_spec "${newer_url_spec}")
+	filename=$(almalinux_image_filename_from_url_spec "${newer_url_spec}")
 	digest=$(awk "/${filename}/{print \"sha256:\"\$1}" "${downloaded_sha256sum}")
 	[[ -n ${digest} ]] || error_exit "Failed to get the SHA256 digest for ${filename}"
 	json_vars location arch digest
 }
 
-function almalinux_kitten_cache_key_for_image_kernel() {
+function almalinux_cache_key_for_image_kernel() {
 	local location=$1 url_spec
-	url_spec=$(almalinux_kitten_url_spec_from_location "${location}")
+	url_spec=$(almalinux_url_spec_from_location "${location}")
 	jq -r '["almalinux-kitten", .major_minor_version // .major_version, .target_vendor,
 		if .date then "timestamped" else "latest" end,
 		.arch, .file_extension] | join(":")' <<<"${url_spec}"
 }
 
-function almalinux_kitten_image_entry_for_image_kernel() {
+function almalinux_image_entry_for_image_kernel() {
 	local location=$1 kernel_is_not_supported=$2 overriding=${3:-"{}"} url_spec image_entry=''
 	[[ ${kernel_is_not_supported} == "null" ]] || echo "Updating kernel information is not supported on AlmaLinux Kitten" >&2
-	url_spec=$(almalinux_kitten_url_spec_from_location "${location}" | jq -r ". + ${overriding}")
+	url_spec=$(almalinux_url_spec_from_location "${location}" | jq -r ". + ${overriding}")
 	if jq -e '.date' <<<"${url_spec}" >/dev/null; then
-		image_entry=$(almalinux_kitten_latest_image_entry_for_url_spec "${url_spec}")
+		image_entry=$(almalinux_latest_image_entry_for_url_spec "${url_spec}")
 	else
 		image_entry=$(
 			# shellcheck disable=SC2030
-			location=$(almalinux_kitten_location_from_url_spec "${url_spec}")
+			location=$(almalinux_location_from_url_spec "${url_spec}")
 			location=$(validate_url_without_redirect "${location}")
 			arch=$(jq -r '.path_arch' <<<"${url_spec}")
 			json_vars location arch
@@ -194,7 +194,7 @@ declare overriding="{}"
 while [[ $# -gt 0 ]]; do
 	case "$1" in
 	-h | --help)
-		almalinux_kitten_print_help
+		almalinux_print_help
 		exit 0
 		;;
 	-d | --debug) set -x ;;
@@ -232,7 +232,7 @@ while [[ $# -gt 0 ]]; do
 done
 
 if [[ ${#templates[@]} -eq 0 ]]; then
-	almalinux_kitten_print_help
+	almalinux_print_help
 	exit 0
 fi
 
@@ -257,7 +257,7 @@ for template in "${templates[@]}"; do
 		set +e # Disable 'set -e' to avoid exiting on error for the next assignment.
 		cache_key=$(
 			set -e # Enable 'set -e' for the next command.
-			almalinux_kitten_cache_key_for_image_kernel "${location}" "${kernel_location}"
+			almalinux_cache_key_for_image_kernel "${location}" "${kernel_location}"
 		) # Check exit status separately to prevent disabling 'set -e' by using the function call in the condition.
 		# shellcheck disable=2181
 		[[ $? -eq 0 ]] || continue
@@ -266,7 +266,7 @@ for template in "${templates[@]}"; do
 			if [[ -v image_entry_cache[${cache_key}] ]]; then
 				echo "${image_entry_cache[${cache_key}]}"
 			else
-				almalinux_kitten_image_entry_for_image_kernel "${location}" "${kernel_location}" "${overriding}"
+				almalinux_image_entry_for_image_kernel "${location}" "${kernel_location}" "${overriding}"
 			fi
 		) # Check exit status separately to prevent disabling 'set -e' by using the function call in the condition.
 		# shellcheck disable=2181
diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot/01-alpine-ash-as-bash.sh b/pkg/cidata/cidata.TEMPLATE.d/boot/01-alpine-ash-as-bash.sh
index d4241f12..a06e4770 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/boot/01-alpine-ash-as-bash.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot/01-alpine-ash-as-bash.sh
@@ -7,9 +7,6 @@
 # cloud-init scripts can use `#!/bin/bash` and `set -o pipefail`.
 test -f /etc/alpine-release || exit 0
 
-# If bash already exists, do nothing.
-test -x /bin/bash && exit 0
-
 # Redirect bash to ash (built with CONFIG_ASH_BASH_COMPAT) and hope for the best :)
 # It does support `set -o pipefail`, but not `[[`.
 # /bin/bash can't be a symlink because /bin/ash is a symlink to /bin/busybox
diff --git a/pkg/limainfo/limainfo.go b/pkg/infoutil/infoutil.go
similarity index 83%
rename from pkg/limainfo/limainfo.go
rename to pkg/infoutil/infoutil.go
index 89a646ec..82daac81 100644
--- a/pkg/limainfo/limainfo.go
+++ b/pkg/infoutil/infoutil.go
@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright The Lima Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package limainfo
+package infoutil
 
 import (
 	"errors"
@@ -16,7 +16,7 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-type LimaInfo struct {
+type Info struct {
 	Version         string                       `json:"version"`
 	Templates       []templatestore.Template     `json:"templates"`
 	DefaultTemplate *limayaml.LimaYAML           `json:"defaultTemplate"`
@@ -29,10 +29,7 @@ type GuestAgent struct {
 	Location string `json:"location"` // since Lima v1.1.0
 }
 
-// New returns a LimaInfo object with the Lima version, a list of all Templates and their location,
-// the DefaultTemplate corresponding to template://default with all defaults filled in, the
-// LimaHome location, a list of all supported VMTypes, and a map of GuestAgents for each architecture.
-func New() (*LimaInfo, error) {
+func GetInfo() (*Info, error) {
 	b, err := templatestore.Read(templatestore.Default)
 	if err != nil {
 		return nil, err
@@ -41,7 +38,7 @@ func New() (*LimaInfo, error) {
 	if err != nil {
 		return nil, err
 	}
-	info := &LimaInfo{
+	info := &Info{
 		Version:         version.Version,
 		DefaultTemplate: y,
 		VMTypes:         driverutil.Drivers(),
diff --git a/pkg/limatmpl/locator.go b/pkg/limatmpl/locator.go
index 3f2f2674..a2f6ca0d 100644
--- a/pkg/limatmpl/locator.go
+++ b/pkg/limatmpl/locator.go
@@ -40,7 +40,8 @@ func Read(ctx context.Context, name, locator string) (*Template, error) {
 	isTemplateURL, templateURL := SeemsTemplateURL(locator)
 	switch {
 	case isTemplateURL:
-		templateName := path.Join(templateURL.Host, templateURL.Path)
+		// No need to use SecureJoin here. https://github.com/lima-vm/lima/pull/805#discussion_r853411702
+		templateName := filepath.Join(templateURL.Host, templateURL.Path)
 		logrus.Debugf("interpreting argument %q as a template name %q", locator, templateName)
 		if tmpl.Name == "" {
 			// e.g., templateName = "deprecated/centos-7.yaml" , tmpl.Name = "centos-7"
diff --git a/pkg/limayaml/containerd.yaml b/pkg/limayaml/containerd.yaml
index 43163b53..3d77de58 100644
--- a/pkg/limayaml/containerd.yaml
+++ b/pkg/limayaml/containerd.yaml
@@ -1,9 +1,9 @@
 archives:
-- location: https://github.com/containerd/nerdctl/releases/download/v2.1.2/nerdctl-full-2.1.2-linux-amd64.tar.gz
+- location: https://github.com/containerd/nerdctl/releases/download/v2.1.1/nerdctl-full-2.1.1-linux-amd64.tar.gz
   arch: x86_64
-  digest: sha256:b3ab8564c8fa6feb89d09bee881211b700b047373c767bec38256d0d68f93074
-- location: https://github.com/containerd/nerdctl/releases/download/v2.1.2/nerdctl-full-2.1.2-linux-arm64.tar.gz
+  digest: sha256:f4fcb3ba57dabf3f1a07d6f58e1917c3b8a5ef7a84fa268c0f706f214e78b48f
+- location: https://github.com/containerd/nerdctl/releases/download/v2.1.1/nerdctl-full-2.1.1-linux-arm64.tar.gz
   arch: aarch64
-  digest: sha256:1b52f32b7d5bbf63005bceb6a3cacd237d2fa8f1d05bb590e8ce58731779b9ee
+  digest: sha256:a5004520d47b2823dd07888378c70e1085f4f14bcb5f575ea8426d5b5b37c7c6
 # No arm-v7
 # No riscv64
diff --git a/templates/_images/centos-stream-10.yaml b/templates/_images/centos-stream-10.yaml
index 640374d5..1f0afc4e 100644
--- a/templates/_images/centos-stream-10.yaml
+++ b/templates/_images/centos-stream-10.yaml
@@ -1,18 +1,19 @@
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
 
-- location: "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-10-20250520.0.x86_64.qcow2"
+- location: "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-10-20250429.0.x86_64.qcow2"
   arch: "x86_64"
-  digest: "sha256:16b7ef3db3fe1ac60d8140d34f1bf7b24dc1636e7ad2412f909232f014a2875d"
-- location: "https://cloud.centos.org/centos/10-stream/aarch64/images/CentOS-Stream-GenericCloud-10-20250520.0.aarch64.qcow2"
+  digest: "sha256:f30c6c57858c7c9be55b47541f2b70786d0858b0047c7b682b4346a1bac96899"
+- location: "https://cloud.centos.org/centos/10-stream/aarch64/images/CentOS-Stream-GenericCloud-10-20250429.0.aarch64.qcow2"
   arch: "aarch64"
-  digest: "sha256:814d7887011c102b3c5fe55e2a5ba4966d89e7c26a38da1e7277719861aeba0a"
-- location: "https://cloud.centos.org/centos/10-stream/s390x/images/CentOS-Stream-GenericCloud-10-20250520.0.s390x.qcow2"
+  digest: "sha256:e5990c7b18ded37db1b9309575eb80e19fad80ac0f4cabd14421211833f0cffc"
+- location: "https://cloud.centos.org/centos/10-stream/s390x/images/CentOS-Stream-GenericCloud-10-20250429.0.s390x.qcow2"
   arch: "s390x"
-  digest: "sha256:8d4597d8117abe216beb30e3b52bb2b5e4e405544151055e139d77d05b37d423"
-- location: "https://cloud.centos.org/centos/10-stream/ppc64le/images/CentOS-Stream-GenericCloud-10-20250520.0.ppc64le.qcow2"
+  digest: "sha256:d102c9ee9c1ff72d93f349ab30980c6901be5f85083ef2bfd5a882f164fcb692"
+- location: "https://cloud.centos.org/centos/10-stream/ppc64le/images/CentOS-Stream-GenericCloud-10-20250429.0.ppc64le.qcow2"
   arch: "ppc64le"
-  digest: "sha256:88ad4ba818dfd0f43e5fff9d4a793589df4f35c5120a9cf3958960d765662ca9"
+  digest: "sha256:75157ca6cdf43ad755f99904219c4b4285126df194ed38d558cd5de0f8f1cd97"
+
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 
diff --git a/templates/_images/centos-stream-9.yaml b/templates/_images/centos-stream-9.yaml
index 7947ef10..ad9a5b25 100644
--- a/templates/_images/centos-stream-9.yaml
+++ b/templates/_images/centos-stream-9.yaml
@@ -1,18 +1,19 @@
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
 
-- location: "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20250512.0.x86_64.qcow2"
+- location: "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20250428.0.x86_64.qcow2"
   arch: "x86_64"
-  digest: "sha256:9c7cbce3c1fdd1e06e4fea8d577ec014f18eb700e48629b04a84ce1589890135"
-- location: "https://cloud.centos.org/centos/9-stream/aarch64/images/CentOS-Stream-GenericCloud-9-20250512.0.aarch64.qcow2"
+  digest: "sha256:686887f2fbe63317e42d85c3feb0c69879388fbe959d83de0210a4212a5d7d76"
+- location: "https://cloud.centos.org/centos/9-stream/aarch64/images/CentOS-Stream-GenericCloud-9-20250428.0.aarch64.qcow2"
   arch: "aarch64"
-  digest: "sha256:583aff93ae902f5085aa2bc44f648fd63d5fa706285823bd9bbbaf4fc40070dd"
-- location: "https://cloud.centos.org/centos/9-stream/s390x/images/CentOS-Stream-GenericCloud-9-20250512.0.s390x.qcow2"
+  digest: "sha256:2460259ae98a81d29473b5e95f675a7c1042683fe4af0240e38fe0ee85fcb782"
+- location: "https://cloud.centos.org/centos/9-stream/s390x/images/CentOS-Stream-GenericCloud-9-20250428.0.s390x.qcow2"
   arch: "s390x"
-  digest: "sha256:4788b2bb31c9014c0eb09f8f058ae88ef5956df058e553c86ef0dcab044d334a"
-- location: "https://cloud.centos.org/centos/9-stream/ppc64le/images/CentOS-Stream-GenericCloud-9-20250512.0.ppc64le.qcow2"
+  digest: "sha256:ec270d96ac73e1fe28587df500fd1602c8d80a7bddf354e25b7d2b91a936993c"
+- location: "https://cloud.centos.org/centos/9-stream/ppc64le/images/CentOS-Stream-GenericCloud-9-20250428.0.ppc64le.qcow2"
   arch: "ppc64le"
-  digest: "sha256:0e1886f61015998abb0dcc691238b28bf36933be27e7bee5a4a4df3b5fdf8844"
+  digest: "sha256:926da7012700e4c4f4ef04643baaee9c0ac7293bcdb4acdb8982266b8fe9a908"
+
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 
diff --git a/templates/_images/debian-11.yaml b/templates/_images/debian-11.yaml
index 44898dd0..05a8474e 100644
--- a/templates/_images/debian-11.yaml
+++ b/templates/_images/debian-11.yaml
@@ -1,15 +1,16 @@
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
 
-- location: "https://cloud.debian.org/images/cloud/bullseye/20250512-2110/debian-11-genericcloud-amd64-20250512-2110.qcow2"
+- location: "https://cloud.debian.org/images/cloud/bullseye/20250429-2097/debian-11-genericcloud-amd64-20250429-2097.qcow2"
   arch: "x86_64"
-  digest: "sha512:c902c738e05c0a9d67284563996aaae82a27b7df5240f38620ef9a7bdcab82e82317fa2209861718e74952199400607b30d8bd5c4a5cf53823ce4f54deb5d895"
-- location: "https://cloud.debian.org/images/cloud/bullseye/20250512-2110/debian-11-genericcloud-arm64-20250512-2110.qcow2"
+  digest: "sha512:6dc6a940c1e32375a9bd454bcc4ccc4ce4ae3a4b8b38ebe911359189be8c3f8eaf6b7136aa5edfb32df755c51a4e1c95a6ffee9a99265bad3e7835ed50ef037b"
+- location: "https://cloud.debian.org/images/cloud/bullseye/20250429-2097/debian-11-genericcloud-arm64-20250429-2097.qcow2"
   arch: "aarch64"
-  digest: "sha512:e79761b03da4928ce6251236a739d2ac33c183c0b7e8d5474ec7218c3e4296b11bb81f10d54973c67d49535500898bb9ca3a984ca96f0314a2d19face956021f"
-- location: "https://cloud.debian.org/images/cloud/bullseye/20250512-2110/debian-11-genericcloud-ppc64el-20250512-2110.qcow2"
+  digest: "sha512:f27fa0af9ab5edd232d8d418daa755ffe27d6382b25208f01c4959444c7968629e91f9ea112cbffc49ec29536dab02f30edcdacfdff588ccad16a99a572bba0f"
+- location: "https://cloud.debian.org/images/cloud/bullseye/20250429-2097/debian-11-genericcloud-ppc64el-20250429-2097.qcow2"
   arch: "ppc64le"
-  digest: "sha512:d0eb263160c14242b47a008d43295bb59d2ced056849000311d52e9b9fa820d13a8387234faf54bab4f43040d5b044e4bdc80e8fc5e55ba5e03a878356b4151a"
+  digest: "sha512:ab23cc83b58f0d63450277d6d94a173ea2503ee0594c535a4432eca130cd5d06a646b24bae8bdcf633e73e2fc4dfeaffac9c5ec213c7267f3f8db048d256e85f"
+
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 
diff --git a/templates/_images/debian-12.yaml b/templates/_images/debian-12.yaml
index 97897950..cae7d0cc 100644
--- a/templates/_images/debian-12.yaml
+++ b/templates/_images/debian-12.yaml
@@ -1,15 +1,16 @@
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
 
-- location: "https://cloud.debian.org/images/cloud/bookworm/20250519-2117/debian-12-genericcloud-amd64-20250519-2117.qcow2"
+- location: "https://cloud.debian.org/images/cloud/bookworm/20250428-2096/debian-12-genericcloud-amd64-20250428-2096.qcow2"
   arch: "x86_64"
-  digest: "sha512:ee35c87b8a0c67eb67a169beec3bef5d6868957c1d31374797ef37072650c5067094c50ca293d7b926a967d07515abf1845f515084e3a192c7c69df75e84c95a"
-- location: "https://cloud.debian.org/images/cloud/bookworm/20250519-2117/debian-12-genericcloud-arm64-20250519-2117.qcow2"
+  digest: "sha512:f2a87069aad71019ee0c8215f36bcf1e30248494af41da105f461876ea23d7997782d7a04b68b8cd39b19d4bd1779ae0dfcd6a91d1a2ac719555d673515b4d93"
+- location: "https://cloud.debian.org/images/cloud/bookworm/20250428-2096/debian-12-genericcloud-arm64-20250428-2096.qcow2"
   arch: "aarch64"
-  digest: "sha512:9282da6c8509e16191a3950c63174a4c94f8921ff2062ed54912f86aa8c986edf443d7f77f0e9d0937c2576f09fbacb2fd53459875ec2c7afb015c70d54c7e19"
-- location: "https://cloud.debian.org/images/cloud/bookworm/20250519-2117/debian-12-genericcloud-ppc64el-20250519-2117.qcow2"
+  digest: "sha512:a669b9b82fc3afc8c9ef84c7e9a38ffdec060b51b47fe33a66f2b65d0da9a742f9645a4fa24b5c8cb4e5a37123a0ae4ad810410c4160a6f6825c7189c296f5ec"
+- location: "https://cloud.debian.org/images/cloud/bookworm/20250428-2096/debian-12-genericcloud-ppc64el-20250428-2096.qcow2"
   arch: "ppc64le"
-  digest: "sha512:67dcadf2975455a2e3b32bf4025f1b2429b7b189a34db69214168f63ef977704a4eb03f3a28ae4a0f3799374ed302327fe6628e352c8043570f45b8f9fe9b88e"
+  digest: "sha512:a40a41d341e5e76ff189ffcc172a510617f1af46bb2a08e54b1570cd594e99c69912640b007a0581232c6e3a22e7a3d38de3babf70aced68ba902726146ee628"
+
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 
diff --git a/templates/_images/ubuntu-20.04.yaml b/templates/_images/ubuntu-20.04.yaml
index 04e9fd73..74daa49f 100644
--- a/templates/_images/ubuntu-20.04.yaml
+++ b/templates/_images/ubuntu-20.04.yaml
@@ -1,21 +1,22 @@
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
 
-- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250516/ubuntu-20.04-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250429/ubuntu-20.04-server-cloudimg-amd64.img"
   arch: "x86_64"
-  digest: "sha256:3d5a77f8f6a240cd3478c24cc4d0a11a823236b03868d79a432906c394b835a9"
-- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250516/ubuntu-20.04-server-cloudimg-arm64.img"
+  digest: "sha256:d8099fc706ba63de95e1e3657a019ce46c4e8eface838319138d1a18f274ddb4"
+- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250429/ubuntu-20.04-server-cloudimg-arm64.img"
   arch: "aarch64"
-  digest: "sha256:c1fa8013924407283fbc25af7d50cb3cfd1811d7099bdb624bf699d91b3f1a41"
-- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250516/ubuntu-20.04-server-cloudimg-armhf.img"
+  digest: "sha256:1b341e3c9006660986b0c18b523948f3a53bb22e5e16d8e04bcf3ea8315b90c0"
+- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250429/ubuntu-20.04-server-cloudimg-armhf.img"
   arch: "armv7l"
-  digest: "sha256:709e58073d548ba4515c012314eda9528c73986b7f6f88b02becbe3daae9000d"
-- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250516/ubuntu-20.04-server-cloudimg-s390x.img"
+  digest: "sha256:0815f07d31c409551f792b64317f9ee5e29a9da41ba0b1ea4ba0e8628f047c4c"
+- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250429/ubuntu-20.04-server-cloudimg-s390x.img"
   arch: "s390x"
-  digest: "sha256:fc6f187f301e4c2e35c01f106efe9c528c5ca2da50faafc0e0c586d8b8e368ff"
-- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250516/ubuntu-20.04-server-cloudimg-ppc64el.img"
+  digest: "sha256:710fc0a25cf1c3684d87202cccf10761e5c6e690500e7a17f7da9a9965a1d35d"
+- location: "https://cloud-images.ubuntu.com/releases/focal/release-20250429/ubuntu-20.04-server-cloudimg-ppc64el.img"
   arch: "ppc64le"
-  digest: "sha256:560d8b1532efb87bb1f105ac251428e789284cca3080d3d55bbce87982370cc2"
+  digest: "sha256:45e79fb0ae143fdad797802f586f318f1c98199d6a6f1366f3f64242ceb7c07e"
+
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 
diff --git a/templates/_images/ubuntu-22.04.yaml b/templates/_images/ubuntu-22.04.yaml
index 934a32eb..bf9ecd81 100644
--- a/templates/_images/ubuntu-22.04.yaml
+++ b/templates/_images/ubuntu-22.04.yaml
@@ -1,24 +1,25 @@
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
 
-- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250516/ubuntu-22.04-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250429/ubuntu-22.04-server-cloudimg-amd64.img"
   arch: "x86_64"
-  digest: "sha256:a037d6d0299171ba62019f3c3f895eb902c271f8e9676cfe0f22e38070344579"
-- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250516/ubuntu-22.04-server-cloudimg-arm64.img"
+  digest: "sha256:952bc5bb4349897a409559c26fdec006a2744b103e005af6df8693cfab515bc2"
+- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250429/ubuntu-22.04-server-cloudimg-arm64.img"
   arch: "aarch64"
-  digest: "sha256:a83795b1ff39e13314e31001bf358081be6e7f7eb3ae93a72cc494ceef51462e"
-- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250516/ubuntu-22.04-server-cloudimg-riscv64.img"
+  digest: "sha256:61e112c18372a72644be70b32c24c46e95f255ce55b91abfa3eb3f4611a80f1a"
+- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250429/ubuntu-22.04-server-cloudimg-riscv64.img"
   arch: "riscv64"
-  digest: "sha256:b7f9eb9046a80d34f9b61de2a9c1c5869d204ed9250862dea8bb2f25df7ccc51"
-- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250516/ubuntu-22.04-server-cloudimg-armhf.img"
+  digest: "sha256:d473c0d51f8c2dc20ed2fd78549fa8ac6e959e9c6aab6ea611821db81b65e55a"
+- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250429/ubuntu-22.04-server-cloudimg-armhf.img"
   arch: "armv7l"
-  digest: "sha256:e0e4755938b3234f229dad40e5969b520396cc1a31be1ec82104ec9c568ce055"
-- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250516/ubuntu-22.04-server-cloudimg-s390x.img"
+  digest: "sha256:f105b8e8781d2071ece1d8c679f1ea47905f7a5e141f7b69dfb4d8b94ee41e55"
+- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250429/ubuntu-22.04-server-cloudimg-s390x.img"
   arch: "s390x"
-  digest: "sha256:5a55bb49213b093b03dd54b4e4cc3b873f6b39a05ab25480d246bb99b1fa4d4a"
-- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250516/ubuntu-22.04-server-cloudimg-ppc64el.img"
+  digest: "sha256:dd2a7139ba741391fe62a2fb7f80beef72300126ac080d3e46c46e4f9dbafe20"
+- location: "https://cloud-images.ubuntu.com/releases/jammy/release-20250429/ubuntu-22.04-server-cloudimg-ppc64el.img"
   arch: "ppc64le"
-  digest: "sha256:923c250246b42aae1213be3b5df35d866ec5e2b6f7aebefa2095109fd8c1d575"
+  digest: "sha256:b1ece28847210487a452eb77601dbb89f613d8f31a8a971932d38b4eabc3f08d"
+
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 
diff --git a/templates/_images/ubuntu-24.04.yaml b/templates/_images/ubuntu-24.04.yaml
index b78d60a9..500a2895 100644
--- a/templates/_images/ubuntu-24.04.yaml
+++ b/templates/_images/ubuntu-24.04.yaml
@@ -1,24 +1,25 @@
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
 
-- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250516/ubuntu-24.04-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250430/ubuntu-24.04-server-cloudimg-amd64.img"
   arch: "x86_64"
-  digest: "sha256:8d6161defd323d24d66f85dda40e64e2b9021aefa4ca879dcbc4ec775ad1bbc5"
-- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250516/ubuntu-24.04-server-cloudimg-arm64.img"
+  digest: "sha256:bc471ca49de03b5129c65b70f9862b7f4b5e721622fd34ade78132f6f7999e2d"
+- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250430/ubuntu-24.04-server-cloudimg-arm64.img"
   arch: "aarch64"
-  digest: "sha256:c933c6932615d26c15f6e408e4b4f8c43cb3e1f73b0a98c2efa916cc9ab9549c"
-- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250516/ubuntu-24.04-server-cloudimg-riscv64.img"
+  digest: "sha256:05317c8ea0f973af351e4e1da9c4cba82991c94d2529b4c7af09e88091f518c5"
+- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250430/ubuntu-24.04-server-cloudimg-riscv64.img"
   arch: "riscv64"
-  digest: "sha256:8b7f41b6530609a5cb1c4ec21b1993e6e80985e5c9c2b13d43dad95bc58afb94"
-- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250516/ubuntu-24.04-server-cloudimg-armhf.img"
+  digest: "sha256:2b15872b41e46adab16e8eb2f560b765152d1c80a45d0f0f73b74fa5f41945c7"
+- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250430/ubuntu-24.04-server-cloudimg-armhf.img"
   arch: "armv7l"
-  digest: "sha256:c9a9c7d6cd680b4faf8421da78e64aab7a3d024e86d48e57472fe74a4f45343e"
-- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250516/ubuntu-24.04-server-cloudimg-s390x.img"
+  digest: "sha256:dcec9714fde82617fdc1e4c1345700db0902bd546dd9c752985b958bd2cceab5"
+- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250430/ubuntu-24.04-server-cloudimg-s390x.img"
   arch: "s390x"
-  digest: "sha256:ecf500c278ed43dddc80edaa68f24e4e8bbe7e715169f97347b82991054ddbea"
-- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250516/ubuntu-24.04-server-cloudimg-ppc64el.img"
+  digest: "sha256:f4b61d53b30e08b3e44ac99012c933b92d00620c789154511ef62d44fae15c04"
+- location: "https://cloud-images.ubuntu.com/releases/noble/release-20250430/ubuntu-24.04-server-cloudimg-ppc64el.img"
   arch: "ppc64le"
-  digest: "sha256:11fc8af103fa6ae0f9b250e7929bf6fba15cb9fb3434108f699569e918c8eba5"
+  digest: "sha256:36c52f130c91478b1069ee29bf4c70a4e44de986d0716dd56e3af165ac5a04fe"
+
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 
diff --git a/templates/_images/ubuntu-24.10.yaml b/templates/_images/ubuntu-24.10.yaml
index 827c8d9d..61f6f14a 100644
--- a/templates/_images/ubuntu-24.10.yaml
+++ b/templates/_images/ubuntu-24.10.yaml
@@ -1,24 +1,25 @@
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
 
-- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250502/ubuntu-24.10-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250430/ubuntu-24.10-server-cloudimg-amd64.img"
   arch: "x86_64"
-  digest: "sha256:ad138a12a105ba1d6138fee0a7827de9edb04c8e3497c4ee03bfb00222e47668"
-- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250502/ubuntu-24.10-server-cloudimg-arm64.img"
+  digest: "sha256:baaf40f68a1e93f9523949aa81fa85bb183cf316db34517b5cd614a921c74b9d"
+- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250430/ubuntu-24.10-server-cloudimg-arm64.img"
   arch: "aarch64"
-  digest: "sha256:ed3eb300e553f30b6d7ba5a18c9c654848e706e9701eb904e46a374f204d2e89"
-- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250502/ubuntu-24.10-server-cloudimg-riscv64.img"
+  digest: "sha256:89d6202dcb135b65128946363d00ecfae1646f2fd43116207b1bd99faa33626e"
+- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250430/ubuntu-24.10-server-cloudimg-riscv64.img"
   arch: "riscv64"
-  digest: "sha256:6879c1d7eefe03ac061647ea96d189608e5cfb18e9c2432bbb91dbc2c74913fc"
-- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250502/ubuntu-24.10-server-cloudimg-armhf.img"
+  digest: "sha256:379225eda5d3c206f39494fb2270def1f9ad135d1f5b618966a2b57d9a75d8a0"
+- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250430/ubuntu-24.10-server-cloudimg-armhf.img"
   arch: "armv7l"
-  digest: "sha256:248d6d6fbe0ac73448f7ec984db2ecfce89602767634d09b6d631e7fa3286047"
-- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250502/ubuntu-24.10-server-cloudimg-s390x.img"
+  digest: "sha256:63e13a3a4c246a4cce4930cc1c1b52da3a6f7c2be2badf5067ebe176b33da7db"
+- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250430/ubuntu-24.10-server-cloudimg-s390x.img"
   arch: "s390x"
-  digest: "sha256:84d6f5289747170a5b0e405e82fd947bafb9e40dfe0ac858ba4b81f8e5b61a2d"
-- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250502/ubuntu-24.10-server-cloudimg-ppc64el.img"
+  digest: "sha256:dea8034b9401a0946dda898ceb61129d8f0d41de162f7cf143bdcc4664d3e831"
+- location: "https://cloud-images.ubuntu.com/releases/oracular/release-20250430/ubuntu-24.10-server-cloudimg-ppc64el.img"
   arch: "ppc64le"
-  digest: "sha256:063768391a5f9353d1c2f24479f762f3e0abac35a86e9b93a77db03b519381e6"
+  digest: "sha256:ec15e530f9b594c59a81ccebea1af26d3a61b18a84bfda048e6913cef034c19c"
+
 # Fallback to the latest release image.
 # Hint: run `limactl prune` to invalidate the cache
 
diff --git a/website/content/en/docs/config/disk.md b/website/content/en/docs/config/disk.md
new file mode 100644
index 00000000..db687930
--- /dev/null
+++ b/website/content/en/docs/config/disk.md
@@ -0,0 +1,24 @@
+---
+title: Disks
+---
+
+This guide explains how to increase the disk size of a Lima VM running on macOS when you've run out of space, as well as how to edit the disk size using the `limactl` CLI.
+
+## Resize Disk Using limactl
+
+Starting with v1.1, Lima supports editing the disk size of an existing instance using the `--disk` flag with the `limactl edit` command.  
+This is the recommended and simplest way to resize your VM disk.
+
+```sh
+limactl edit <vm-name> --disk <new-size>
+```
+
+Example for 20GB:
+
+```sh
+limactl edit default --disk 20
+```
+
+> **Note:**  
+> - Increasing disk size is supported, but shrinking disks is not recommended.
+> - The instance may need to be stopped before editing disk size.


Test patch:
diff --git a/pkg/templatestore/templatestore.go b/pkg/templatestore/templatestore.go
index f91f2c44..4695aa97 100644
--- a/pkg/templatestore/templatestore.go
+++ b/pkg/templatestore/templatestore.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"unicode"
 
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/lima-vm/lima/pkg/store/dirnames"
 	"github.com/lima-vm/lima/pkg/usrlocalsharelima"
 )
@@ -41,16 +42,7 @@ func templatesPaths() ([]string, error) {
 	}, nil
 }
 
-// Read searches for template `name` in all template directories and returns the
-// contents of the first one found. Template names cannot contain the substring ".."
-// to make sure they don't reference files outside the template directories. We are
-// not using securejoin.SecureJoin because the actual template may be a symlink to a
-// directory elsewhere (e.g. when installed by Homebrew).
 func Read(name string) ([]byte, error) {
-	doubleDot := ".."
-	if strings.Contains(name, doubleDot) {
-		return nil, fmt.Errorf("template name %q must not contain %q", name, doubleDot)
-	}
 	paths, err := templatesPaths()
 	if err != nil {
 		return nil, err
@@ -62,8 +54,10 @@ func Read(name string) ([]byte, error) {
 		name += ".yaml"
 	}
 	for _, templatesDir := range paths {
-		// Normalize filePath for error messages because template names always use forward slashes
-		filePath := filepath.Clean(filepath.Join(templatesDir, name))
+		filePath, err := securejoin.SecureJoin(templatesDir, name)
+		if err != nil {
+			return nil, err
+		}
 		if b, err := os.ReadFile(filePath); !errors.Is(err, os.ErrNotExist) {
 			return b, err
 		}
@@ -73,10 +67,6 @@ func Read(name string) ([]byte, error) {
 
 const Default = "default"
 
-// Templates returns a list of Template structures containing the Name and Location for each template.
-// It searches all template directories, but only the first template of a given name is recorded.
-// Only non-hidden files with a ".yaml" file extension are considered templates.
-// The final result is sorted alphabetically by template name.
 func Templates() ([]Template, error) {
 	paths, err := templatesPaths()
 	if err != nil {