Lima v2.0: expanding the focus to hardening AI#

Akihiro Suda (NTT)

• Why: Interesting signal for agentic-workload isolation: Lima (now a CNCF incubating project) repositioned around sandboxing AI coding agents in VMs — a stronger boundary than the deprecated sandbox-exec approaches agents ship with.
• What: Lima v2.0 (Nov 2025): plugin infrastructure (VM driver, CLI, URL-schema plugins), GPU acceleration via the krunkit driver (virtio-GPU → MoltenVK/Metal on Apple silicon, e.g. for llama.cpp), an MCP server exposing sandboxed tools (list_directory, read_file, run_shell_command) to host-side agents, and CLI improvements.
• How: Agents run inside the VM with only the working directory mounted read-write; alternatively host-side agents connect through Lima's MCP server, whose tools are strongly sandboxed by the VM boundary. v2.1 (ETA March 2026) adds "sync mode": synced directories are written back only after explicit user confirmation, preventing "Sorry I removed everything including .git dir" incidents.
• Where applicable: Developer-workstation AI-agent isolation. It's a VM-per-agent hammer, not a production workload-identity answer — but the MCP-server pattern (sandboxed tool exposure to agents) is a model worth watching for anyone working on agentic identity and access.