Lima Ubuntu VM setup on Mac

Homebrew

https://gitee.com/cunkai/HomebrewCN/blob/master/error.md

Installation

/bin/zsh -c "$(curl -fsSL https://gitee.com/cunkai/HomebrewCN/raw/master/Homebrew.sh)"

Uninstallation

/bin/zsh -c "$(curl -fsSL https://gitee.com/cunkai/HomebrewCN/raw/master/HomebrewUninstall.sh)"

Lima

Lima launches Linux virtual machines with automatic file sharing and port forwarding (similar to WSL2).

# Install
brew install lima

# Create VM
limactl create --cpus=8 --memory=8 --name=default template://ubuntu
limactl list

# Start && Enter
limactl start default
limactl shell default


# Stop
limactl stop default
# Delete
limactl delete default
# Protect && Unprotect
limactl protect default
limactl unprotect default

# Copy
# Host -> VM
limactl cp ~/Downloads/test.png default:/tmp
# VM -> Host
limactl cp default:/tmp/test.png ~/Downloads

Port Fowarding(SSH)

eg. Forward traffic from 0.0.0.0:2222 to 127.0.0.1:60022

1. Local Port Forwarding on the Same Machine

# socat
brew install socat
socat TCP-LISTEN:2222,bind=0.0.0.0,reuseaddr,fork TCP:127.0.0.1:60022

2. Remote Port Forwarding via SSH

Access a service on the remote server that’s only bound to 127.0.0.1 (not exposed to the internet).

ssh -N -L 2222:127.0.0.1:60022 user@remote-server

• -N: Tells SSH not to execute any remote commands (no shell session; just port forwarding).
• -L 2222:127.0.0.1:60022: Sets up local port forwarding:
  • Local Port: 2222 (on your machine).
  • Remote Target: 127.0.0.1:60022 (a service running on the remote server’s localhost, accessible only from the server itself).

When you connect to localhost:2222 on your machine, the traffic is encrypted and sent through the SSH tunnel to 127.0.0.1:60022 on the remote server.

3. Firewall Rules (Linux/macOS)

For advanced setups, use firewall rules to forward traffic:

Linux (iptables):

sudo iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to-destination 127.0.0.1:60022
sudo iptables -t nat -A OUTPUT -p tcp --dport 2222 -j DNAT --to-destination 127.0.0.1:60022

macOS (pfctl):

Edit /etc/pf.conf and Apply the rules:

rdr pass on en0 proto tcp from any to any port 2222 -> 127.0.0.1 port 60022
# Replace en0 with your network interface.

sudo pfctl -f /etc/pf.conf
sudo pfctl -e

VS Code Remote SSH

1. copy ~/.lima/_config/user on Mac to ~/.ssh/lima-user on local machine
2. chmod 600 ~/.ssh/lima-user

Host lima-default
  IdentityFile "/home/haco/.ssh/lima-user"
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
  NoHostAuthenticationForLocalhost yes
  GSSAPIAuthentication no
  PreferredAuthentications publickey
  Compression no
  BatchMode yes
  IdentitiesOnly yes
  Ciphers "^aes128-gcm@openssh.com,aes256-gcm@openssh.com"
  User haco
  # ControlMaster auto
  # ControlPath "/Users/haco/.lima/default/ssh.sock"
  # ControlPersist yes
  Hostname 127.0.0.1
  Port 2222