add filter option to list command #4187

olamilekan000 · 2025-10-12T20:07:38Z

change adds --filter option to list command for a user-friendly way to filter instances using yq expressions,
which is equivalent to yq options like --yq 'select(EXPR)'

Fixes

cmd/limactl/list.go

AkihiroSuda · 2025-10-12T23:35:58Z

cmd/limactl/list.go

 	}
+	if len(filter) != 0 {
+		for _, f := range filter {
+			yq = append(yq, "select("+f+")")


Needs escaping

I tested numerous escaping approaches as asked, but it breaks the yq expressions. What string escape approach would you recommend? Thanks @AkihiroSuda

@AkihiroSuda I don't see why this needs escaping. The filter expression should be inserted literally inside the select().

Without escaping the code looks vulnerable to "Bobby Tables".
Unlikely to result in breaking data in our case though

How is this different from any code you specify via --yq? The only difference is that the --filter argument is wrapped inside a select() call.

The user can literally send the same command via --yq "$(printf "select(%s)" "$FILTER")".

Any escaping would simply break the filter expression.

Second side note: I also didn't see any functionality in yq that would allow you to get a list of all environment variables. You have to know the variable name to query the value. Please let me know if I overlooked anything!

Clearing the env may cause an unexpected effect to the entire process, including the Go runtime.

Can't we just add a new option in the YQ library to prohibit accessing envs?

At least https://pkg.go.dev/github.com/mikefarah/yq/v4@v4.48.1/pkg/yqlib#ExpressionNode could be verified that there is no reference to env vars.

Clearing the env may cause an unexpected effect to the entire process, including the Go runtime.

All we do after clearing the environment is calling yqlib to evaluate the expression, printing the result with fmt.Fprint, and exiting the process. I can't see how anything would be affected in an unexpected way.

The fact that os.Getenv will always return the empty string inside yqlib is not unexpected, but desired.

I would be opposed to modifying the process environment for every yqlib call, but in limactl list and limactl info it would be acceptable when all that is left to do is evaluating an expression and printing the result.

Can't we just add a new option in the YQ library to prohibit accessing envs?

I don't know; there doesn't seem to be an easy way to pass settings to the env operator etc.

I agree that this would be a good enhancement (so we could make it apply to all our yqlib calls), but for limactl list it seems like overkill because I don't see an easy way to implement it.

@AkihiroSuda Are you ok with using os.Clearenv() in this particular case (limactl list, just before calling yqlib, printing the result, and exiting)?

I suspect @olamilekan000 is waiting for a decision before addressing the remaining issues, so this would be blocking it from being included in Lima 2.0.

cmd/limactl/list.go

jandubois

Needs changes (allow --filter with --yq) and simplifications.

cmd/limactl/list.go

jandubois · 2025-10-14T05:24:12Z

cmd/limactl/list.go

+		if len(yq) != 0 {
+			return errors.New("option --filter conflicts with option --yq")
+		}


I think you should be able to combine --filter and --yq as long as the output format is json or yaml.

So you could just drop the check here because yq is already incompatible with the other output formats.

This isn't too clear to me but is there anything wrong with the way it currently is?

Yes:

❯ l ls -l '.status == "Running"' NAME STATUS SSH VMTYPE ARCH CPUS MEMORY DISK DIR alpine-iso Running 127.0.0.1:50496 vz aarch64 4 4GiB 100GiB ~/.lima/alpine-iso ❯ l ls -l '.status == "Running"' --yq .name FATA[0000] option --filter conflicts with option --yq ❯ l ls --yq 'select(.status == "Running")' --yq .name alpine-iso

I expect the last 2 commands to work exactly the same. There is no reason for the len(yq) check to exist.

cmd/limactl/list.go

jandubois · 2025-10-14T05:26:39Z

cmd/limactl/list.go

 	}
+	if len(filter) != 0 {
+		for _, f := range filter {
+			yq = append(yq, "select("+f+")")


@AkihiroSuda I don't see why this needs escaping. The filter expression should be inserted literally inside the select().

cmd/limactl/list.go

jandubois · 2025-10-15T03:50:53Z

cmd/limactl/list.go

+	isGoTemplate := strings.HasPrefix(format, "{{") && strings.HasSuffix(format, "}}")
+	if len(filter) != 0 && (format == "table" || isGoTemplate) {


Suggested change

isGoTemplate := strings.HasPrefix(format, "{{") && strings.HasSuffix(format, "}}")

if len(filter) != 0 && (format == "table" || isGoTemplate) {

if len(filter) != 0 && format != "json" && format != "yaml") {

Despite what the --help output says, every string except table, json, and yaml is treated as a Go template, so the check for the double braces prefix/suffix is not correct:

❯ l ls -f 'Name is: {{.Name}}' Name is: alpine-iso Name is: alpine-lima-3.22.2 Name is: foo

jandubois · 2025-10-15T03:57:50Z

cmd/limactl/list.go

+	for _, instance := range instances {
+		jsonBytes, err := json.Marshal(instance)
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal instance %s: %w", instance.Name, err)


Suggested change

return nil, fmt.Errorf("failed to marshal instance %s: %w", instance.Name, err)

return nil, fmt.Errorf("failed to marshal instance %q: %w", instance.Name, err)

Always use %q when printing use input.

Also applies to the next error message.

AkihiroSuda

#4187 (comment)

Signed-off-by: olalekan odukoya <odukoyaonline@gmail.com>

AkihiroSuda · 2025-10-15T09:28:16Z

cmd/limactl/list.go

+                   Examples:
+                     --filter '.status == "Running"'
+                     --filter '.vmType == "vz"'
+                     --filter '.status == "Running"' --filter '.vmType == "vz"'


Is this AND-matching or OR-matching?

I assume you want the description updated to clarify.

It is AND so you can do this:

❯ cat ~/bin/limactl-ps #!/bin/sh limactl ls --filter 'select(.status == "Running")' "$@" ❯ l ls NAME STATUS SSH VMTYPE ARCH CPUS MEMORY DISK DIR alpine-iso Running 127.0.0.1:50496 vz aarch64 4 4GiB 100GiB ~/.lima/alpine-iso alpine-lima-3.22.2 Stopped 127.0.0.1:0 vz aarch64 4 4GiB 100GiB ~/.lima/alpine-lima-3.22.2 default Running 127.0.0.1:54512 qemu aarch64 4 4GiB 100GiB ~/.lima/default foo Stopped 127.0.0.1:0 vz aarch64 4 1.177MiB 100GiB ~/.lima/foo ❯ l ps NAME STATUS SSH VMTYPE ARCH CPUS MEMORY DISK DIR alpine-iso Running 127.0.0.1:50496 vz aarch64 4 4GiB 100GiB ~/.lima/alpine-iso default Running 127.0.0.1:54512 qemu aarch64 4 4GiB 100GiB ~/.lima/default ❯ l ps -l '.vmType == "vz"' NAME STATUS SSH VMTYPE ARCH CPUS MEMORY DISK DIR alpine-iso Running 127.0.0.1:50496 vz aarch64 4 4GiB 100GiB ~/.lima/alpine-iso

jandubois · 2025-10-15T16:24:24Z

cmd/limactl/list.go

+		if !valid.MatchString(f) {
+			return fmt.Errorf("unsafe characters in filter expression: %q", f)
+		}


I don't think this is useful. The whole point of --filter and --yq is to provide YQ expressions that are going to be evaluated. There is no vulnerability; the expression is provided by the user themselves.

And we already get an error when the YQ expression is invalid, e.g.

❯ l ls -l '.vmType ==' FATA[0000] failed to apply filter select(.vmType ==): '==' expects 2 args but there is 1

So I don't understand the purpose of this "validation", especially since it might make legitimate use cases invalid (e.g. you are restricting which characters are allowed inside literal strings).

jandubois

The combination of --filter and --quiet is not working (the filter is ignored):

❯ l ls -l '.vmType == "qemu"'
NAME       STATUS     SSH                VMTYPE    ARCH       CPUS    MEMORY    DISK      DIR
default    Running    127.0.0.1:54512    qemu      aarch64    4       4GiB      100GiB    ~/.lima/default

❯ l ls -l '.vmType == "qemu"' -q
alpine-iso
alpine-lima-3.22.2
default
foo

olamilekan000 force-pushed the add-filter-opttion-to-list-cmd branch 2 times, most recently from 4601c97 to c7631d4 Compare October 12, 2025 21:57

AkihiroSuda reviewed Oct 12, 2025

View reviewed changes

cmd/limactl/list.go Outdated Show resolved Hide resolved

AkihiroSuda reviewed Oct 12, 2025

View reviewed changes

cmd/limactl/list.go Show resolved Hide resolved

jandubois requested changes Oct 14, 2025

View reviewed changes

olamilekan000 force-pushed the add-filter-opttion-to-list-cmd branch 3 times, most recently from 404b08c to a5ba9ad Compare October 14, 2025 22:33

olamilekan000 requested a review from jandubois October 14, 2025 23:23

jandubois reviewed Oct 15, 2025

View reviewed changes

AkihiroSuda requested changes Oct 15, 2025

View reviewed changes

olamilekan000 force-pushed the add-filter-opttion-to-list-cmd branch 2 times, most recently from 224e6e4 to b3f18db Compare October 15, 2025 09:25

add filter option to list command

bdef056

Signed-off-by: olalekan odukoya <odukoyaonline@gmail.com>

olamilekan000 force-pushed the add-filter-opttion-to-list-cmd branch from b3f18db to bdef056 Compare October 15, 2025 09:26

AkihiroSuda added this to the v2.0.0 milestone Oct 15, 2025

AkihiroSuda reviewed Oct 15, 2025

View reviewed changes

jandubois reviewed Oct 15, 2025

View reviewed changes

jandubois requested changes Oct 15, 2025

View reviewed changes

		isGoTemplate := strings.HasPrefix(format, "{{") && strings.HasSuffix(format, "}}")
		if len(filter) != 0 && (format == "table" \|\| isGoTemplate) {

	isGoTemplate := strings.HasPrefix(format, "{{") && strings.HasSuffix(format, "}}")
	if len(filter) != 0 && (format == "table" \|\| isGoTemplate) {
	if len(filter) != 0 && format != "json" && format != "yaml") {

	return nil, fmt.Errorf("failed to marshal instance %s: %w", instance.Name, err)
	return nil, fmt.Errorf("failed to marshal instance %q: %w", instance.Name, err)

add filter option to list command #4187

Are you sure you want to change the base?

add filter option to list command #4187

Conversation

olamilekan000 commented Oct 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

olamilekan000 Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jandubois Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jandubois left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jandubois Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jandubois left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

olamilekan000 commented Oct 12, 2025 •

edited

Loading

olamilekan000 Oct 13, 2025 •

edited

Loading

AkihiroSuda Oct 17, 2025 •

edited

Loading

jandubois Oct 17, 2025 •

edited

Loading

jandubois Oct 15, 2025 •

edited

Loading