Data and isolation

Host isolation

Weave mounts no host directories by default. Pass one or more existing directories after --mount to create or start to expose only those directories. Mounts are read-only unless a directory has Lima's :w suffix:

weave create dev --mount ./src ./config ./tmp:w

Every create or start replaces the previous mount set. Omitting --mount removes all mounts, protecting host files from commands intended to run only inside a disposable environment.

Isolated copies

Copy one or more host files onto the VM's own disk:

weave cp dev ./package.json ./src/index.ts --o /dev

The VM can modify or remove these copies without changing the original host files. Omit --o to copy to the guest user's home directory (~). Weave creates a missing destination directory and can write to protected guest paths using guest-side elevated permissions.

Guest persistence

Stopping a VM does not remove its virtual disk. Its files remain available when the VM is restarted:

weave stop dev
weave create dev

The restarted VM receives a new TTL. Use weave kill dev when you want to remove the disk and its data permanently.

Network access

Guest application ports are denied by default. Explicitly publish a TCP port to parent localhost with a Docker-style mapping:

weave port add dev 8080:3000

This makes guest port 3000 available at 127.0.0.1:8080 on the parent. Add multiple mappings by running port add again, inspect them with weave port ls dev, and remove a mapping with weave port remove dev 8080.

Port mappings persist independently of VM state. Changing them on a running VM briefly restarts it while preserving its original TTL expiry.

This policy restricts inbound parent-to-guest application access. Guests retain outbound network access, including DNS and internet access, even when host mounts are disabled.

Weave data directory

Weave keeps its bundled Lima runtime, templates, and VM state separate from any system Lima installation:

macOS and Linux: ~/weave
Windows: %APPDATA%\weave