diff --git a/pkg/container/lima.yaml b/pkg/container/lima.yaml
index 259d70c41..08e387dab 100644
--- a/pkg/container/lima.yaml
+++ b/pkg/container/lima.yaml
@@ -24,6 +24,6 @@ provision:
   script: |
     rm -f $HOME/containerd.sock
     ln -s /proc/$(cat $XDG_RUNTIME_DIR/containerd-rootless/child_pid)/root/run/containerd/containerd.sock ${HOME}/containerd.sock
- - mode: system
-   script: |
-     chmod 0755 /etc/cni
+- mode: system
+  script: |
+    chmod 0755 /etc/cni
diff --git a/pkg/container/lima_runner.go b/pkg/container/lima_runner.go
index 7e9f8b18d..292222dbe 100644
--- a/pkg/container/lima_runner.go
+++ b/pkg/container/lima_runner.go
@@ -256,8 +256,15 @@ func (l *lima) terminateVM(ctx context.Context, cfg *Config) error {
 
 func (l *lima) WorkspaceTar(ctx context.Context, cfg *Config) (io.ReadCloser, error) {
 	pr, pw := io.Pipe()
-	err := l.nerdctl(ctx, melangeVMName, nil, pw, nil, "exec", "-i", "tar", "cf", "-", "-C", runnerWorkdir, "melange-out")
-	return pr, err
+	go func() {
+		defer pw.Close()
+
+		if err := l.nerdctl(ctx, melangeVMName, nil, pw, nil, "exec", "-i", cfg.PodID, "tar", "cf", "-", "-C", runnerWorkdir, "melange-out"); err != nil {
+			pw.CloseWithError(fmt.Errorf("failed to tar workspace: %w", err))
+		}
+	}()
+
+	return pr, nil
 }
 
 // these private functions handle some reusable code to avoid duplication.
@@ -333,7 +340,7 @@ func (l *lima) start(ctx context.Context, name string, exists bool) error {
 
 	if !exists {
 		buf = bytes.NewReader(config)
-		args = append(args, "/dev/stdin")
+		args = append(args, "-")
 	}
 	return l.limactl(ctx, buf, nil, nil, args...)
 }