diff --git a/cmd/limactl/shell.go b/cmd/limactl/shell.go
index 563322a83e1..63dd28ca681 100644
--- a/cmd/limactl/shell.go
+++ b/cmd/limactl/shell.go
@@ -55,30 +55,38 @@ func shellAction(clicontext *cli.Context) error {
 		return err
 	}
 
-	// Buildup changeDirCmd to "cd workDir || cd currentDir || cd homeDir"
+	// When workDir is explicitly set, the shell MUST have workDir as the cwd, or exit with an error.
+	//
+	// changeDirCmd := "cd workDir || exit 1"                  if workDir != ""
+	//              := "cd hostCurrentDir || cd hostHomeDir"   if workDir == ""
 	var changeDirCmd string
-	workDir := clicontext.String("workdir")
-	if workDir == "" {
-		changeDirCmd = "false"
-	} else {
-		changeDirCmd = fmt.Sprintf("cd %q", workDir)
-	}
-	if len(y.Mounts) > 0 {
-		currentDir, err := os.Getwd()
+	if workDir := clicontext.String("workdir"); workDir != "" {
+		changeDirCmd = fmt.Sprintf("cd %q || exit 1", workDir)
+		// FIXME: check whether y.Mounts contains the home, not just len > 0
+	} else if len(y.Mounts) > 0 {
+		hostCurrentDir, err := os.Getwd()
 		if err == nil {
-			changeDirCmd = fmt.Sprintf("%s || cd %q", changeDirCmd, currentDir)
+			changeDirCmd = fmt.Sprintf("cd %q", hostCurrentDir)
 		} else {
+			changeDirCmd = "false"
 			logrus.WithError(err).Warn("failed to get the current directory")
 		}
-		homeDir, err := os.UserHomeDir()
+		hostHomeDir, err := os.UserHomeDir()
 		if err == nil {
-			changeDirCmd = fmt.Sprintf("%s || cd %q", changeDirCmd, homeDir)
+			changeDirCmd = fmt.Sprintf("%s || cd %q", changeDirCmd, hostHomeDir)
 		} else {
 			logrus.WithError(err).Warn("failed to get the home directory")
 		}
+	} else {
+		logrus.Debug("the host home does not seem mounted, so the guest shell will have a different cwd")
+	}
+
+	if changeDirCmd == "" {
+		changeDirCmd = "false"
 	}
+	logrus.Debugf("changeDirCmd=%q", changeDirCmd)
 
-	script := fmt.Sprintf(" %s ; exec bash --login", changeDirCmd)
+	script := fmt.Sprintf("%s ; exec bash --login", changeDirCmd)
 	if clicontext.NArg() > 1 {
 		script += fmt.Sprintf(" -c %q", shellescape.QuoteCommand(clicontext.Args().Tail()))
 	}
diff --git a/examples/k3s.yaml b/examples/k3s.yaml
index c091106a2f9..f9c103aa172 100644
--- a/examples/k3s.yaml
+++ b/examples/k3s.yaml
@@ -10,14 +10,16 @@
 # lima-k3s   Ready    control-plane,master   69s   v1.21.1+k3s1
 
 images:
-- location: "~/Downloads/hirsute-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/hirsute/current/hirsute-server-cloudimg-amd64.img"
   arch: "x86_64"
 
+# Mounts are disabled in this example, but can be enabled optionally.
 mounts: []
 
 ssh:
   localPort: 60022
 
+# containerd is managed by k3s, not by Lima, so the values are set to false here.
 containerd:
   system: false
   user: false
@@ -38,5 +40,5 @@ probes:
     fi
   hint: |
     The k3s kubeconfig file has not yet been created.
-    Run "lima bash sudo journalctl -u k3s" to check the log.
+    Run "limactl shell k3s sudo journalctl -u k3s" to check the log.
     If that is still empty, check the bottom of the log at "/var/log/cloud-init-output.log".
diff --git a/pkg/cidata/user-data.TEMPLATE b/pkg/cidata/user-data.TEMPLATE
index 584c6c9b4b5..614d01943df 100644
--- a/pkg/cidata/user-data.TEMPLATE
+++ b/pkg/cidata/user-data.TEMPLATE
@@ -103,24 +103,31 @@ write_files:
       if [ ! -x /usr/local/bin/nerdctl ]; then
         version="0.8.3"
         goarch="amd64"
-        if [ "$(uname -m )" = "aarch64 "]; then
+        if [ "$(uname -m )" = "aarch64" ]; then
           goarch="arm64"
         fi
         curl -fsSL https://github.com/containerd/nerdctl/releases/download/v${version}/nerdctl-full-${version}-linux-${goarch}.tar.gz | tar Cxz /usr/local
       fi
       {{- if .Containerd.System}}
-      systemctl enable containerd
-      systemctl start containerd
+      cat >"/etc/containerd/config.toml" <<EOF
+        version = 2
+        [proxy_plugins]
+          [proxy_plugins."stargz"]
+            type = "snapshot"
+            address = "/run/containerd-stargz-grpc/containerd-stargz-grpc.sock"
+      EOF
+      systemctl enable --now containerd buildkit stargz-snapshotter
       {{- end}}
       {{- if .Containerd.User}}
       modprobe tap || true
       if [ ! -e "/home/{{.User}}.linux/.config/containerd/config.toml" ]; then
         mkdir -p "/home/{{.User}}.linux/.config/containerd"
         cat >"/home/{{.User}}.linux/.config/containerd/config.toml" <<EOF
+        version = 2
         [proxy_plugins]
           [proxy_plugins."stargz"]
-                type = "snapshot"
-        address = "/run/user/{{.UID}}/containerd-stargz-grpc/containerd-stargz-grpc.sock"
+            type = "snapshot"
+            address = "/run/user/{{.UID}}/containerd-stargz-grpc/containerd-stargz-grpc.sock"
       EOF
         chown -R "{{.User}}" "/home/{{.User}}.linux/.config"
       fi
diff --git a/pkg/limayaml/default.TEMPLATE.yaml b/pkg/limayaml/default.TEMPLATE.yaml
index 39c0fbb6880..8035b6fb573 100644
--- a/pkg/limayaml/default.TEMPLATE.yaml
+++ b/pkg/limayaml/default.TEMPLATE.yaml
@@ -59,10 +59,10 @@ video:
   display: "none"
 
 containerd:
-  # Enable system-wide containerd (systemctl enable containerd)
+  # Enable system-wide (aka rootful)  containerd and its dependencies (BuildKit, Stargz Snapshotter)
   # Default: false
   system: false
-  # Enable user-scoped containerd (systemctl --user enable containerd)
+  # Enable user-scoped (aka rootless) containerd and its dependencies
   # Default: true
   user: true