From 4747bf4dab7852c05cf31f9db86dc04cdce8b836 Mon Sep 17 00:00:00 2001
From: Manuel Huber <manuelh@nvidia.com>
Date: Sat, 18 Jul 2026 11:29:09 +0200
Subject: [PATCH] nvidia/runtime-rs: use block-plain emptyDir
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set the non-confidential NVIDIA runtime-rs emptyDir mode to
block-plain through a dedicated Makefile default.

This prepares the runtime class for configurations where filesystem
sharing is disabled and emptyDir volumes need to be backed by
guest-mounted block devices instead of shared-fs.

Also add the shared configure_nvidia_runtime_rs_shared_fs_dropin()
test helper, which keeps the NVIDIA runtime-rs Docker/nerdctl smoke
tests on virtio-fs while the shared_fs=none + EROFS snapshotter path
is exercised by Kubernetes CI.

Signed-off-by: Manuel Huber <manuelh@nvidia.com>
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: OpenAI Codex <codex@openai.com>
---
 src/runtime-rs/Makefile |  2 ++
 tests/common.bash       | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/src/runtime-rs/Makefile b/src/runtime-rs/Makefile
index 613b85bd79..6bd8f71138 100644
--- a/src/runtime-rs/Makefile
+++ b/src/runtime-rs/Makefile
@@ -204,6 +204,7 @@ DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"kernel_params\", \"kernel_veri
 DEFDISABLEGUESTSECCOMP := true
 DEFEMPTYDIRMODE := shared-fs
 DEFEMPTYDIRMODE_COCO := block-encrypted
+DEFEMPTYDIRMODE_NV := block-plain
 ##VAR DEFAULTEXPFEATURES=[features] Default experimental features enabled
 DEFAULTEXPFEATURES := []
 DEFDISABLESELINUX := false
@@ -751,6 +752,7 @@ USER_VARS += DEFNETWORKMODEL_QEMU
 USER_VARS += DEFNETWORKMODEL_FC
 USER_VARS += DEFEMPTYDIRMODE
 USER_VARS += DEFEMPTYDIRMODE_COCO
+USER_VARS += DEFEMPTYDIRMODE_NV
 USER_VARS += DEFDISABLEGUESTSECCOMP
 USER_VARS += DEFDISABLESELINUX
 USER_VARS += DEFDISABLEGUESTSELINUX
diff --git a/tests/common.bash b/tests/common.bash
index 36f15a72a6..708cbc7ae0 100644
--- a/tests/common.bash
+++ b/tests/common.bash
@@ -807,6 +807,31 @@ function enabling_hypervisor() {
 	export KATA_CONFIG_PATH="${DEST_KATA_CONFIG}"
 }
 
+# Docker and nerdctl smoke tests exercise Kata through the default overlayfs
+# snapshotter path. Keep NVIDIA runtime-rs on virtio-fs for those tests; the
+# shared_fs=none + EROFS snapshotter path is covered by Kubernetes CI instead.
+function configure_nvidia_runtime_rs_shared_fs_dropin() {
+	case "${KATA_HYPERVISOR:-}" in
+		qemu-nvidia-cpu-runtime-rs) ;;
+		*) return 0 ;;
+	esac
+
+	local -r cfg="${KATA_CONFIG_PATH:-}"
+	[[ -z "${cfg}" || ! -e "${cfg}" ]] && return 0
+
+	local -r dropin_dir="$(dirname "${cfg}")/config.d"
+	local -r dropin_path="${dropin_dir}/99-nvidia-runtime-rs-shared-fs.toml"
+
+	info "Configuring NVIDIA runtime-rs shared-fs smoke test via ${dropin_path}"
+	sudo mkdir -p "${dropin_dir}"
+	sudo tee "${dropin_path}" >/dev/null <<EOF
+[hypervisor.qemu]
+shared_fs = "virtio-fs"
+
+[runtime]
+emptydir_mode = "shared-fs"
+EOF
+}
 
 function check_containerd_config_for_kata() {
 	declare -r containerd_path="/etc/containerd/config.toml"