runtime: teach Go config loader about debug_console_shell for exec

kata-runtime exec loads the runtime TOML (including config.d drop-ins)
through the Go katautils config path before dialing the guest debug
console. Drop-ins such as 20-debug.toml set agent.kata.debug_console_shell
for runtime-rs NVIDIA profiles; without this field the loader failed while
merging drop-ins and exec never reached the vsock connection.

Plumb debug_console_shell through to KataAgentConfig and emit
agent.debug_console_shell on the kernel command line when creating
sandboxes via the Go runtime path. Runtime-rs already handles the same
key via kata-types; this commit is for hosts that invoke kata-runtime
exec against runtime-rs shims using the shared drop-in layout.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>

src/runtime/pkg/katautils/config.go

@@ -233,6 +233,7 @@ type agent struct {
 	Debug                bool     `toml:"enable_debug"`
 	Tracing              bool     `toml:"enable_tracing"`
 	DebugConsoleEnabled  bool     `toml:"debug_console_enabled"`
+	DebugConsoleShell    string   `toml:"debug_console_shell"`
 	DialTimeout          uint32   `toml:"dial_timeout"`
 	CdhApiTimeout        uint32   `toml:"cdh_api_timeout"`
 	LaunchProcessTimeout uint32   `toml:"launch_process_timeout"`
@@ -797,6 +798,10 @@ func (a agent) debugConsoleEnabled() bool {
 	return a.DebugConsoleEnabled
 }
 
+func (a agent) debugConsoleShell() string {
+	return a.DebugConsoleShell
+}
+
 func (a agent) dialTimout() uint32 {
 	return a.DialTimeout
 }
@@ -1534,6 +1539,7 @@ func updateRuntimeConfigAgent(configPath string, tomlConf tomlConfig, config *oc
 			Trace:                agent.trace(),
 			KernelModules:        agent.kernelModules(),
 			EnableDebugConsole:   agent.debugConsoleEnabled(),
+			DebugConsoleShell:    agent.debugConsoleShell(),
 			DialTimeout:          agent.dialTimout(),
 			CdhApiTimeout:        agent.cdhApiTimout(),
 			LaunchProcessTimeout: agent.launchProcessTimeout(),

src/runtime/pkg/katautils/config_test.go

@@ -1841,6 +1841,36 @@ vfio_mode="vfio"
 	assert.Equal(t, config.Runtime.VfioMode, "vfio")
 }
 
+func TestLoadDropInAgentDebugConsoleShell(t *testing.T) {
+	tmpdir := t.TempDir()
+
+	configPath := path.Join(tmpdir, "runtime.toml")
+	err := createConfig(configPath, `
+[hypervisor.qemu]
+path = "/usr/bin/qemu-kvm"
+[runtime]
+hypervisor_name = "qemu"
+agent_name = "kata"
+`)
+	assert.NoError(t, err)
+
+	dropInDir := path.Join(tmpdir, "config.d")
+	err = os.Mkdir(dropInDir, os.FileMode(0777))
+	assert.NoError(t, err)
+
+	err = createConfig(path.Join(dropInDir, "20-debug.toml"), `
+[agent.kata]
+debug_console_enabled = true
+debug_console_shell = "/run/kata-extensions/devkit/bin/sh"
+`)
+	assert.NoError(t, err)
+
+	_, runtimeConfig, err := LoadConfiguration(configPath, true)
+	assert.NoError(t, err)
+	assert.True(t, runtimeConfig.AgentConfig.EnableDebugConsole)
+	assert.Equal(t, "/run/kata-extensions/devkit/bin/sh", runtimeConfig.AgentConfig.DebugConsoleShell)
+}
+
 func TestUpdateRuntimeConfigHypervisor(t *testing.T) {
 	assert := assert.New(t)
 

src/runtime/virtcontainers/kata_agent.go

@@ -95,6 +95,7 @@ const (
 	kernelParamDebugConsole           = "agent.debug_console"
 	kernelParamDebugConsoleVPort      = "agent.debug_console_vport"
 	kernelParamDebugConsoleVPortValue = "1026"
+	kernelParamDebugConsoleShell      = "agent.debug_console_shell"
 
 	// Default SELinux type applied to the container process inside guest
 	defaultSeLinuxContainerType = "container_t"
@@ -309,6 +310,7 @@ type KataAgentConfig struct {
 	Debug                bool
 	Trace                bool
 	EnableDebugConsole   bool
+	DebugConsoleShell    string
 	VisibleCdiDevices    bool
 	Policy               string
 }
@@ -371,6 +373,10 @@ func KataAgentKernelParams(config KataAgentConfig) []Param {
 		params = append(params, Param{Key: kernelParamDebugConsoleVPort, Value: kernelParamDebugConsoleVPortValue})
 	}
 
+	if config.DebugConsoleShell != "" {
+		params = append(params, Param{Key: kernelParamDebugConsoleShell, Value: config.DebugConsoleShell})
+	}
+
 	if config.CdhApiTimeout > 0 {
 		cdhApiTimeout := strconv.FormatUint(uint64(config.CdhApiTimeout), 10)
 		params = append(params, Param{Key: vcAnnotations.CdhApiTimeoutKernelParam, Value: cdhApiTimeout})

src/runtime/virtcontainers/kata_agent_test.go

@@ -1131,6 +1131,7 @@ func TestKataAgentKernelParams(t *testing.T) {
 		containerPipeSize    uint32
 		launchProcessTimeout uint32
 		visibleCdiDevices    bool
+		debugConsoleShell    string
 		expectedParams       []Param
 	}
 
@@ -1140,6 +1141,7 @@ func TestKataAgentKernelParams(t *testing.T) {
 	containerPipeSizeParam := Param{Key: vcAnnotations.ContainerPipeSizeKernelParam, Value: "2097152"}
 	launchProcessTimeoutParam := Param{Key: vcAnnotations.LaunchProcessTimeoutKernelParam, Value: "60"}
 	visibleCdiDevicesParam := Param{Key: "agent.visible_cdi_devices", Value: "true"}
+	debugConsoleShellParam := Param{Key: "agent.debug_console_shell", Value: "/run/kata-extensions/devkit/bin/sh"}
 
 	data := []testData{
 		{name: "no options", expectedParams: []Param{}},
@@ -1163,6 +1165,8 @@ func TestKataAgentKernelParams(t *testing.T) {
 		{name: "debug and launch process timeout", debug: true, launchProcessTimeout: 60, expectedParams: []Param{debugParam, launchProcessTimeoutParam}},
 
 		{name: "visible cdi devices", visibleCdiDevices: true, expectedParams: []Param{visibleCdiDevicesParam}},
+
+		{name: "debug console shell", debugConsoleShell: "/run/kata-extensions/devkit/bin/sh", expectedParams: []Param{debugConsoleShellParam}},
 	}
 
 	for _, d := range data {
@@ -1175,6 +1179,7 @@ func TestKataAgentKernelParams(t *testing.T) {
 				ContainerPipeSize:    d.containerPipeSize,
 				LaunchProcessTimeout: d.launchProcessTimeout,
 				VisibleCdiDevices:    d.visibleCdiDevices,
+				DebugConsoleShell:    d.debugConsoleShell,
 			}
 
 			params := KataAgentKernelParams(config)