diff --git a/src/runtime-rs/.gitignore b/src/runtime-rs/.gitignore
index 82cc0b64ca..0e5a39c11f 100644
--- a/src/runtime-rs/.gitignore
+++ b/src/runtime-rs/.gitignore
@@ -1,2 +1,3 @@
 target
 crates/shim/src/config.rs
+/config/*.toml
diff --git a/src/runtime-rs/Makefile b/src/runtime-rs/Makefile
index 5585e844a4..e923ad8c71 100644
--- a/src/runtime-rs/Makefile
+++ b/src/runtime-rs/Makefile
@@ -8,14 +8,252 @@
 # Use the following format:
 # '##VAR VARIABLE_NAME: help about variable'
 # '##TARGET TARGET_NAME: help about target'
-
+PROJECT_TYPE = kata
 PROJECT_NAME = Kata Containers
+PROJECT_TAG = kata-containers
 PROJECT_URL = https://github.com/kata-containers
 PROJECT_COMPONENT = containerd-shim-kata-v2
 CONTAINERD_RUNTIME_NAME = io.containerd.kata.v2
 
+include ../../utils.mk
+
+ARCH_DIR = arch
+ARCH_FILE_SUFFIX = -options.mk
+ARCH_FILE = $(ARCH_DIR)/$(ARCH)$(ARCH_FILE_SUFFIX)
+
+ifeq (,$(realpath $(ARCH_FILE)))
+    $(error "ERROR: invalid architecture: '$(ARCH)'")
+else
+    # Load architecture-dependent settings
+    include $(ARCH_FILE)
+endif
+
+ifeq ($(PREFIX),)
+    PREFIX := /usr
+endif
+
+PREFIXDEPS    := $(PREFIX)
+DBBINDIR    := $(PREFIXDEPS)/bin
+LIBEXECDIR := $(PREFIXDEPS)/libexec
+SHAREDIR := $(PREFIX)/share
+DEFAULTSDIR := $(SHAREDIR)/defaults
+PROJECT_DIR = $(PROJECT_TAG)
+IMAGENAME = $(PROJECT_TAG).img
 TARGET = $(PROJECT_COMPONENT)
 
+CONFIG_FILE = configuration.toml
+HYPERVISOR_DB = dragonball
+
+
+DEFAULT_HYPERVISOR ?= $(HYPERVISOR_DB)
+
+HYPERVISORS := $(HYPERVISOR_DB)
+
+DBPATH := $(DBBINDIR)/$(QEMUCMD)
+DBVALIDHYPERVISORPATHS := [\"$(DBPATH)\"]
+
+PKGDATADIR := $(PREFIXDEPS)/share/$(PROJECT_DIR)
+KERNELDIR := $(PKGDATADIR)
+IMAGEPATH := $(PKGDATADIR)/$(IMAGENAME)
+FIRMWAREPATH :=
+FIRMWAREVOLUMEPATH :=
+
+# Default number of vCPUs
+DEFVCPUS := 1
+# Default maximum number of vCPUs
+DEFMAXVCPUS := 0
+# Default memory size in MiB
+DEFMEMSZ := 2048
+# Default memory slots
+# Cases to consider :
+# - nvdimm rootfs image
+# - preallocated memory
+# - vm template memory
+# - hugepage memory
+DEFMEMSLOTS := 10
+#Default number of bridges
+DEFBRIDGES := 1
+DEFENABLEANNOTATIONS := []
+DEFDISABLEGUESTSECCOMP := true
+DEFDISABLEGUESTEMPTYDIR := false
+#Default experimental features enabled
+DEFAULTEXPFEATURES := []
+DEFDISABLESELINUX := false
+#Default entropy source
+DEFENTROPYSOURCE := /dev/urandom
+DEFVALIDENTROPYSOURCES := [\"/dev/urandom\",\"/dev/random\",\"\"]
+DEFDISABLEBLOCK := false
+DEFSHAREDFS_CLH_VIRTIOFS := virtio-fs
+DEFSHAREDFS_QEMU_VIRTIOFS := virtio-fs
+DEFVIRTIOFSDAEMON := $(LIBEXECDIR)/kata-qemu/virtiofsd
+ifeq ($(ARCH),x86_64)
+DEFVIRTIOFSDAEMON := $(LIBEXECDIR)/virtiofsd
+endif
+DEFVALIDVIRTIOFSDAEMONPATHS := [\"$(DEFVIRTIOFSDAEMON)\"]
+# Default DAX mapping cache size in MiB
+#if value is 0, DAX is not enabled
+DEFVIRTIOFSCACHESIZE ?= 0
+DEFVIRTIOFSCACHE ?= auto
+# Format example:
+#   [\"-o\", \"arg1=xxx,arg2\", \"-o\", \"hello world\", \"--arg3=yyy\"]
+#
+# see `virtiofsd -h` for possible options.
+# Make sure you quote args.
+DEFVIRTIOFSEXTRAARGS ?= [\"--thread-pool-size=1\", \"-o\", \"announce_submounts\"]
+DEFENABLEIOTHREADS := false
+DEFENABLEVHOSTUSERSTORE := false
+DEFVHOSTUSERSTOREPATH := $(PKGRUNDIR)/vhost-user
+DEFVALIDVHOSTUSERSTOREPATHS := [\"$(DEFVHOSTUSERSTOREPATH)\"]
+DEFFILEMEMBACKEND := ""
+DEFVALIDFILEMEMBACKENDS := [\"$(DEFFILEMEMBACKEND)\"]
+DEFMSIZE9P := 8192
+DEFVFIOMODE := guest-kernel
+# Default cgroup model
+DEFSANDBOXCGROUPONLY ?= false
+DEFSTATICRESOURCEMGMT ?= false
+DEFBINDMOUNTS := []
+SED = sed
+CLI_DIR = cmd
+SHIMV2 = containerd-shim-kata-v2
+SHIMV2_OUTPUT = $(CURDIR)/$(SHIMV2)
+SHIMV2_DIR = $(CLI_DIR)/$(SHIMV2)
+MONITOR = kata-monitor
+MONITOR_OUTPUT = $(CURDIR)/$(MONITOR)
+MONITOR_DIR = $(CLI_DIR)/kata-monitor
+SOURCES := $(shell find . 2>&1 | grep -E '.*\.(c|h|go)$$')
+VERSION := ${shell cat ./VERSION}
+# List of configuration files to build and install
+CONFIGS =
+CONFIG_PATHS =
+SYSCONFIG_PATHS =
+# List of hypervisors known for the current architecture
+KNOWN_HYPERVISORS =
+# List of hypervisors known for the current architecture
+KNOWN_HYPERVISORS =
+
+CONFDIR := $(DEFAULTSDIR)/$(PROJECT_DIR)
+SYSCONFDIR := $(SYSCONFDIR)/$(PROJECT_DIR)
+# Main configuration file location for stateless systems
+CONFIG_PATH := $(abspath $(CONFDIR)/$(CONFIG_FILE))
+# Secondary configuration file location. Note that this takes precedence
+# over CONFIG_PATH.
+SYSCONFIG := $(abspath $(SYSCONFDIR)/$(CONFIG_FILE))
+SHAREDIR := $(SHAREDIR)
+
+ifneq (,$(DBCMD))
+    KNOWN_HYPERVISORS += $(HYPERVISOR_DB)
+    CONFIG_FILE_DB = configuration-dragonball.toml
+    CONFIG_DB = config/$(CONFIG_FILE_DB)
+    CONFIG_DB_IN = $(CONFIG_DB).in
+    CONFIG_PATH_DB = $(abspath $(CONFDIR)/$(CONFIG_FILE_DB))
+    CONFIG_PATHS += $(CONFIG_PATH_DB)
+    SYSCONFIG_DB = $(abspath $(SYSCONFDIR)/$(CONFIG_FILE_DB))
+    SYSCONFIG_PATHS += $(SYSCONFIG_DB)
+    CONFIGS += $(CONFIG_DB)
+    # dragonball-specific options (all should be suffixed by "_dragonball")
+    DEFMAXVCPUS_DB := 1
+    DEFBLOCKSTORAGEDRIVER_DB := virtio-blk
+    DEFNETWORKMODEL_DB := tcfilter
+    KERNELPARAMS = console=ttyS1 agent.log_vport=1025
+	KERNELTYPE_DB = uncompressed
+    KERNEL_NAME_DB = $(call MAKE_KERNEL_NAME,$(KERNELTYPE_DB))
+    KERNELPATH_DB = $(KERNELDIR)/$(KERNEL_NAME_DB)
+    DEFSANDBOXCGROUPONLY = true
+    RUNTIMENAME := virt_container
+    PIPESIZE := 1
+	DBSHAREDFS := inline-virtio-fs
+endif
+
+ifeq ($(DEFAULT_HYPERVISOR),$(HYPERVISOR_DB))
+    DEFAULT_HYPERVISOR_CONFIG = $(CONFIG_FILE_DB)
+endif
+# list of variables the user may wish to override
+USER_VARS += ARCH
+USER_VARS += BINDIR
+USER_VARS += CONFIG_DB_IN
+USER_VARS += CONFIG_PATH
+USER_VARS += DESTDIR
+USER_VARS += DEFAULT_HYPERVISOR
+USER_VARS += DBCMD
+USER_VARS += DBCTLCMD
+USER_VARS += DBPATH
+USER_VARS += DBVALIDHYPERVISORPATHS
+USER_VARS += DBCTLPATH
+USER_VARS += DBVALIDCTLPATHS
+USER_VARS += SYSCONFIG
+USER_VARS += IMAGENAME
+USER_VARS += IMAGEPATH
+USER_VARS += MACHINETYPE
+USER_VARS += KERNELDIR
+USER_VARS += KERNELTYPE
+USER_VARS += KERNELPATH_DB
+USER_VARS += KERNELPATH
+USER_VARS += KERNELVIRTIOFSPATH
+USER_VARS += FIRMWAREPATH
+USER_VARS += FIRMWAREVOLUMEPATH
+USER_VARS += MACHINEACCELERATORS
+USER_VARS += CPUFEATURES
+USER_VARS += DEFMACHINETYPE_CLH
+USER_VARS += KERNELPARAMS
+USER_VARS += LIBEXECDIR
+USER_VARS += LOCALSTATEDIR
+USER_VARS += PKGDATADIR
+USER_VARS += PKGLIBEXECDIR
+USER_VARS += PKGRUNDIR
+USER_VARS += PREFIX
+USER_VARS += PROJECT_BUG_URL
+USER_VARS += PROJECT_NAME
+USER_VARS += PROJECT_ORG
+USER_VARS += PROJECT_PREFIX
+USER_VARS += PROJECT_TAG
+USER_VARS += PROJECT_TYPE
+USER_VARS += RUNTIME_NAME
+USER_VARS += SHAREDIR
+USER_VARS += SYSCONFDIR
+USER_VARS += DEFVCPUS
+USER_VARS += DEFMAXVCPUS
+USER_VARS += DEFMAXVCPUS_ACRN
+USER_VARS += DEFMAXVCPUS_DB
+USER_VARS += DEFMEMSZ
+USER_VARS += DEFMEMSLOTS
+USER_VARS += DEFBRIDGES
+USER_VARS += DEFNETWORKMODEL_DB
+USER_VARS += DEFDISABLEGUESTEMPTYDIR
+USER_VARS += DEFDISABLEGUESTSECCOMP
+USER_VARS += DEFDISABLESELINUX
+USER_VARS += DEFAULTEXPFEATURES
+USER_VARS += DEFDISABLEBLOCK
+USER_VARS += DEFBLOCKSTORAGEDRIVER_DB
+USER_VARS += DEFSHAREDFS_CLH_VIRTIOFS
+USER_VARS += DEFSHAREDFS_QEMU_VIRTIOFS
+USER_VARS += DEFVIRTIOFSDAEMON
+USER_VARS += DEFVALIDVIRTIOFSDAEMONPATHS
+USER_VARS += DEFVIRTIOFSCACHESIZE
+USER_VARS += DEFVIRTIOFSCACHE
+USER_VARS += DEFVIRTIOFSEXTRAARGS
+USER_VARS += DEFENABLEANNOTATIONS
+USER_VARS += DEFENABLEIOTHREADS
+USER_VARS += DEFENABLEVHOSTUSERSTORE
+USER_VARS += DEFVHOSTUSERSTOREPATH
+USER_VARS += DEFVALIDVHOSTUSERSTOREPATHS
+USER_VARS += DEFFILEMEMBACKEND
+USER_VARS += DEFVALIDFILEMEMBACKENDS
+USER_VARS += DEFMSIZE9P
+USER_VARS += DEFENTROPYSOURCE
+USER_VARS += DEFVALIDENTROPYSOURCES
+USER_VARS += DEFSANDBOXCGROUPONLY
+USER_VARS += DEFSTATICRESOURCEMGMT
+USER_VARS += DEFBINDMOUNTS
+USER_VARS += DEFVFIOMODE
+USER_VARS += BUILDFLAGS
+USER_VARS += RUNTIMENAME
+USER_VARS += HYPERVISOR_DB
+USER_VARS += PIPESIZE
+USER_VARS += DBSHAREDFS
+USER_VARS += KATA_INSTALL_GROUP
+USER_VARS += KATA_INSTALL_OWNER
+USER_VARS += KATA_INSTALL_CFG_PERMS
+
 SOURCES := \
   $(shell find . 2>&1 | grep -E '.*\.rs$$') \
   Cargo.toml
@@ -35,7 +273,6 @@ ifneq ($(EXTRA_RUSTFEATURES),)
     override EXTRA_RUSTFEATURES := --features $(EXTRA_RUSTFEATURES)
 endif
 
-include ../../utils.mk
 
 TARGET_PATH = target/$(TRIPLE)/$(BUILD_TYPE)/$(TARGET)
 
@@ -49,6 +286,12 @@ GENERATED_CODE = crates/shim/src/config.rs
 RUNTIME_NAME=$(TARGET)
 RUNTIME_VERSION=$(VERSION)
 
+GENERATED_VARS = \
+		VERSION \
+		CONFIG_DB_IN \
+		$(USER_VARS)
+
+
 GENERATED_REPLACEMENTS= \
     PROJECT_NAME \
     RUNTIME_NAME \
@@ -78,6 +321,12 @@ define INSTALL_FILE
 	install -D -m 644 $1 $(DESTDIR)$2/$1 || exit 1;
 endef
 
+# Returns the name of the kernel file to use based on the provided KERNELTYPE.
+# $1 : KERNELTYPE (compressed or uncompressed)
+define MAKE_KERNEL_NAME
+$(if $(findstring uncompressed,$1),vmlinux.container,vmlinuz.container)
+endef
+
 .DEFAULT_GOAL := default
 
 ##TARGET default: build code
@@ -88,8 +337,13 @@ $(TARGET): $(GENERATED_CODE) $(TARGET_PATH)
 $(TARGET_PATH): $(SOURCES) | show-summary
 	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
 
+GENERATED_FILES += $(CONFIGS)
+
 $(GENERATED_FILES): %: %.in
-	@sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@"
+	@sed \
+        $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') \
+        $(foreach v,$(GENERATED_VARS),-e "s|@$v@|$($v)|g") \
+        $< > $@
 
 ##TARGET optimize: optimized  build
 optimize: $(SOURCES) | show-summary show-header
@@ -100,6 +354,7 @@ clean:
 	@cargo clean
 	@rm -f $(GENERATED_FILES)
 	@rm -f tarpaulin-report.html
+	@rm -f $(CONFIGS)
 
 vendor:
 	@cargo vendor
@@ -163,6 +418,10 @@ codecov: check_tarpaulin
 codecov-html: check_tarpaulin
 	cargo tarpaulin $(TARPAULIN_ARGS) -o Html
 
+install-configs: $(CONFIGS)
+	$(foreach f,$(CONFIGS),$(call INSTALL_CONFIG,$f,$(dir $(CONFIG_PATH)))) \
+    sudo ln -sf $(DEFAULT_HYPERVISOR_CONFIG) $(DESTDIR)/$(CONFIG_PATH)
+
 .PHONY: \
 	help \
 	optimize \
diff --git a/src/runtime-rs/arch/x86_64-options.mk b/src/runtime-rs/arch/x86_64-options.mk
new file mode 100644
index 0000000000..0e837f0657
--- /dev/null
+++ b/src/runtime-rs/arch/x86_64-options.mk
@@ -0,0 +1,15 @@
+# Copyright (c) 2019-2022 Alibaba Cloud
+# Copyright (c) 2019-2022 Ant Group
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+MACHINETYPE := q35
+KERNELPARAMS :=
+MACHINEACCELERATORS :=
+CPUFEATURES := pmu=off
+
+QEMUCMD := qemu-system-x86_64
+
+# dragonball binary name
+DBCMD := dragonball
diff --git a/src/runtime-rs/config/configuration-dragonball.toml.in b/src/runtime-rs/config/configuration-dragonball.toml.in
new file mode 100644
index 0000000000..bda6a8d3a1
--- /dev/null
+++ b/src/runtime-rs/config/configuration-dragonball.toml.in
@@ -0,0 +1,249 @@
+# Copyright (c) 2019-2022 Alibaba Cloud
+# Copyright (c) 2019-2022 Ant Group
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+# XXX: WARNING: this file is auto-generated.
+# XXX:
+# XXX: Source file: "@CONFIG_DB_IN@"
+# XXX: Project:
+# XXX:   Name: @PROJECT_NAME@
+# XXX:   Type: @PROJECT_TYPE@
+
+[hypervisor.dragonball]
+path = "@DBPATH@"
+ctlpath = "@DBCTLPATH@"
+kernel = "@KERNELPATH_DB@"
+image = "@IMAGEPATH@"
+
+# List of valid annotation names for the hypervisor
+# Each member of the list is a regular expression, which is the base name
+# of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
+enable_annotations = @DEFENABLEANNOTATIONS@
+
+# List of valid annotations values for the hypervisor
+# Each member of the list is a path pattern as described by glob(3).
+# The default if not set is empty (all annotations rejected.)
+# Your distribution recommends: @DBVALIDHYPERVISORPATHS@
+valid_hypervisor_paths = @DBVALIDHYPERVISORPATHS@
+
+# List of valid annotations values for ctlpath
+# The default if not set is empty (all annotations rejected.)
+# Your distribution recommends: 
+# valid_ctlpaths = 
+
+# Optional space-separated list of options to pass to the guest kernel.
+# For example, use `kernel_params = "vsyscall=emulate"` if you are having
+# trouble running pre-2.15 glibc.
+#
+# WARNING: - any parameter specified here will take priority over the default
+# parameter value of the same name used to start the virtual machine.
+# Do not set values here unless you understand the impact of doing so as you
+# may stop the virtual machine from booting.
+# To see the list of default parameters, enable hypervisor debug, create a
+# container and look for 'default-kernel-parameters' log entries.
+kernel_params = "@KERNELPARAMS@"
+
+# Path to the firmware.
+# If you want that DB uses the default firmware leave this option empty
+firmware = "@FIRMWAREPATH@"
+
+
+# Default number of vCPUs per SB/VM:
+# unspecified or 0                --> will be set to 1
+# < 0                             --> will be set to the actual number of physical cores
+# > 0 <= number of physical cores --> will be set to the specified number
+# > number of physical cores      --> will be set to the actual number of physical cores
+default_vcpus = @DEFVCPUS@
+
+
+# Default maximum number of vCPUs per SB/VM:
+# unspecified or == 0             --> will be set to the actual number of physical cores or to the maximum number
+#                                     of vCPUs supported by KVM if that number is exceeded
+# > 0 <= number of physical cores --> will be set to the specified number
+# > number of physical cores      --> will be set to the actual number of physical cores or to the maximum number
+#                                     of vCPUs supported by KVM if that number is exceeded
+# WARNING: Depending of the architecture, the maximum number of vCPUs supported by KVM is used when
+# the actual number of physical cores is greater than it.
+# WARNING: Be aware that this value impacts the virtual machine's memory footprint and CPU
+# the hotplug functionality. For example, `default_maxvcpus = 240` specifies that until 240 vCPUs
+# can be added to a SB/VM, but the memory footprint will be big. Another example, with
+# `default_maxvcpus = 8` the memory footprint will be small, but 8 will be the maximum number of
+# vCPUs supported by the SB/VM. In general, we recommend that you do not edit this variable,
+# unless you know what are you doing.
+default_maxvcpus = @DEFMAXVCPUS_DB@
+
+# Bridges can be used to hot plug devices.
+# Limitations:
+# * Currently only pci bridges are supported
+# * Until 30 devices per bridge can be hot plugged.
+# * Until 5 PCI bridges can be cold plugged per VM.
+#   This limitation could be a bug in the kernel
+# Default number of bridges per SB/VM:
+# unspecified or 0   --> will be set to @DEFBRIDGES@
+# > 1 <= 5           --> will be set to the specified number
+# > 5                --> will be set to 5
+default_bridges = @DEFBRIDGES@
+
+# Default memory size in MiB for SB/VM.
+# If unspecified then it will be set @DEFMEMSZ@ MiB.
+default_memory = @DEFMEMSZ@
+
+# Block storage driver to be used for the hypervisor in case the container
+# rootfs is backed by a block device. DB only supports virtio-blk.
+block_device_driver = "@DEFBLOCKSTORAGEDRIVER_DB@"
+
+# This option changes the default hypervisor and kernel parameters
+# to enable debug output where available.
+#
+# Default false
+#enable_debug = true
+
+# Disable the customizations done in the runtime when it detects
+# that it is running on top a VMM. This will result in the runtime
+# behaving as it would when running on bare metal.
+#
+#disable_nesting_checks = true
+
+# If host doesn't support vhost_net, set to true. Thus we won't create vhost fds for nics.
+# Default false
+#disable_vhost_net = true
+
+# Path to OCI hook binaries in the *guest rootfs*.
+# This does not affect host-side hooks which must instead be added to
+# the OCI spec passed to the runtime.
+#
+# You can create a rootfs with hooks by customizing the osbuilder scripts:
+# https://github.com/kata-containers/kata-containers/tree/main/tools/osbuilder
+#
+# Hooks must be stored in a subdirectory of guest_hook_path according to their
+# hook type, i.e. "guest_hook_path/{prestart,poststart,poststop}".
+# The agent will scan these directories for executable files and add them, in
+# lexicographical order, to the lifecycle of the guest container.
+# Hooks are executed in the runtime namespace of the guest. See the official documentation:
+# https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
+# Warnings will be logged if any error is encountered while scanning for hooks,
+# but it will not abort container execution.
+#guest_hook_path = "/usr/share/oci/hooks"
+
+# Shared file system type:
+#   - virtio-fs (default)
+#   - virtio-9p
+#   - virtio-fs-nydus
+shared_fs = "@DBSHAREDFS@"
+
+[agent.@PROJECT_TYPE@]
+container_pipe_size=@PIPESIZE@
+# If enabled, make the agent display debug-level messages.
+# (default: disabled)
+#enable_debug = true
+
+# Enable agent tracing.
+#
+# If enabled, the agent will generate OpenTelemetry trace spans.
+#
+# Notes:
+#
+# - If the runtime also has tracing enabled, the agent spans will be
+#   associated with the appropriate runtime parent span.
+# - If enabled, the runtime will wait for the container to shutdown,
+#   increasing the container shutdown time slightly.
+#
+# (default: disabled)
+#enable_tracing = true
+
+# Enable debug console.
+
+# If enabled, user can connect guest OS running inside hypervisor
+# through "kata-runtime exec <sandbox-id>" command
+
+#debug_console_enabled = true
+
+# Agent connection dialing timeout value in seconds
+# (default: 30)
+#dial_timeout = 30
+
+[runtime]
+# If enabled, the runtime will log additional debug messages to the
+# system log
+# (default: disabled)
+#enable_debug = true
+#
+# Internetworking model
+# Determines how the VM should be connected to the
+# the container network interface
+# Options:
+#
+#   - bridged (Deprecated)
+#     Uses a linux bridge to interconnect the container interface to
+#     the VM. Works for most cases except macvlan and ipvlan.
+#     ***NOTE: This feature has been deprecated with plans to remove this
+#     feature in the future. Please use other network models listed below.
+#
+#
+#   - macvtap
+#     Used when the Container network interface can be bridged using
+#     macvtap.
+#
+#   - none
+#     Used when customize network. Only creates a tap device. No veth pair.
+#
+#   - tcfilter
+#     Uses tc filter rules to redirect traffic from the network interface
+#     provided by plugin to a tap interface connected to the VM.
+#
+internetworking_model="@DEFNETWORKMODEL_DB@"
+
+name="@RUNTIMENAME@"
+hypervisor_name="@HYPERVISOR_DB@"
+agent_name="@PROJECT_TYPE@"
+
+# disable guest seccomp
+# Determines whether container seccomp profiles are passed to the virtual
+# machine and applied by the kata agent. If set to true, seccomp is not applied
+# within the guest
+# (default: true)
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
+
+# If enabled, the runtime will create opentracing.io traces and spans.
+# (See https://www.jaegertracing.io/docs/getting-started).
+# (default: disabled)
+#enable_tracing = true
+
+# Set the full url to the Jaeger HTTP Thrift collector.
+# The default if not set will be "http://localhost:14268/api/traces"
+#jaeger_endpoint = ""
+
+# Sets the username to be used if basic auth is required for Jaeger.
+#jaeger_user = ""
+
+# Sets the password to be used if basic auth is required for Jaeger.
+#jaeger_password = ""
+
+# If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
+# This option may have some potential impacts to your host. It should only be used when you know what you're doing.
+# `disable_new_netns` conflicts with `internetworking_model=bridged` and `internetworking_model=macvtap`. It works only
+# with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
+# (like OVS) directly.
+# (default: false)
+#disable_new_netns = true
+
+# if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
+# The container cgroups in the host are not created, just one single cgroup per sandbox.
+# The runtime caller is free to restrict or collect cgroup stats of the overall Kata sandbox.
+# The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
+# The sandbox cgroup is constrained if there is no container type annotation.
+# See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
+
+# Enabled experimental feature list, format: ["a", "b"].
+# Experimental features are features not stable enough for production,
+# they may break compatibility, and are prepared for a big version bump.
+# Supported experimental features:
+# (default: [])
+experimental=@DEFAULTEXPFEATURES@
+
+# If enabled, user can run pprof tools with shim v2 process through kata-monitor.
+# (default: false)
+# enable_pprof = true
diff --git a/utils.mk b/utils.mk
index c87da0c06b..a52bb7362d 100644
--- a/utils.mk
+++ b/utils.mk
@@ -3,6 +3,23 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 
+# Note:
+#
+# Since this file defines rules, it should be included
+# in other makefiles *after* their default rule has been defined.
+
+# Owner for installed files
+export KATA_INSTALL_OWNER     ?= root
+
+# Group for installed files
+export KATA_INSTALL_GROUP     ?= adm
+
+# Permissions for installed configuration files.
+#
+# XXX: Note that the permissions MUST be zero for "other"
+# XXX: in case the configuration file contains secrets.
+export KATA_INSTALL_CFG_PERMS ?= 0640
+
 # Create a set of standard rules for a project such that:
 #
 # - The component depends on its Makefile.
@@ -160,3 +177,28 @@ standard_rust_check:
 	cargo clippy --all-targets --all-features --release \
 		-- \
 		-D warnings
+
+# Install a file (full version).
+#
+# params:
+#
+# $1 : File to install.
+# $2 : Directory path where file will be installed.
+# $3 : Permissions to apply to the installed file.
+define INSTALL_FILE_FULL
+    sudo install \
+        --mode $3 \
+        --owner $(KATA_INSTALL_OWNER) \
+        --group $(KATA_INSTALL_GROUP) \
+        -D $1 $2/$(notdir $1) || exit 1;
+endef
+
+# Install a configuration file.
+#
+# params:
+#
+# $1 : File to install.
+# $2 : Directory path where file will be installed.
+define INSTALL_CONFIG
+    $(call INSTALL_FILE_FULL,$1,$2,$(KATA_INSTALL_CFG_PERMS))
+endef