tests: fix fc-rs CI failures in k8s, nerdctl and stability

Also, add fc-rs to shim-components.json for kata-deploy

fc-rs was missing from the shim-components catalog, so kata-deploy
extracted no tarballs for it. This left configuration-fc-rs.toml
absent from /opt/kata/share/defaults/kata-containers/runtime-rs/,
causing kata-deploy to fail with "Configuration file not found".

Add fc-rs as a rust shim (shim-v2-rust) with the same firecracker
components as the existing fc entry. The config template already
exists in src/runtime-rs/config/ and is built into the shim-v2-rust
tarball when FCCMD is set.

Signed-off-by: Anastassios Nanos <ananos@nubificus.co.uk>

tests/hypervisor_helpers.sh

@@ -11,7 +11,7 @@ CCA_HYPERVISORS=("qemu-cca")
 GPU_TEE_HYPERVISORS=("qemu-nvidia-gpu-snp" "qemu-nvidia-gpu-tdx" "qemu-nvidia-gpu-snp-runtime-rs" "qemu-nvidia-gpu-tdx-runtime-rs")
 TEE_HYPERVISORS=("${SNP_HYPERVISORS[@]}" "${TDX_HYPERVISORS[@]}" "${SE_HYPERVISORS[@]}" "${CCA_HYPERVISORS[@]}" "${GPU_TEE_HYPERVISORS[@]}")
 NON_TEE_HYPERVISORS=("qemu-coco-dev" "qemu-coco-dev-runtime-rs")
-FIRECRACKER_HYPERVISORS=("firecracker" "fc")
+FIRECRACKER_HYPERVISORS=("firecracker" "fc" "fc-rs")
 
 ALL_HYPERVISORS=(
 	"clh"

tests/integration/kubernetes/gha-run.sh

@@ -201,8 +201,12 @@ function prelabel_node_for_kata_deploy() {
 function prepull_kata_deploy_images() {
 	local kata_deploy_image="${DOCKER_REGISTRY}/${DOCKER_REPO}:${DOCKER_TAG}"
 
-	info "Pre-pulling kata-deploy image (devmapper): ${kata_deploy_image}"
-	sudo ctr -n k8s.io images pull --snapshotter devmapper "${kata_deploy_image}"
+	# Pull without --snapshotter: configure_devmapper sets
+	# unpack_config = [{platform: linux/amd64, snapshotter: devmapper}]
+	# in containerd.toml, so the transfer service unpacks into devmapper
+	# directly using that config — no SnapshotterCapabilities auto-discovery.
+	info "Pre-pulling kata-deploy image: ${kata_deploy_image}"
+	sudo ctr -n k8s.io images pull "${kata_deploy_image}"
 
 	# Resolve NFD image version from the helm dependency lock file
 	pushd "${helm_chart_dir}" > /dev/null
@@ -215,8 +219,8 @@ function prepull_kata_deploy_images() {
 			| grep "version:" | awk '{print $2}')
 		if [[ -n "${nfd_version}" ]]; then
 			local nfd_image="registry.k8s.io/nfd/node-feature-discovery:v${nfd_version}"
-			info "Pre-pulling NFD image (devmapper): ${nfd_image}"
-			sudo ctr -n k8s.io images pull --snapshotter devmapper "${nfd_image}" || true
+			info "Pre-pulling NFD image: ${nfd_image}"
+			sudo ctr -n k8s.io images pull "${nfd_image}" || true
 		fi
 	fi
 }

tests/integration/nerdctl/gha-run.sh

@@ -141,6 +141,15 @@ function install_kata_for_nerdctl() {
 	# containerd config via overwrite_containerd_config.
 	if [ "${KATA_HYPERVISOR:-}" = "fc-rs" ]; then
 		configure_devmapper_for_containerd
+
+		# Pre-pull alpine into the content store (no --snapshotter).
+		# nerdctl v2.3.1 calls SnapshotterCapabilities for OCI image indexes
+		# during pull, and devmapper returns nil/empty capabilities, causing
+		# "no unpack platforms defined". Pre-pulling without a snapshotter
+		# populates the content store; when nerdctl run then finds the image
+		# already present, it calls image.Unpack(devmapper) via the container-
+		# creation path which bypasses the SnapshotterCapabilities check.
+		sudo ctr -n default images pull docker.io/library/alpine:latest
 	fi
 }
 

tests/stability/soak_parallel_rm.sh

@@ -187,10 +187,14 @@ function init() {
 	nginx_digest=$("${GOPATH}/bin/yq" ".docker_images.nginx.digest" "${versions_file}")
 	nginx_image="${nginx_registry}@${nginx_digest}"
 
-	# Pull nginx image
+	# Pull nginx into the content store (no --snapshotter: avoids the
+	# SnapshotterCapabilities RPC that containerd v2.x client.Pull triggers,
+	# which devmapper fails with "no unpack platforms defined").
+	# ctr run --snapshotter devmapper later triggers image.Unpack() via the
+	# container-creation path, which bypasses SnapshotterCapabilities entirely.
 	sudo "${CTR_EXE}" image pull "${nginx_image}"
 	if [ $? != 0 ]; then
-		die "Unable to retry docker image ${nginx_image}"
+		die "Unable to pull docker image ${nginx_image}"
 	fi
 }
 

tools/packaging/kata-deploy/shim-components.json

@@ -82,6 +82,9 @@
       "x86_64":  ["shim-v2-go", "firecracker", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"],
       "aarch64": ["shim-v2-go", "firecracker", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"]
     },
+    "fc-rs": {
+      "x86_64":  ["shim-v2-rust", "firecracker", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"]
+    },
     "remote": {
       "x86_64":  ["shim-v2-go"],
       "ppc64le": ["shim-v2-go"],