Merge pull request #4593 from fidencio/2.4.3-branch-bump

# Kata Containers 2.4.3

.github/workflows/add-pr-sizing-label.yaml

@@ -1,38 +0,0 @@
-# Copyright (c) 2022 Intel Corporation
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-name: Add PR sizing label
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - reopened
-      - synchronize
-
-jobs:
-  add-pr-size-label:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v1
-
-      - name: Install PR sizing label script
-        run: |
-          # Clone into a temporary directory to avoid overwriting
-          # any existing github directory.
-          pushd $(mktemp -d) &>/dev/null
-          git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
-          sudo install pr-add-size-label.sh /usr/local/bin
-          popd &>/dev/null
-
-      - name: Add PR sizing label
-        env:
-          GITHUB_TOKEN: ${{ secrets.KATA_GITHUB_ACTIONS_PR_SIZE_TOKEN }}
-        run: |
-          pr=${{ github.event.number }}
-          sudo apt -y install diffstat patchutils
-
-          pr-add-size-label.sh -p "$pr"

.github/workflows/commit-message-check.yaml

@@ -10,7 +10,7 @@ env:
   error_msg: |+
     See the document below for help on formatting commits for the project.
 
-    https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
+    https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md#patch-format
 
 jobs:
   commit-message-check:

.github/workflows/docs-url-alive-check.yaml

@@ -1,44 +0,0 @@
-on:
-  schedule:
-    - cron:  '0 23 * * 0'
-
-name: Docs URL Alive Check
-jobs:
-  test:
-    strategy:
-      matrix:
-        go-version: [1.17.x]
-        os: [ubuntu-20.04]
-    runs-on: ${{ matrix.os }}
-    env:
-      target_branch: ${{ github.base_ref }}
-    steps:
-    - name: Install Go
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-      uses: actions/setup-go@v2
-      with:
-        go-version: ${{ matrix.go-version }}
-      env:
-        GOPATH: ${{ runner.workspace }}/kata-containers
-    - name: Set env
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-      run: |
-        echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
-        echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
-    - name: Checkout code
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-      uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-        path: ./src/github.com/${{ github.repository }}
-    - name: Setup
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-      run: |
-        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/setup.sh
-      env:
-        GOPATH: ${{ runner.workspace }}/kata-containers
-    # docs url alive check
-    - name: Docs URL Alive Check
-      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-      run: |
-        cd ${GOPATH}/src/github.com/${{ github.repository }} && make docs-url-alive-check

.github/workflows/kata-deploy-test.yaml

@@ -1,4 +1,5 @@
 on:
+  workflow_dispatch: # this is used to trigger the workflow on non-main branches
   issue_comment:
     types: [created, edited]
 

.github/workflows/snap-release.yaml

@@ -26,7 +26,7 @@ jobs:
           # Check semantic versioning format (x.y.z) and if the current tag is the latest tag
           if echo "${current_version}" | grep -q "^[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+$" && echo -e "$latest_version\n$current_version" | sort -C -V; then
             # Current version is the latest version, build it
-            snapcraft -d snap --destructive-mode
+            snapcraft snap --debug --destructive-mode
           fi
 
       - name: Upload snap

.github/workflows/snap.yaml

@@ -24,4 +24,4 @@ jobs:
       - name: Build snap
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
         run: |
-          snapcraft -d snap --destructive-mode
+          snapcraft snap --debug --destructive-mode

Makefile

@@ -14,7 +14,6 @@ TOOLS =
 
 TOOLS += agent-ctl
 TOOLS += trace-forwarder
-TOOLS += runk
 
 STANDARD_TARGETS = build check clean install test vendor
 
@@ -40,16 +39,10 @@ generate-protocols:
 static-checks: build
 	bash ci/static-checks.sh
 
-docs-url-alive-check:
-	bash ci/docs-url-alive-check.sh
-
 .PHONY: \
 	all \
 	binary-tarball \
 	default \
 	install-binary-tarball \
 	logging-crate-tests \
-	static-checks \
-	docs-url-alive-check
-
-
+	static-checks

README.md

@@ -118,7 +118,6 @@ The table below lists the core parts of the project:
 | [runtime](src/runtime) | core | Main component run by a container manager and providing a containerd shimv2 runtime implementation. |
 | [agent](src/agent) | core | Management process running inside the virtual machine / POD that sets up the container environment. |
 | [documentation](docs) | documentation | Documentation common to all components (such as design and install documentation). |
-| [libraries](src/libs) | core | Library crates shared by multiple Kata Container components or published to [`crates.io`](https://crates.io/index.html) |
 | [tests](https://github.com/kata-containers/tests) | tests | Excludes unit tests which live with the main code. |
 
 ### Additional components
@@ -132,7 +131,6 @@ The table below lists the remaining parts of the project:
 | [osbuilder](tools/osbuilder) | infrastructure | Tool to create "mini O/S" rootfs and initrd images and kernel for the hypervisor. |
 | [`agent-ctl`](src/tools/agent-ctl) | utility | Tool that provides low-level access for testing the agent. |
 | [`trace-forwarder`](src/tools/trace-forwarder) | utility | Agent tracing helper. |
-| [`runk`](src/tools/runk) | utility | Standard OCI container runtime based on the agent. |
 | [`ci`](https://github.com/kata-containers/ci) | CI | Continuous Integration configuration files and scripts. |
 | [`katacontainers.io`](https://github.com/kata-containers/www.katacontainers.io) | Source for the [`katacontainers.io`](https://www.katacontainers.io) site. |
 

VERSION

@@ -1 +1 @@
-2.5.0-alpha1
+2.4.3

ci/docs-url-alive-check.sh

@@ -1,12 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2021 Easystack Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-
-set -e
-
-cidir=$(dirname "$0")
-source "${cidir}/lib.sh"
-
-run_docs_url_alive_check

ci/install_libseccomp.sh

@@ -19,7 +19,7 @@ source "${tests_repo_dir}/.ci/lib.sh"
 # fail. So let's ensure they are unset here.
 unset PREFIX DESTDIR
 
-arch=${ARCH:-$(uname -m)}
+arch=$(uname -m)
 workdir="$(mktemp -d --tmpdir build-libseccomp.XXXXX)"
 
 # Variables for libseccomp
@@ -70,8 +70,7 @@ build_and_install_gperf() {
     curl -sLO "${gperf_tarball_url}"
     tar -xf "${gperf_tarball}"
     pushd "gperf-${gperf_version}"
-    # Unset $CC for configure, we will always use native for gperf
-    CC= ./configure --prefix="${gperf_install_dir}"
+    ./configure --prefix="${gperf_install_dir}"
     make
     make install
     export PATH=$PATH:"${gperf_install_dir}"/bin
@@ -85,7 +84,7 @@ build_and_install_libseccomp() {
     curl -sLO "${libseccomp_tarball_url}"
     tar -xf "${libseccomp_tarball}"
     pushd "libseccomp-${libseccomp_version}"
-    ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static --host="${arch}"
+    ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static
     make
     make install
     popd

ci/install_musl.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Copyright (c) 2020 Ant Group
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+set -e
+
+install_aarch64_musl() {
+	local arch=$(uname -m)
+	if [ "${arch}" == "aarch64" ]; then
+		local musl_tar="${arch}-linux-musl-native.tgz"
+		local musl_dir="${arch}-linux-musl-native"
+		pushd /tmp
+		if curl -sLO --fail https://musl.cc/${musl_tar}; then
+			tar -zxf ${musl_tar}
+			mkdir -p /usr/local/musl/
+			cp -r ${musl_dir}/* /usr/local/musl/
+		fi
+		popd
+	fi
+}
+
+install_aarch64_musl

ci/lib.sh

@@ -44,12 +44,3 @@ run_go_test()
 	clone_tests_repo
 	bash "$tests_repo_dir/.ci/go-test.sh"
 }
-
-run_docs_url_alive_check()
-{
-	clone_tests_repo
-	# Make sure we have the targeting branch
-	git remote set-branches --add origin "${branch}"
-	git fetch -a
-	bash "$tests_repo_dir/.ci/static-checks.sh" --docs --all "github.com/kata-containers/kata-containers"
-}

docs/Limitations.md

@@ -46,7 +46,7 @@ The following link shows the latest list of limitations:
 # Contributing
 
 If you would like to work on resolving a limitation, please refer to the
-[contributors guide](https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md).
+[contributors guide](https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md).
 If you wish to raise an issue for a new limitation, either
 [raise an issue directly on the runtime](https://github.com/kata-containers/kata-containers/issues/new)
 or see the

docs/README.md

@@ -30,6 +30,7 @@ See the [how-to documentation](how-to).
 * [GPU Passthrough with Kata](./use-cases/GPU-passthrough-and-Kata.md)
 * [SR-IOV with Kata](./use-cases/using-SRIOV-and-kata.md)
 * [Intel QAT with Kata](./use-cases/using-Intel-QAT-and-kata.md)
+* [VPP with Kata](./use-cases/using-vpp-and-kata.md)
 * [SPDK vhost-user with Kata](./use-cases/using-SPDK-vhostuser-and-kata.md)
 * [Intel SGX with Kata](./use-cases/using-Intel-SGX-and-kata.md)
 

docs/Release-Process.md

@@ -4,11 +4,11 @@
 ## Requirements
 
 - [hub](https://github.com/github/hub)
-  * Using an [application token](https://github.com/settings/tokens) is required for hub.
+  * Using an [application token](https://github.com/settings/tokens) is required for hub (set to a GITHUB_TOKEN environment variable).
 
 - GitHub permissions to push tags and create releases in Kata repositories.
 
-- GPG configured to sign git tags. https://help.github.com/articles/generating-a-new-gpg-key/
+- GPG configured to sign git tags. https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
 
 - You should configure your GitHub to use your ssh keys (to push to branches). See https://help.github.com/articles/adding-a-new-ssh-key-to-your-github-account/.
     * As an alternative, configure hub to push and fork with HTTPS, `git config --global hub.protocol https` (Not tested yet) *
@@ -48,7 +48,7 @@
 ### Merge all bump version Pull requests
 
   - The above step will create a GitHub pull request in the Kata projects. Trigger the CI using `/test` command on each bump Pull request.
-  - Trigger the test-kata-deploy workflow on the kata-containers repository bump Pull request using `/test_kata_deploy` (monitor under the "action" tab).
+  - Trigger the `test-kata-deploy` workflow which is under the `Actions` tab on the repository GitHub page (make sure to select the correct branch and validate it passes).
   - Check any failures and fix if needed.
   - Work with the Kata approvers to verify that the CI works and the pull requests are merged.
 

docs/Unit-Test-Advice.md

@@ -277,9 +277,7 @@ mod tests {
 
 ## Temporary files
 
-Use `t.TempDir()` to create temporary directory. The directory created by
-`t.TempDir()` is automatically removed when the test and all its subtests
-complete.
+Always delete temporary files on success.
 
 ### Golang temporary files
 
@@ -288,7 +286,11 @@ func TestSomething(t *testing.T) {
     assert := assert.New(t)
 
     // Create a temporary directory
-    tmpdir := t.TempDir()
+    tmpdir, err := os.MkdirTemp("", "")
+    assert.NoError(err)
+
+    // Delete it at the end of the test
+    defer os.RemoveAll(tmpdir) 
 
     // Add test logic that will use the tmpdir here...
 }

docs/design/README.md

@@ -11,7 +11,6 @@ Kata Containers design documents:
 - [`Inotify` support](inotify.md)
 - [Metrics(Kata 2.0)](kata-2-0-metrics.md)
 - [Design for Kata Containers `Lazyload` ability with `nydus`](kata-nydus-design.md)
-- [Design for direct-assigned volume](direct-blk-device-assignment.md)
 
 ---
 

docs/design/VSocks.md

@@ -67,15 +67,22 @@ Using a proxy for multiplexing the connections between the VM and the host uses
 4.5MB per [POD][2]. In a high density deployment this could add up to GBs of
 memory that could have been used to host more PODs. When we talk about density
 each kilobyte matters and it might be the decisive factor between run another
-POD or not. Before making the decision not to use VSOCKs, you should ask
+POD or not. For example if you have 500 PODs running in a server, the same
+amount of [`kata-proxy`][3] processes will be running and consuming for around
+2250MB of RAM. Before making the decision not to use VSOCKs, you should ask
 yourself, how many more containers can run with the memory RAM consumed by the
 Kata proxies?
 
 ### Reliability
 
+[`kata-proxy`][3] is in charge of multiplexing the connections between virtual
+machine and host processes, if it dies all connections get broken. For example
+if you have a [POD][2] with 10 containers running, if `kata-proxy` dies it would
+be impossible to contact your containers, though they would still be running.
 Since communication via VSOCKs is direct, the only way to lose communication
 with the containers is if the VM itself or the `containerd-shim-kata-v2` dies, if this happens
 the containers are removed automatically.
 
 [1]: https://wiki.qemu.org/Features/VirtioVsock
 [2]: ./vcpu-handling.md#virtual-cpus-and-kubernetes-pods
+[3]: https://github.com/kata-containers/proxy

docs/design/direct-blk-device-assignment.md

@@ -1,253 +0,0 @@
-# Motivation
-Today, there exist a few gaps between Container Storage Interface (CSI) and virtual machine (VM) based runtimes such as Kata Containers 
-that prevent them from working together smoothly.
-
-First, it’s cumbersome to use a persistent volume (PV) with Kata Containers. Today, for a PV with Filesystem volume mode, Virtio-fs
-is the only way to surface it inside a Kata Container guest VM. But often mounting the filesystem (FS) within the guest operating system (OS) is 
-desired due to performance benefits, availability of native FS features and security benefits over the Virtio-fs mechanism.
-
-Second, it’s difficult if not impossible to resize a PV online with Kata Containers. While a PV can be expanded on the host OS, 
-the updated metadata needs to be propagated to the guest OS in order for the application container to use the expanded volume. 
-Currently, there is not a way to propagate the PV metadata from the host OS to the guest OS without restarting the Pod sandbox.
-
-# Proposed Solution
-
-Because of the OS boundary, these features cannot be implemented in the CSI node driver plugin running on the host OS 
-as is normally done in the runc container. Instead, they can be done by the Kata Containers agent inside the guest OS, 
-but it requires the CSI driver to pass the relevant information to the Kata Containers runtime. 
-An ideal long term solution would be to have the `kubelet` coordinating the communication between the CSI driver and 
-the container runtime, as described in [KEP-2857](https://github.com/kubernetes/enhancements/pull/2893/files). 
-However, as the KEP is still under review, we would like to propose a short/medium term solution to unblock our use case.
-
-The proposed solution is built on top of a previous [proposal](https://github.com/egernst/kata-containers/blob/da-proposal/docs/design/direct-assign-volume.md) 
-described by Eric Ernst. The previous proposal has two gaps:
-
-1. Writing a `csiPlugin.json` file to the volume root path introduced a security risk. A malicious user can gain unauthorized 
-access to a block device by writing their own `csiPlugin.json` to the above location through an ephemeral CSI plugin.  
-
-2. The proposal didn't describe how to establish a mapping between a volume and a kata sandbox, which is needed for 
-implementing CSI volume resize and volume stat collection APIs.
-
-This document particularly focuses on how to address these two gaps.
-
-## Assumptions and Limitations
-1. The proposal assumes that a block device volume will only be used by one Pod on a node at a time, which we believe 
-is the most common pattern in Kata Containers use cases. It’s also unsafe to have the same block device attached to more than 
-one Kata pod. In the context of Kubernetes, the `PersistentVolumeClaim` (PVC) needs to have the `accessMode` as `ReadWriteOncePod`. 
-2. More advanced Kubernetes volume features such as, `fsGroup`, `fsGroupChangePolicy`, and `subPath` are not supported. 
-
-## End User Interface
-
-1. The user specifies a PV as a direct-assigned volume. How a PV is specified as a direct-assigned volume is left for each CSI implementation to decide.
-There are a few options for reference:
-   1. A storage class parameter specifies whether it's a direct-assigned volume. This avoids any lookups of PVC 
-   or Pod information from the CSI plugin (as external provisioner takes care of these). However, all PVs in the storage class with the parameter set 
-   will have host mounts skipped.
-   2. Use a PVC annotation. This approach requires the CSI plugins have `--extra-create-metadata` [set](https://kubernetes-csi.github.io/docs/external-provisioner.html#persistentvolumeclaim-and-persistentvolume-parameters)
-   to be able to perform a lookup of the PVC annotations from the API server. Pro: API server lookup of annotations only required during creation of PV. 
-   Con: The CSI plugin will always skip host mounting of the PV.
-   3. The CSI plugin can also lookup pod `runtimeclass` during `NodePublish`. This approach can be found in the [ALIBABA CSI plugin](https://github.com/kubernetes-sigs/alibaba-cloud-csi-driver/blob/master/pkg/disk/nodeserver.go#L248).
-2. The CSI node driver delegates the direct assigned volume to the Kata Containers runtime. The CSI node driver APIs need to 
-   be modified to pass the volume mount information and collect volume information to/from the Kata Containers runtime by invoking `kata-runtime` command line commands.
-   * **NodePublishVolume** -- It invokes `kata-runtime direct-volume add --volume-path [volumePath] --mount-info [mountInfo]` 
-   to propagate the volume mount information to the Kata Containers runtime for it to carry out the filesystem mount operation.
-   The `volumePath` is the [target_path](https://github.com/container-storage-interface/spec/blob/master/csi.proto#L1364) in the CSI `NodePublishVolumeRequest`.
-   The `mountInfo` is a serialized JSON string. 
-   * **NodeGetVolumeStats** -- It invokes `kata-runtime direct-volume stats --volume-path [volumePath]` to retrieve the filesystem stats of direct-assigned volume.
-   * **NodeExpandVolume** -- It invokes `kata-runtime direct-volume resize --volume-path [volumePath] --size [size]` to send a resize request to the Kata Containers runtime to
-   resize the direct-assigned volume.
-   * **NodeStageVolume/NodeUnStageVolume** -- It invokes `kata-runtime direct-volume remove --volume-path [volumePath]` to remove the persisted metadata of a direct-assigned volume.
-
-The `mountInfo` object is defined as follows:
-```Golang
-type MountInfo struct {
-    // The type of the volume (ie. block)
-    VolumeType string `json:"volume-type"`
-    // The device backing the volume.
-    Device string `json:"device"`
-    // The filesystem type to be mounted on the volume.
-    FsType string `json:"fstype"`
-    // Additional metadata to pass to the agent regarding this volume.
-    Metadata map[string]string `json:"metadata,omitempty"`
-    // Additional mount options.
-    Options []string `json:"options,omitempty"`
-}
-```
-Notes: given that the `mountInfo` is persisted to the disk by the Kata runtime, it shouldn't container any secrets (such as SMB mount password).
-
-## Implementation Details
-
-### Kata runtime
-Instead of the CSI node driver writing the mount info into a `csiPlugin.json` file under the volume root, 
-as described in the original proposal, here we propose that the CSI node driver passes the mount information to 
-the Kata Containers runtime through a new `kata-runtime` commandline command. The `kata-runtime` then writes the mount 
-information to a `mount-info.json` file in a predefined location (`/run/kata-containers/shared/direct-volumes/[volume_path]/`).
-
-When the Kata Containers runtime starts a container, it verifies whether a volume mount is a direct-assigned volume by checking 
-whether there is a `mountInfo` file under the computed Kata `direct-volumes` directory. If it is, the runtime parses the `mountInfo` file, 
-updates the mount spec with the data in `mountInfo`. The updated mount spec is then passed to the Kata agent in the guest VM together
-with other mounts. The Kata Containers runtime also creates a file named by the sandbox id under the `direct-volumes/[volume_path]/` 
-directory. The reason for adding a sandbox id file is to establish a mapping between the volume and the sandbox using it. 
-Later, when the Kata Containers runtime handles the `get-stats` and `resize` commands, it uses the sandbox id to identify 
-the endpoint of the corresponding `containerd-shim-kata-v2`.
-
-### containerd-shim-kata-v2 changes
-`containerd-shim-kata-v2` provides an API for sandbox management through a Unix domain socket. Two new handlers are proposed: `/direct-volume/stats` and `/direct-volume/resize`:
-
-Example:
-
-```bash
-$ curl --unix-socket "$shim_socket_path" -I -X GET 'http://localhost/direct-volume/stats/[urlSafeVolumePath]'
-$ curl --unix-socket "$shim_socket_path" -I -X POST 'http://localhost/direct-volume/resize' -d '{ "volumePath"": [volumePath], "Size": "123123" }'
-```
-
-The shim then forwards the corresponding request to the `kata-agent` to carry out the operations inside the guest VM. For `resize` operation, 
-the Kata runtime also needs to notify the hypervisor to resize the block device (e.g. call `block_resize` in QEMU). 
-
-### Kata agent changes
-
-The mount spec of a direct-assigned volume is passed to `kata-agent` through the existing `Storage` GRPC object. 
-Two new APIs and three new GRPC objects are added to GRPC protocol between the shim and agent for resizing and getting volume stats:
-```protobuf
-
-rpc GetVolumeStats(VolumeStatsRequest) returns (VolumeStatsResponse);
-rpc ResizeVolume(ResizeVolumeRequest) returns (google.protobuf.Empty);
-
-message VolumeStatsRequest {
-// The volume path on the guest outside the container
-    string volume_guest_path = 1;
-}
-
-message ResizeVolumeRequest {
-// Full VM guest path of the volume (outside the container)
-    string volume_guest_path = 1;
-    uint64 size = 2;
-}
-
-// This should be kept in sync with CSI NodeGetVolumeStatsResponse (https://github.com/container-storage-interface/spec/blob/v1.5.0/csi.proto)
-message VolumeStatsResponse {
-   // This field is OPTIONAL.
-   repeated VolumeUsage usage = 1;
-   // Information about the current condition of the volume.
-   // This field is OPTIONAL.
-   // This field MUST be specified if the VOLUME_CONDITION node
-   // capability is supported.
-   VolumeCondition volume_condition = 2;
-}
-message VolumeUsage {
-   enum Unit {
-      UNKNOWN = 0;
-      BYTES = 1;
-      INODES = 2;
-   }
-   // The available capacity in specified Unit. This field is OPTIONAL.
-   // The value of this field MUST NOT be negative.
-   uint64 available = 1;
-
-   // The total capacity in specified Unit. This field is REQUIRED.
-   // The value of this field MUST NOT be negative.
-   uint64 total = 2;
-
-   // The used capacity in specified Unit. This field is OPTIONAL.
-   // The value of this field MUST NOT be negative.
-   uint64 used = 3;
-
-   // Units by which values are measured. This field is REQUIRED.
-   Unit unit = 4;
-}
-
-// VolumeCondition represents the current condition of a volume.
-message VolumeCondition {
-
-   // Normal volumes are available for use and operating optimally.
-   // An abnormal volume does not meet these criteria.
-   // This field is REQUIRED.
-   bool abnormal = 1;
-
-   // The message describing the condition of the volume.
-   // This field is REQUIRED.
-   string message = 2;
-}
-
-```
-
-### Step by step walk-through
-
-Given the following definition:
-```YAML
----
-apiVersion: v1
-kind: Pod
-metadata:
-  name: app
-spec:
-  runtime-class: kata-qemu
-  containers:
-  - name: app
-    image: centos
-    command: ["/bin/sh"]
-    args: ["-c", "while true; do echo $(date -u) >> /data/out.txt; sleep 5; done"]
-    volumeMounts:
-    - name: persistent-storage
-      mountPath: /data
-  volumes:
-  - name: persistent-storage
-    persistentVolumeClaim:
-      claimName: ebs-claim
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  annotations:
-    skip-hostmount: "true"
-  name: ebs-claim
-spec:
-  accessModes:
-    - ReadWriteOncePod
-  volumeMode: Filesystem
-  storageClassName: ebs-sc
-  resources:
-    requests:
-      storage: 4Gi
----
-kind: StorageClass
-apiVersion: storage.k8s.io/v1
-metadata:
-  name: ebs-sc
-provisioner: ebs.csi.aws.com
-volumeBindingMode: WaitForFirstConsumer
-parameters:
-  csi.storage.k8s.io/fstype: ext4
-
-```
-Let’s assume that changes have been made in the `aws-ebs-csi-driver` node driver.
-
-**Node publish volume**
-1. In the node CSI driver, the `NodePublishVolume` API invokes: `kata-runtime direct-volume add --volume-path "/kubelet/a/b/c/d/sdf" --mount-info "{\"Device\": \"/dev/sdf\", \"fstype\": \"ext4\"}"`.
-2. The `Kata-runtime` writes the mount-info JSON to a file called `mountInfo.json` under `/run/kata-containers/shared/direct-volumes/kubelet/a/b/c/d/sdf`.
-
-**Node unstage volume**
-1. In the node CSI driver, the `NodeUnstageVolume` API invokes: `kata-runtime direct-volume remove --volume-path "/kubelet/a/b/c/d/sdf"`.
-2. Kata-runtime deletes the directory `/run/kata-containers/shared/direct-volumes/kubelet/a/b/c/d/sdf`.
-
-**Use the volume in sandbox**
-1. Upon the request to start a container, the `containerd-shim-kata-v2` examines the container spec,
-and iterates through the mounts. For each mount, if there is a `mountInfo.json` file under `/run/kata-containers/shared/direct-volumes/[mount source path]`,
-it generates a `storage` GRPC object after overwriting the mount spec with the information in `mountInfo.json`.
-2. The shim sends the storage objects to kata-agent through TTRPC.
-3. The shim writes a file with the sandbox id as the name under `/run/kata-containers/shared/direct-volumes/[mount source path]`.
-4. The kata-agent mounts the storage objects for the container.
-
-**Node expand volume**
-1. In the node CSI driver, the `NodeExpandVolume` API invokes: `kata-runtime direct-volume resize –-volume-path "/kubelet/a/b/c/d/sdf" –-size 8Gi`.
-2. The Kata runtime checks whether there is a sandbox id file under the directory `/run/kata-containers/shared/direct-volumes/kubelet/a/b/c/d/sdf`.
-3. The Kata runtime identifies the shim instance through the sandbox id, and sends a GRPC request to resize the volume.
-4. The shim handles the request, asks the hypervisor to resize the block device and sends a GRPC request to Kata agent to resize the filesystem.
-5. Kata agent receives the request and resizes the filesystem.
-
-**Node get volume stats**
-1. In the node CSI driver, the `NodeGetVolumeStats` API invokes: `kata-runtime direct-volume stats –-volume-path "/kubelet/a/b/c/d/sdf"`.
-2. The Kata runtime checks whether there is a sandbox id file under the directory `/run/kata-containers/shared/direct-volumes/kubelet/a/b/c/d/sdf`.
-3. The Kata runtime identifies the shim instance through the sandbox id, and sends a GRPC request to get the volume stats.
-4. The shim handles the request and forwards it to the Kata agent.
-5. Kata agent receives the request and returns the filesystem stats.

docs/design/vcpu-handling.md

@@ -2,15 +2,24 @@
 
 ## Default number of virtual CPUs
 
-Before starting a container, the [runtime][4] reads the `default_vcpus` option
-from the [configuration file][5] to determine the number of virtual CPUs
+Before starting a container, the [runtime][6] reads the `default_vcpus` option
+from the [configuration file][7] to determine the number of virtual CPUs
 (vCPUs) needed to start the virtual machine. By default, `default_vcpus` is
 equal to 1 for fast boot time and a small memory footprint per virtual machine.
 Be aware that increasing this value negatively impacts the virtual machine's
 boot time and memory footprint.
 In general, we recommend that you do not edit this variable, unless you know
 what are you doing. If your container needs more than one vCPU, use
-[Kubernetes `cpu` limits][1] to assign more resources.
+[docker `--cpus`][1], [docker update][4], or [Kubernetes `cpu` limits][2] to
+assign more resources.
+
+*Docker*
+
+```sh
+$ docker run --name foo -ti --cpus 2 debian bash
+$ docker update --cpus 4 foo
+```
+
 
 *Kubernetes*
 
@@ -40,7 +49,7 @@ $ sudo -E kubectl create -f ~/cpu-demo.yaml
 ## Virtual CPUs and Kubernetes pods
 
 A Kubernetes pod is a group of one or more containers, with shared storage and
-network, and a specification for how to run the containers [[specification][2]].
+network, and a specification for how to run the containers [[specification][3]].
 In Kata Containers this group of containers, which is called a sandbox, runs inside
 the same virtual machine. If you do not specify a CPU constraint, the runtime does
 not add more vCPUs and the container is not placed inside a CPU cgroup.
@@ -64,7 +73,13 @@ constraints with each container trying to consume 100% of vCPU, the resources
 divide in two parts, 50% of vCPU for each container because your virtual
 machine does not have enough resources to satisfy containers needs. If you want
 to give access to a greater or lesser portion of vCPUs to a specific container,
-use [Kubernetes `cpu` requests][1].
+use [`docker --cpu-shares`][1] or [Kubernetes `cpu` requests][2].
+
+*Docker*
+
+```sh
+$ docker run -ti --cpus-shares=512 debian bash
+```
 
 *Kubernetes*
 
@@ -94,9 +109,10 @@ $ sudo -E kubectl create -f ~/cpu-demo.yaml
 Before running containers without CPU constraint, consider that your containers
 are not running alone. Since your containers run inside a virtual machine other
 processes use the vCPUs as well (e.g. `systemd` and the Kata Containers
-[agent][3]). In general, we recommend setting `default_vcpus` equal to 1 to
+[agent][5]). In general, we recommend setting `default_vcpus` equal to 1 to
 allow non-container processes to run on this vCPU and to specify a CPU
-constraint for each container.
+constraint for each container. If your container is already running and needs
+more vCPUs, you can add more using [docker update][4].
 
 ## Container with CPU constraint
 
@@ -105,7 +121,7 @@ constraints using the following formula: `vCPUs = ceiling( quota / period )`, wh
 `quota` specifies the number of microseconds per CPU Period that the container is
 guaranteed CPU access and `period` specifies the CPU CFS scheduler period of time
 in microseconds. The result determines the number of vCPU to hot plug into the
-virtual machine. Once the vCPUs have been added, the [agent][3] places the
+virtual machine. Once the vCPUs have been added, the [agent][5] places the
 container inside a CPU cgroup. This placement allows the container to use only
 its assigned resources.
 
@@ -122,6 +138,25 @@ the virtual machine starts with 8 vCPUs and 1 vCPUs is added and assigned
 to the container. Non-container processes might be able to use 8 vCPUs but they
 use a maximum 1 vCPU, hence 7 vCPUs might not be used.
 
+
+*Container without CPU constraint*
+
+```sh
+$ docker run -ti debian bash -c "nproc; cat /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_*"
+1       # number of vCPUs
+100000  # cfs period
+-1      # cfs quota
+```
+
+*Container with CPU constraint*
+
+```sh
+docker run --cpus 4 -ti debian bash -c "nproc; cat /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_*"
+5       # number of vCPUs
+100000  # cfs period
+400000  # cfs quota
+```
+
 ## Virtual CPU handling without hotplug
 
 In some cases, the hardware and/or software architecture being utilized does not support
@@ -148,8 +183,11 @@ the container's `spec` will provide the sizing information directly. If these ar
 calculate the number of CPUs required for the workload and augment this by `default_vcpus`
 configuration option, and use this for the virtual machine size.
 
-[1]: https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource
-[2]: https://kubernetes.io/docs/concepts/workloads/pods/pod/
-[3]: ../../src/agent
-[4]: ../../src/runtime
-[5]: ../../src/runtime/README.md#configuration
+
+[1]: https://docs.docker.com/config/containers/resource_constraints/#cpu
+[2]: https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource
+[3]: https://kubernetes.io/docs/concepts/workloads/pods/pod/
+[4]: https://docs.docker.com/engine/reference/commandline/update/
+[5]: ../../src/agent
+[6]: ../../src/runtime
+[7]: ../../src/runtime/README.md#configuration

docs/design/virtualization.md

@@ -39,7 +39,7 @@ Details of each solution and a summary are provided below.
 Kata Containers with QEMU has complete compatibility with Kubernetes.
 
 Depending on the host architecture, Kata Containers supports various machine types,
-for example `q35` on x86 systems, `virt` on ARM systems and `pseries` on IBM Power systems. The default Kata Containers
+for example `pc` and `q35` on x86 systems, `virt` on ARM systems and `pseries` on IBM Power systems. The default Kata Containers
 machine type is `q35`. The machine type and its [`Machine accelerators`](#machine-accelerators) can
 be changed by editing the runtime [`configuration`](architecture/README.md#configuration) file.
 
@@ -60,8 +60,9 @@ Machine accelerators are architecture specific and can be used to improve the pe
 and enable specific features of the machine types. The following machine accelerators
 are used in Kata Containers:
 
-- NVDIMM: This machine accelerator is x86 specific and only supported by `q35` machine types.
-`nvdimm` is used to provide the root filesystem as a persistent memory device to the Virtual Machine.
+- NVDIMM: This machine accelerator is x86 specific and only supported by `pc` and
+`q35` machine types. `nvdimm` is used to provide the root filesystem as a persistent
+memory device to the Virtual Machine.
 
 #### Hotplug devices
 

docs/how-to/README.md

@@ -15,11 +15,6 @@
 - `qemu`
 - `cloud-hypervisor`
 - `firecracker`
-
-   In the case of `firecracker` the use of a block device `snapshotter` is needed
-   for the VM rootfs. Refer to the following guide for additional configuration
-   steps:
-   - [Setup Kata containers with `firecracker`](how-to-use-kata-containers-with-firecracker.md)
 - `ACRN`
 
   While `qemu` , `cloud-hypervisor` and `firecracker` work out of the box with installation of Kata,

docs/how-to/how-to-run-docker-with-kata.md

@@ -48,9 +48,9 @@ Running Docker containers Kata Containers requires care because `VOLUME`s specif
 kataShared on / type virtiofs (rw,relatime,dax)
 ```
 
-`kataShared` mount types are powered by [`virtio-fs`](https://virtio-fs.gitlab.io/), a marked improvement over `virtio-9p`, thanks to [PR #1016](https://github.com/kata-containers/runtime/pull/1016). While `virtio-fs` is normally an excellent choice, in the case of DinD workloads `virtio-fs` causes an issue -- [it *cannot* be used as a "upper layer" of `overlayfs` without a custom patch](http://lists.katacontainers.io/pipermail/kata-dev/2020-January/001216.html).
+`kataShared` mount types are powered by [`virtio-fs`][virtio-fs], a marked improvement over `virtio-9p`, thanks to [PR #1016](https://github.com/kata-containers/runtime/pull/1016). While `virtio-fs` is normally an excellent choice, in the case of DinD workloads `virtio-fs` causes an issue -- [it *cannot* be used as a "upper layer" of `overlayfs` without a custom patch](http://lists.katacontainers.io/pipermail/kata-dev/2020-January/001216.html).
 
-As `/var/lib/docker` is a `VOLUME` specified by DinD (i.e. the `docker` images tagged `*-dind`/`*-dind-rootless`), `docker` will fail to start (or even worse, silently pick a worse storage driver like `vfs`) when started in a Kata Container. Special measures must be taken when running DinD-powered workloads in Kata Containers.
+As `/var/lib/docker` is a `VOLUME` specified by DinD (i.e. the `docker` images tagged `*-dind`/`*-dind-rootless`), `docker` fill fail to start (or even worse, silently pick a worse storage driver like `vfs`) when started in a Kata Container. Special measures must be taken when running DinD-powered workloads in Kata Containers.
 
 ## Workarounds/Solutions
 
@@ -58,7 +58,7 @@ Thanks to various community contributions (see [issue references below](#referen
 
 ### Use a memory backed volume
 
-For small workloads (small container images, without much generated filesystem load), a memory-backed volume is sufficient. Kubernetes supports a variant of  [the `EmptyDir` volume](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir), which allows for memdisk-backed storage -- the the `medium: Memory`. An example of a `Pod` using such a setup [was contributed](https://github.com/kata-containers/runtime/issues/1429#issuecomment-477385283), and is reproduced below:
+For small workloads (small container images, without much generated filesystem load), a memory-backed volume is sufficient. Kubernetes supports a variant of  [the `EmptyDir` volume][k8s-emptydir], which allows for memdisk-backed storage -- the [the `medium: Memory` ][k8s-memory-volume-type]. An example of a `Pod` using such a setup [was contributed](https://github.com/kata-containers/runtime/issues/1429#issuecomment-477385283), and is reproduced below:
 
 ```yaml
 apiVersion: v1

docs/how-to/how-to-use-kata-containers-with-acrn.md

@@ -101,7 +101,7 @@ Start an ACRN based Kata Container,
 $ sudo docker run -ti --runtime=kata-runtime busybox sh
 ```
 
-You will see ACRN(`acrn-dm`) is now running on your system, as well as a `kata-shim`. You should obtain an interactive shell prompt. Verify that all the Kata processes terminate once you exit the container.
+You will see ACRN(`acrn-dm`) is now running on your system, as well as a `kata-shim`, `kata-proxy`. You should obtain an interactive shell prompt. Verify that all the Kata processes terminate once you exit the container.
 
 ```bash
 $ ps -ef | grep -E "kata|acrn"

docs/how-to/how-to-use-kata-containers-with-firecracker.md

@@ -1,254 +0,0 @@
-# Configure Kata Containers to use Firecracker
-
-This document provides an overview on how to run Kata Containers with the AWS Firecracker hypervisor.
-
-## Introduction
-
-AWS Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services that provide serverless operational models. AWS Firecracker runs workloads in lightweight virtual machines, called `microVMs`, which combine the security and isolation properties provided by hardware virtualization technology with the speed and flexibility of Containers.
-
-Please refer to AWS Firecracker [documentation](https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md) for more details.
-
-## Pre-requisites
-
-This document requires the presence of Kata Containers on your system. Install using the instructions available through the following links:
-
-- Kata Containers [automated installation](../install/README.md)
-
-- Kata Containers manual installation: Automated installation does not seem to be supported for Clear Linux, so please use [manual installation](../Developer-Guide.md) steps.
-> **Note:** Create rootfs image and not initrd image.
-
-## Install AWS Firecracker
-
-Kata Containers only support AWS Firecracker v0.23.4 ([yet](https://github.com/kata-containers/kata-containers/pull/1519)).
-To install Firecracker we need to get the `firecracker` and `jailer` binaries:
-
-```bash
-$ release_url="https://github.com/firecracker-microvm/firecracker/releases"
-$ version="v0.23.1"
-$ arch=`uname -m`
-$ curl ${release_url}/download/${version}/firecracker-${version}-${arch} -o firecracker
-$ curl ${release_url}/download/${version}/jailer-${version}-${arch} -o jailer
-$ chmod +x jailer firecracker
-```
-
-To make the binaries available from the default system `PATH` it is recommended to move them to `/usr/local/bin` or add a symbolic link:
-
-```bash
-$ sudo ln -s $(pwd)/firecracker /usr/local/bin
-$ sudo ln -s $(pwd)/jailer /usr/local/bin
-```
-
-More details can be found in [AWS Firecracker docs](https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md)
-
-In order to run Kata with AWS Firecracker a block device as the backing store for a VM is required. To interact with `containerd` and Kata we use the `devmapper` `snapshotter`.
-
-## Configure `devmapper`
-
-To check support for your `containerd` installation, you can run:
-
-```
-$ ctr plugins ls |grep devmapper
-```
-
-if the output of the above command is:
-
-```
-io.containerd.snapshotter.v1    devmapper                linux/amd64    ok
-```
-then you can skip this section and move on to `Configure Kata Containers with AWS Firecracker`
-
-If the output of the above command is:
-
-```
-io.containerd.snapshotter.v1    devmapper                linux/amd64    error
-```
-
-then we need to setup `devmapper` `snapshotter`. Based on a [very useful
-guide](https://docs.docker.com/storage/storagedriver/device-mapper-driver/)
-from docker, we can set it up using the following scripts:
-
-> **Note:** The following scripts assume a 100G sparse file for storing container images, a 10G sparse file for the thin-provisioning pool and 10G base image files for any sandboxed container created. This means that we will need at least 10GB free space.
-
-```
-#!/bin/bash
-set -ex
-
-DATA_DIR=/var/lib/containerd/devmapper
-POOL_NAME=devpool
-
-mkdir -p ${DATA_DIR}
-
-# Create data file
-sudo touch "${DATA_DIR}/data"
-sudo truncate -s 100G "${DATA_DIR}/data"
-
-# Create metadata file
-sudo touch "${DATA_DIR}/meta"
-sudo truncate -s 10G "${DATA_DIR}/meta"
-
-# Allocate loop devices
-DATA_DEV=$(sudo losetup --find --show "${DATA_DIR}/data")
-META_DEV=$(sudo losetup --find --show "${DATA_DIR}/meta")
-
-# Define thin-pool parameters.
-# See https://www.kernel.org/doc/Documentation/device-mapper/thin-provisioning.txt for details.
-SECTOR_SIZE=512
-DATA_SIZE="$(sudo blockdev --getsize64 -q ${DATA_DEV})"
-LENGTH_IN_SECTORS=$(bc <<< "${DATA_SIZE}/${SECTOR_SIZE}")
-DATA_BLOCK_SIZE=128
-LOW_WATER_MARK=32768
-
-# Create a thin-pool device
-sudo dmsetup create "${POOL_NAME}" \
-    --table "0 ${LENGTH_IN_SECTORS} thin-pool ${META_DEV} ${DATA_DEV} ${DATA_BLOCK_SIZE} ${LOW_WATER_MARK}"
-
-cat << EOF
-#
-# Add this to your config.toml configuration file and restart `containerd` daemon
-#
-[plugins]
-  [plugins.devmapper]
-    pool_name = "${POOL_NAME}"
-    root_path = "${DATA_DIR}"
-    base_image_size = "10GB"
-    discard_blocks = true
-EOF
-```
-
-Make it executable and run it:
-
-```bash
-$ sudo chmod +x ~/scripts/devmapper/create.sh
-$ cd ~/scripts/devmapper/
-$ sudo ./create.sh
-```
-
-Now, we can add the `devmapper` configuration provided from the script to `/etc/containerd/config.toml`.
-> **Note:** If you are using the default `containerd` configuration (`containerd config default >> /etc/containerd/config.toml`), you may need to edit the existing `[plugins."io.containerd.snapshotter.v1.devmapper"]`configuration.
-Save and restart `containerd`:
-
-
-```bash
-$ sudo systemctl restart containerd
-```
-
-We can use `dmsetup` to verify that the thin-pool was created successfully.
-
-```bash
-$ sudo dmsetup ls
-```
-
- We should also check that `devmapper` is registered and running:
-
-```bash
-$ sudo ctr plugins ls | grep devmapper
-```
-
-This script needs to be run only once, while setting up the `devmapper` `snapshotter` for `containerd`. Afterwards, make sure that on each reboot, the thin-pool is initialized from the same data directory. Otherwise, all the fetched containers (or the ones that you have created) will be re-initialized. A simple script that re-creates the thin-pool from the same data directory is shown below:
-
-```
-#!/bin/bash
-set -ex
-
-DATA_DIR=/var/lib/containerd/devmapper
-POOL_NAME=devpool
-
-# Allocate loop devices
-DATA_DEV=$(sudo losetup --find --show "${DATA_DIR}/data")
-META_DEV=$(sudo losetup --find --show "${DATA_DIR}/meta")
-
-# Define thin-pool parameters.
-# See https://www.kernel.org/doc/Documentation/device-mapper/thin-provisioning.txt for details.
-SECTOR_SIZE=512
-DATA_SIZE="$(sudo blockdev --getsize64 -q ${DATA_DEV})"
-LENGTH_IN_SECTORS=$(bc <<< "${DATA_SIZE}/${SECTOR_SIZE}")
-DATA_BLOCK_SIZE=128
-LOW_WATER_MARK=32768
-
-# Create a thin-pool device
-sudo dmsetup create "${POOL_NAME}" \
-    --table "0 ${LENGTH_IN_SECTORS} thin-pool ${META_DEV} ${DATA_DEV} ${DATA_BLOCK_SIZE} ${LOW_WATER_MARK}"
-```
-
-We can create a systemd service to run the above script on each reboot:
-
-```bash
-$ sudo nano /lib/systemd/system/devmapper_reload.service
-```
-
-The service file:
-
-```
-[Unit]
-Description=Devmapper reload script
-
-[Service]
-ExecStart=/path/to/script/reload.sh
-
-[Install]
-WantedBy=multi-user.target
-```
-
-Enable the newly created service:
-
-```bash
-$ sudo systemctl daemon-reload
-$ sudo systemctl enable devmapper_reload.service
-$ sudo systemctl start devmapper_reload.service
-```
-
-## Configure Kata Containers with AWS Firecracker
-
-To configure Kata Containers with AWS Firecracker, copy the generated `configuration-fc.toml` file when building the `kata-runtime` to either `/etc/kata-containers/configuration-fc.toml` or `/usr/share/defaults/kata-containers/configuration-fc.toml`.
-
-The following command shows full paths to the `configuration.toml` files that the runtime loads. It will use the first path that exists. (Please make sure the kernel and image paths are set correctly in the `configuration.toml` file)
-
-```bash
-$ sudo kata-runtime --show-default-config-paths
-```
-
-## Configure `containerd`
-Next, we need to configure containerd. Add a file in your path (e.g. `/usr/local/bin/containerd-shim-kata-fc-v2`) with the following contents:
-
-```
-#!/bin/bash
-KATA_CONF_FILE=/etc/containers/configuration-fc.toml /usr/local/bin/containerd-shim-kata-v2 $@
-```
-> **Note:** You may need to edit the paths of the configuration file and the `containerd-shim-kata-v2` to correspond to your setup.
-
-Make it executable:
-
-```bash
-$ sudo chmod +x /usr/local/bin/containerd-shim-kata-fc-v2
-```
-
-Add the relevant section in `containerd`’s `config.toml` file (`/etc/containerd/config.toml`):
-
-```
-[plugins.cri.containerd.runtimes]
-  [plugins.cri.containerd.runtimes.kata-fc]
-    runtime_type = "io.containerd.kata-fc.v2"
-```
-
-> **Note:** If you are using the default `containerd` configuration (`containerd config default >> /etc/containerd/config.toml`),
-> the configuration should change to :
-```
-[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
-  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-fc]
-    runtime_type = "io.containerd.kata-fc.v2"
-```
-
-Restart `containerd`:
-
-```bash
-$ sudo systemctl restart containerd
-```
-
-## Verify the installation
-
-We are now ready to launch a container using Kata with Firecracker to verify that everything worked:
-
-```bash
-$ sudo ctr images pull --snapshotter devmapper docker.io/library/ubuntu:latest
-$ sudo ctr run --snapshotter devmapper --runtime io.containerd.run.kata-fc.v2 -t --rm docker.io/library/ubuntu
-```

docs/install/container-manager/containerd/containerd-install.md

@@ -81,7 +81,7 @@
   - Download the standard `systemd(1)` service file and install to
     `/etc/systemd/system/`:
 
-    - https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
+    - https://raw.githubusercontent.com/containerd/containerd/master/containerd.service
 
     > **Notes:**
     >

docs/use-cases/GPU-passthrough-and-Kata.md

@@ -3,4 +3,4 @@
 Kata Containers supports passing certain GPUs from the host into the container. Select the GPU vendor for detailed information:
 
 - [Intel](Intel-GPU-passthrough-and-Kata.md)
-- [NVIDIA](NVIDIA-GPU-passthrough-and-Kata.md)
+- [Nvidia](Nvidia-GPU-passthrough-and-Kata.md)

docs/use-cases/NVIDIA-GPU-passthrough-and-Kata.md

@@ -1,372 +0,0 @@
-# Using NVIDIA GPU device with Kata Containers
-
-An NVIDIA GPU device can be passed to a Kata Containers container using GPU
-passthrough (NVIDIA GPU pass-through mode) as well as GPU mediated passthrough
-(NVIDIA vGPU mode).
-
-NVIDIA GPU pass-through mode, an entire physical GPU is directly assigned to one
-VM, bypassing the NVIDIA Virtual GPU Manager. In this mode of operation, the GPU
-is accessed exclusively by the NVIDIA driver running in the VM to which it is
-assigned. The GPU is not shared among VMs.
-
-NVIDIA Virtual GPU (vGPU) enables multiple virtual machines (VMs) to have
-simultaneous, direct access to a single physical GPU, using the same NVIDIA
-graphics drivers that are deployed on non-virtualized operating systems. By
-doing this, NVIDIA vGPU provides VMs with unparalleled graphics performance,
-compute performance, and application compatibility, together with the
-cost-effectiveness and scalability brought about by sharing a GPU among multiple
-workloads. A vGPU can be either time-sliced or Multi-Instance GPU (MIG)-backed
-with [MIG-slices](https://docs.nvidia.com/datacenter/tesla/mig-user-guide/).
-
-| Technology | Description | Behavior | Detail |
-| --- | --- | --- | --- |
-| NVIDIA GPU pass-through mode | GPU passthrough | Physical GPU assigned to a single VM | Direct GPU assignment to VM without limitation |
-| NVIDIA vGPU time-sliced | GPU time-sliced | Physical GPU time-sliced for multiple VMs | Mediated passthrough |
-| NVIDIA vGPU MIG-backed | GPU with MIG-slices | Physical GPU MIG-sliced for multiple VMs | Mediated passthrough |
-
-## Hardware Requirements
-
-NVIDIA GPUs Recommended for Virtualization:
-
-- NVIDIA Tesla (T4, M10, P6, V100 or newer)
-- NVIDIA Quadro RTX 6000/8000
-
-## Host BIOS Requirements
-
-Some hardware requires a larger PCI BARs window, for example, NVIDIA Tesla P100,
-K40m
-
-```sh
-$ lspci -s d0:00.0 -vv | grep Region
-        Region 0: Memory at e7000000 (32-bit, non-prefetchable) [size=16M]
-        Region 1: Memory at 222800000000 (64-bit, prefetchable) [size=32G] # Above 4G
-        Region 3: Memory at 223810000000 (64-bit, prefetchable) [size=32M]
-```
-
-For large BARs devices, MMIO mapping above 4G address space should be `enabled`
-in the PCI configuration of the BIOS.
-
-Some hardware vendors use different name in BIOS, such as:
-
-- Above 4G Decoding
-- Memory Hole for PCI MMIO
-- Memory Mapped I/O above 4GB
-
-If one is using a GPU based on the Ampere architecture and later additionally
-SR-IOV needs to be enabled for the vGPU use-case.
-
-The following steps outline the workflow for using an NVIDIA GPU with Kata.
-
-## Host Kernel Requirements
-
-The following configurations need to be enabled on your host kernel:
-
-- `CONFIG_VFIO`
-- `CONFIG_VFIO_IOMMU_TYPE1`
-- `CONFIG_VFIO_MDEV`
-- `CONFIG_VFIO_MDEV_DEVICE`
-- `CONFIG_VFIO_PCI`
-
-Your host kernel needs to be booted with `intel_iommu=on` on the kernel command
-line.
-
-## Install and configure Kata Containers
-
-To use non-large BARs devices (for example, NVIDIA Tesla T4), you need Kata
-version 1.3.0 or above. Follow the [Kata Containers setup
-instructions](../install/README.md) to install the latest version of Kata.
-
-To use large BARs devices (for example, NVIDIA Tesla P100), you need Kata
-version 1.11.0 or above.
-
-The following configuration in the Kata `configuration.toml` file as shown below
-can work:
-
-Hotplug for PCI devices with small BARs by `acpi_pcihp` (Linux's ACPI PCI
-Hotplug driver):
-
-```sh
-machine_type = "q35"
-
-hotplug_vfio_on_root_bus = false
-```
-
-Hotplug for PCIe devices with large BARs by `pciehp` (Linux's PCIe Hotplug
-driver):
-
-```sh
-machine_type = "q35"
-
-hotplug_vfio_on_root_bus = true
-pcie_root_port = 1
-```
-
-## Build Kata Containers kernel with GPU support
-
-The default guest kernel installed with Kata Containers does not provide GPU
-support. To use an NVIDIA GPU with Kata Containers, you need to build a kernel
-with the necessary GPU support.
-
-The following kernel config options need to be enabled:
-
-```sh
-# Support PCI/PCIe device hotplug (Required for large BARs device)
-CONFIG_HOTPLUG_PCI_PCIE=y
-
-# Support for loading modules (Required for load NVIDIA drivers)
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-
-# Enable the MMIO access method for PCIe devices (Required for large BARs device)
- CONFIG_PCI_MMCONFIG=y
-```
-
-The following kernel config options need to be disabled:
-
-```sh
-# Disable Open Source NVIDIA driver nouveau
-# It conflicts with NVIDIA official driver
-CONFIG_DRM_NOUVEAU=n
-```
-
-> **Note**: `CONFIG_DRM_NOUVEAU` is normally disabled by default.
-It is worth checking that it is not enabled in your kernel configuration to
-prevent any conflicts.
-
-Build the Kata Containers kernel with the previous config options, using the
-instructions described in [Building Kata Containers
-kernel](../../tools/packaging/kernel). For further details on building and
-installing guest kernels, see [the developer
-guide](../Developer-Guide.md#install-guest-kernel-images).
-
-There is an easy way to build a guest kernel that supports NVIDIA GPU:
-
-```sh
-## Build guest kernel with ../../tools/packaging/kernel
-
-# Prepare (download guest kernel source, generate .config)
-$ ./build-kernel.sh -v 5.15.23 -g nvidia -f setup
-
-# Build guest kernel
-$ ./build-kernel.sh -v 5.15.23 -g nvidia build
-
-# Install guest kernel
-$ sudo -E ./build-kernel.sh -v 5.15.23 -g nvidia install
-```
-
-To build NVIDIA Driver in Kata container, `linux-headers` is required.
-This is a way to generate deb packages for `linux-headers`:
-
-> **Note**:
-> Run `make rpm-pkg` to build the rpm package.
-> Run `make deb-pkg` to build the deb package.
->
-
-```sh
-$ cd kata-linux-5.15.23-89
-$ make deb-pkg
-```
-Before using the new guest kernel, please update the `kernel` parameters in
- `configuration.toml`.
-
-```sh
-kernel = "/usr/share/kata-containers/vmlinuz-nvidia-gpu.container"
-```
-
-## NVIDIA GPU pass-through mode with Kata Containers
-
-Use the following steps to pass an NVIDIA GPU device in pass-through mode with Kata:
-
-1. Find the Bus-Device-Function (BDF) for GPU device on host:
-
-   ```sh
-   $ sudo lspci -nn -D | grep -i nvidia
-   0000:d0:00.0 3D controller [0302]: NVIDIA Corporation Device [10de:20b9] (rev a1)
-   ```
-
-   > PCI address `0000:d0:00.0` is assigned to the hardware GPU device.
-   > `10de:20b9` is the device ID of the hardware GPU device.
-
-2. Find the IOMMU group for the GPU device:
-
-   ```sh
-   $ BDF="0000:d0:00.0"
-   $ readlink -e /sys/bus/pci/devices/$BDF/iommu_group
-   ```
-
-   The previous output shows that the GPU belongs to IOMMU group 192. The next
-   step is to bind the GPU to the VFIO-PCI driver.
-
-   ```sh
-   $ BDF="0000:d0:00.0"
-   $ DEV="/sys/bus/pci/devices/$BDF"
-   $ echo "vfio-pci" > $DEV/driver_override
-   $ echo $BDF > $DEV/driver/unbind
-   $ echo $BDF > /sys/bus/pci/drivers_probe
-   # To return the device to the standard driver, we simply clear the
-   # driver_override and reprobe the device, ex:
-   $ echo > $DEV/preferred_driver
-   $ echo $BDF > $DEV/driver/unbind
-   $ echo $BDF > /sys/bus/pci/drivers_probe
-   ```
-
-3. Check the IOMMU group number under `/dev/vfio`:
-
-   ```sh
-   $ ls -l /dev/vfio
-   total 0
-   crw------- 1 zvonkok zvonkok 243,   0 Mar 18 03:06 192
-   crw-rw-rw- 1 root    root     10, 196 Mar 18 02:27 vfio
-   ```
-
-4. Start a Kata container with GPU device:
-
-   ```sh
-   # You may need to `modprobe vhost-vsock` if you get
-   # host system doesn't support vsock: stat /dev/vhost-vsock
-   $ sudo ctr --debug run --runtime "io.containerd.kata.v2"  --device /dev/vfio/192  --rm -t  "docker.io/library/archlinux:latest" arch uname -r
-   ```
-
-5. Run `lspci` within the container to verify the GPU device is seen in the list
-   of the PCI devices. Note the vendor-device id of the GPU (`10de:20b9`) in the `lspci` output.
-
-   ```sh
-   $ sudo ctr --debug run --runtime "io.containerd.kata.v2"  --device /dev/vfio/192  --rm -t  "docker.io/library/archlinux:latest" arch sh -c "lspci -nn | grep '10de:20b9'"
-   ```
-
-6. Additionally, you can check the PCI BARs space of ​​the NVIDIA GPU device in the container:
-
-   ```sh
-   $ sudo ctr --debug run --runtime "io.containerd.kata.v2"  --device /dev/vfio/192  --rm -t  "docker.io/library/archlinux:latest" arch sh -c "lspci -s 02:00.0 -vv | grep Region"
-   ```
-
-   > **Note**: If you see a message similar to the above, the BAR space of the NVIDIA
-   > GPU has been successfully allocated.
-
-## NVIDIA vGPU mode with Kata Containers
-
-NVIDIA vGPU is a licensed product on all supported GPU boards. A software license
-is required to enable all vGPU features within the guest VM.
-
-> **TODO**: Will follow up with instructions
-
-## Install NVIDIA Driver + Toolkit in Kata Containers Guest OS
-
-Consult the [Developer-Guide](https://github.com/kata-containers/kata-containers/blob/main/docs/Developer-Guide.md#create-a-rootfs-image) on how to create a
-rootfs base image for a distribution of your choice. This is going to be used as
-a base for a NVIDIA enabled guest OS. Use the `EXTRA_PKGS` variable to install
-all the needed packages to compile the drivers. Also copy the kernel development
-packages from the previous `make deb-pkg` into `$ROOTFS_DIR`.
-
-```sh
-export EXTRA_PKGS="gcc make curl gnupg"
-```
-
-Having the `$ROOTFS_DIR` exported in the previous step we can now install all the
-need parts in the guest OS. In this case we have an Ubuntu based rootfs.
-
-First off all mount the special filesystems into the rootfs
-
-```sh
-$ sudo mount -t sysfs -o ro none ${ROOTFS_DIR}/sys
-$ sudo mount -t proc -o ro none ${ROOTFS_DIR}/proc
-$ sudo mount -t tmpfs none ${ROOTFS_DIR}/tmp
-$ sudo mount -o bind,ro /dev ${ROOTFS_DIR}/dev
-$ sudo mount -t devpts none ${ROOTFS_DIR}/dev/pts
-```
-
-Now we can enter `chroot`
-
-```sh
-$ sudo chroot ${ROOTFS_DIR}
-```
-
-Inside the rootfs one is going to install the drivers and toolkit to enable easy
-creation of GPU containers with Kata. We can also use this rootfs for any other
-container not specifically only for GPUs.
-
-As a prerequisite install the copied kernel development packages
-
-```sh
-$ sudo dpkg -i *.deb
-```
-
-Get the driver run file, since we need to build the driver against a kernel that
-is not running on the host we need the ability to specify the exact version we
-want the driver to build against. Take the kernel version one used for building
-the NVIDIA kernel (`5.15.23-nvidia-gpu`).
-
-```sh
-$ wget https://us.download.nvidia.com/XFree86/Linux-x86_64/510.54/NVIDIA-Linux-x86_64-510.54.run
-$ chmod +x NVIDIA-Linux-x86_64-510.54.run
-# Extract the source files so we can run the installer with arguments
-$ ./NVIDIA-Linux-x86_64-510.54.run -x
-$ cd NVIDIA-Linux-x86_64-510.54
-$ ./nvidia-installer -k 5.15.23-nvidia-gpu
-```
-Having the drivers installed we need to install the toolkit which will take care
-of providing the right bits into the container.
-
-```sh
-$ distribution=$(. /etc/os-release;echo $ID$VERSION_ID)
-$ curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
-$ curl -s -L https://nvidia.github.io/libnvidia-container/$distribution/libnvidia-container.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
-$ apt update
-$ apt install nvidia-container-toolkit
-```
-
-Create the hook execution file for Kata:
-
-```
-# Content of $ROOTFS_DIR/usr/share/oci/hooks/prestart/nvidia-container-toolkit.sh
-
-#!/bin/bash -x
-
-/usr/bin/nvidia-container-toolkit -debug $@
-```
-
-As a last step one can do some cleanup of files or package caches. Build the
-rootfs and configure it for use with Kata according to the development guide.
-
-Enable the `guest_hook_path` in Kata's `configuration.toml`
-
-```sh
-guest_hook_path = "/usr/share/oci/hooks"
-```
-
-One has build a NVIDIA rootfs, kernel and now we can run any GPU container
-without installing the drivers into the container. Check NVIDIA device status
-with `nvidia-smi`
-
-```sh
-$  sudo ctr --debug run --runtime "io.containerd.kata.v2"  --device /dev/vfio/192  --rm -t "docker.io/nvidia/cuda:11.6.0-base-ubuntu20.04" cuda nvidia-smi
-Fri Mar 18 10:36:59 2022
-+-----------------------------------------------------------------------------+
-| NVIDIA-SMI 510.54       Driver Version: 510.54       CUDA Version: 11.6     |
-|-------------------------------+----------------------+----------------------+
-| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile Uncorr. ECC |
-| Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util  Compute M. |
-|                               |                      |               MIG M. |
-|===============================+======================+======================|
-|   0  NVIDIA A30X         Off  | 00000000:02:00.0 Off |                    0 |
-| N/A   38C    P0    67W / 230W |      0MiB / 24576MiB |      0%      Default |
-|                               |                      |             Disabled |
-+-------------------------------+----------------------+----------------------+
-
-+-----------------------------------------------------------------------------+
-| Processes:                                                                  |
-|  GPU   GI   CI        PID   Type   Process name                  GPU Memory |
-|        ID   ID                                                   Usage      |
-|=============================================================================|
-|  No running processes found                                                 |
-+-----------------------------------------------------------------------------+
-```
-
-As a last step one can remove the additional packages and files that were added
-to the `$ROOTFS_DIR` to keep it as small as possible.
-
-## References
-
-- [Configuring a VM for GPU Pass-Through by Using the QEMU Command Line](https://docs.nvidia.com/grid/latest/grid-vgpu-user-guide/index.html#using-gpu-pass-through-red-hat-el-qemu-cli)
-- https://gitlab.com/nvidia/container-images/driver/-/tree/master
-- https://github.com/NVIDIA/nvidia-docker/wiki/Driver-containers

docs/use-cases/Nvidia-GPU-passthrough-and-Kata.md

@@ -0,0 +1,293 @@
+# Using Nvidia GPU device with Kata Containers
+
+An Nvidia GPU device can be passed to a Kata Containers container using GPU passthrough
+(Nvidia GPU pass-through mode) as well as GPU mediated passthrough (Nvidia vGPU mode). 
+
+Nvidia GPU pass-through mode, an entire physical GPU is directly assigned to one VM,
+bypassing the Nvidia Virtual GPU Manager. In this mode of operation, the GPU is accessed
+exclusively by the Nvidia driver running in the VM to which it is assigned.
+The GPU is not shared among VMs.
+
+Nvidia Virtual GPU (vGPU) enables multiple virtual machines (VMs) to have simultaneous,
+direct access to a single physical GPU, using the same Nvidia graphics drivers that are
+deployed on non-virtualized operating systems. By doing this, Nvidia vGPU provides VMs
+with unparalleled graphics performance, compute performance, and application compatibility,
+together with the cost-effectiveness and scalability brought about by sharing a GPU
+among multiple workloads.
+
+| Technology | Description | Behaviour | Detail |
+| --- | --- | --- | --- |
+| Nvidia GPU pass-through mode | GPU passthrough | Physical GPU assigned to a single VM | Direct GPU assignment to VM without limitation |
+| Nvidia vGPU mode | GPU sharing | Physical GPU shared by multiple VMs | Mediated passthrough |
+
+## Hardware Requirements
+Nvidia GPUs Recommended for Virtualization:
+
+- Nvidia Tesla (T4, M10, P6, V100 or newer)
+- Nvidia Quadro RTX 6000/8000
+
+## Host BIOS Requirements
+
+Some hardware requires a larger PCI BARs window, for example, Nvidia Tesla P100, K40m
+```
+$ lspci -s 04:00.0 -vv | grep Region
+      Region 0: Memory at c6000000 (32-bit, non-prefetchable) [size=16M]
+      Region 1: Memory at 383800000000 (64-bit, prefetchable) [size=16G] #above 4G
+      Region 3: Memory at 383c00000000 (64-bit, prefetchable) [size=32M]
+```
+
+For large BARs devices, MMIO mapping above 4G address space should be `enabled`
+in the PCI configuration of the BIOS.
+
+Some hardware vendors use different name in BIOS, such as:
+
+- Above 4G Decoding
+- Memory Hole for PCI MMIO
+- Memory Mapped I/O above 4GB
+
+The following steps outline the workflow for using an Nvidia GPU with Kata.
+
+## Host Kernel Requirements
+The following configurations need to be enabled on your host kernel:
+
+- `CONFIG_VFIO`
+- `CONFIG_VFIO_IOMMU_TYPE1`
+- `CONFIG_VFIO_MDEV`
+- `CONFIG_VFIO_MDEV_DEVICE`
+- `CONFIG_VFIO_PCI`
+
+Your host kernel needs to be booted with `intel_iommu=on` on the kernel command line.
+
+## Install and configure Kata Containers
+To use non-large BARs devices (for example, Nvidia Tesla T4), you need Kata version 1.3.0 or above.
+Follow the [Kata Containers setup instructions](../install/README.md)
+to install the latest version of Kata.
+
+To use large BARs devices (for example, Nvidia Tesla P100), you need Kata version 1.11.0 or above.
+
+The following configuration in the Kata `configuration.toml` file as shown below can work:
+
+Hotplug for PCI devices by `acpi_pcihp` (Linux's ACPI PCI Hotplug driver):
+```
+machine_type = "q35"
+
+hotplug_vfio_on_root_bus = false
+```
+
+Hotplug for PCIe devices by `pciehp` (Linux's PCIe Hotplug driver):
+```
+machine_type = "q35"
+
+hotplug_vfio_on_root_bus = true
+pcie_root_port = 1
+```
+
+## Build Kata Containers kernel with GPU support
+The default guest kernel installed with Kata Containers does not provide GPU support.
+To use an Nvidia GPU with Kata Containers, you need to build a kernel with the
+necessary GPU support.
+
+The following kernel config options need to be enabled:
+```
+# Support PCI/PCIe device hotplug (Required for large BARs device)
+CONFIG_HOTPLUG_PCI_PCIE=y
+
+# Support for loading modules (Required for load Nvidia drivers)
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+
+# Enable the MMIO access method for PCIe devices (Required for large BARs device)
+CONFIG_PCI_MMCONFIG=y
+```
+
+The following kernel config options need to be disabled:
+```
+# Disable Open Source Nvidia driver nouveau
+# It conflicts with Nvidia official driver
+CONFIG_DRM_NOUVEAU=n
+```
+> **Note**: `CONFIG_DRM_NOUVEAU` is normally disabled by default.
+It is worth checking that it is not enabled in your kernel configuration to prevent any conflicts.
+
+
+Build the Kata Containers kernel with the previous config options,
+using the instructions described in [Building Kata Containers kernel](../../tools/packaging/kernel).
+For further details on building and installing guest kernels,
+see [the developer guide](../Developer-Guide.md#install-guest-kernel-images).
+
+There is an easy way to build a guest kernel that supports Nvidia GPU:
+```
+## Build guest kernel with ../../tools/packaging/kernel
+
+# Prepare (download guest kernel source, generate .config)
+$ ./build-kernel.sh -v 4.19.86 -g nvidia -f setup
+
+# Build guest kernel
+$ ./build-kernel.sh -v 4.19.86 -g nvidia build
+
+# Install guest kernel
+$ sudo -E ./build-kernel.sh -v 4.19.86 -g nvidia install
+/usr/share/kata-containers/vmlinux-nvidia-gpu.container -> vmlinux-4.19.86-70-nvidia-gpu
+/usr/share/kata-containers/vmlinuz-nvidia-gpu.container -> vmlinuz-4.19.86-70-nvidia-gpu
+```
+
+To build Nvidia Driver in Kata container, `kernel-devel` is required.  
+This is a way to generate rpm packages for `kernel-devel`:
+```
+$ cd kata-linux-4.19.86-68
+$ make rpm-pkg
+Output RPMs:
+~/rpmbuild/RPMS/x86_64/kernel-devel-4.19.86_nvidia_gpu-1.x86_64.rpm
+```
+> **Note**:
+> - `kernel-devel` should be installed in Kata container before run Nvidia driver installer.
+> - Run `make deb-pkg` to build the deb package.
+
+Before using the new guest kernel, please update the `kernel` parameters in `configuration.toml`.
+```
+kernel = "/usr/share/kata-containers/vmlinuz-nvidia-gpu.container"
+```
+
+## Nvidia GPU pass-through mode with Kata Containers
+Use the following steps to pass an Nvidia GPU device in pass-through mode with Kata:
+
+1. Find the Bus-Device-Function (BDF) for GPU device on host:
+   ```
+   $ sudo lspci -nn -D | grep -i nvidia
+   0000:04:00.0 3D controller [0302]: NVIDIA Corporation Device [10de:15f8] (rev a1)
+   0000:84:00.0 3D controller [0302]: NVIDIA Corporation Device [10de:15f8] (rev a1)
+   ```
+   > PCI address `0000:04:00.0` is assigned to the hardware GPU device.
+   > `10de:15f8` is the device ID of the hardware GPU device.
+
+2. Find the IOMMU group for the GPU device:
+   ```
+   $ BDF="0000:04:00.0"
+   $ readlink -e /sys/bus/pci/devices/$BDF/iommu_group
+   /sys/kernel/iommu_groups/45
+   ```
+   The previous output shows that the GPU belongs to IOMMU group 45.
+
+3. Check the IOMMU group number under `/dev/vfio`:
+   ```
+   $ ls -l /dev/vfio
+   total 0
+   crw------- 1 root root 248,   0 Feb 28 09:57 45
+   crw------- 1 root root 248,   1 Feb 28 09:57 54
+   crw-rw-rw- 1 root root  10, 196 Feb 28 09:57 vfio
+   ```
+
+4. Start a Kata container with GPU device:
+   ```
+   $ sudo docker run -it --runtime=kata-runtime --cap-add=ALL --device /dev/vfio/45 centos /bin/bash
+   ```
+
+5. Run `lspci` within the container to verify the GPU device is seen in the list
+   of the PCI devices. Note the vendor-device id of the GPU (`10de:15f8`) in the `lspci` output.
+   ```
+   $ lspci -nn -D | grep '10de:15f8'
+   0000:01:01.0 3D controller [0302]: NVIDIA Corporation GP100GL [Tesla P100 PCIe 16GB] [10de:15f8] (rev a1)
+   ```
+
+6. Additionally, you can check the PCI BARs space of ​​the Nvidia GPU device in the container:
+   ```
+   $ lspci -s 01:01.0 -vv | grep Region
+		Region 0: Memory at c0000000 (32-bit, non-prefetchable) [disabled] [size=16M]
+		Region 1: Memory at 4400000000 (64-bit, prefetchable) [disabled] [size=16G]
+		Region 3: Memory at 4800000000 (64-bit, prefetchable) [disabled] [size=32M]
+   ```
+   > **Note**: If you see a message similar to the above, the BAR space of the Nvidia
+   > GPU has been successfully allocated.
+
+## Nvidia vGPU mode with Kata Containers
+
+Nvidia vGPU is a licensed product on all supported GPU boards. A software license
+is required to enable all vGPU features within the guest VM.
+
+> **Note**: There is no suitable test environment, so it is not written here.
+
+
+## Install Nvidia Driver in Kata Containers
+Download the official Nvidia driver from
+[https://www.nvidia.com/Download/index.aspx](https://www.nvidia.com/Download/index.aspx),
+for example `NVIDIA-Linux-x86_64-418.87.01.run`.
+
+Install the `kernel-devel`(generated in the previous steps) for guest kernel:
+```
+$ sudo rpm -ivh kernel-devel-4.19.86_gpu-1.x86_64.rpm
+```
+
+Here is an example to extract, compile and install Nvidia driver:
+```
+## Extract
+$ sh ./NVIDIA-Linux-x86_64-418.87.01.run -x
+
+## Compile and install (It will take some time)
+$ cd NVIDIA-Linux-x86_64-418.87.01
+$ sudo ./nvidia-installer -a -q --ui=none \
+ --no-cc-version-check \
+ --no-opengl-files --no-install-libglvnd \
+ --kernel-source-path=/usr/src/kernels/`uname -r`
+```
+
+Or just run one command line:
+```
+$ sudo sh ./NVIDIA-Linux-x86_64-418.87.01.run -a -q --ui=none \
+ --no-cc-version-check \
+ --no-opengl-files --no-install-libglvnd \
+ --kernel-source-path=/usr/src/kernels/`uname -r`
+```
+
+To view detailed logs of the installer:
+```
+$ tail -f /var/log/nvidia-installer.log
+```
+
+Load Nvidia driver module manually
+```
+# Optional（generate modules.dep and map files for Nvidia driver）
+$ sudo depmod
+
+# Load module
+$ sudo modprobe nvidia-drm
+
+# Check module
+$ lsmod | grep nvidia
+nvidia_drm             45056  0
+nvidia_modeset       1093632  1 nvidia_drm
+nvidia              18202624  1 nvidia_modeset
+drm_kms_helper        159744  1 nvidia_drm
+drm                   364544  3 nvidia_drm,drm_kms_helper
+i2c_core               65536  3 nvidia,drm_kms_helper,drm
+ipmi_msghandler        49152  1 nvidia
+```
+
+
+Check Nvidia device status with `nvidia-smi`
+```
+$ nvidia-smi
+Tue Mar  3 00:03:49 2020
++-----------------------------------------------------------------------------+
+| NVIDIA-SMI 418.87.01    Driver Version: 418.87.01    CUDA Version: 10.1     |
+|-------------------------------+----------------------+----------------------+
+| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile Uncorr. ECC |
+| Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util  Compute M. |
+|===============================+======================+======================|
+|   0  Tesla P100-PCIE...  Off  | 00000000:01:01.0 Off |                    0 |
+| N/A   27C    P0    25W / 250W |      0MiB / 16280MiB |      0%      Default |
++-------------------------------+----------------------+----------------------+
+
++-----------------------------------------------------------------------------+
+| Processes:                                                       GPU Memory |
+|  GPU       PID   Type   Process name                             Usage      |
+|=============================================================================|
+|  No running processes found                                                 |
++-----------------------------------------------------------------------------+
+
+```
+
+## References
+
+- [Configuring a VM for GPU Pass-Through by Using the QEMU Command Line](https://docs.nvidia.com/grid/latest/grid-vgpu-user-guide/index.html#using-gpu-pass-through-red-hat-el-qemu-cli)
+- https://gitlab.com/nvidia/container-images/driver/-/tree/master
+- https://github.com/NVIDIA/nvidia-docker/wiki/Driver-containers

docs/use-cases/using-vpp-and-kata.md

@@ -0,0 +1,76 @@
+# Setup to run VPP
+
+The Data Plane Development Kit (DPDK) is a set of libraries and drivers for
+fast packet processing. Vector Packet Processing (VPP) is a platform
+extensible framework that provides out-of-the-box production quality
+switch and router functionality. VPP is a high performance packet-processing
+stack that can run on commodity CPUs. Enabling VPP with DPDK support can
+yield significant performance improvements over a Linux\* bridge providing a
+switch with DPDK VHOST-USER ports.
+
+For more information about VPP visit their [wiki](https://wiki.fd.io/view/VPP).
+
+## Install and configure Kata Containers
+
+Follow  the [Kata Containers setup instructions](../Developer-Guide.md).
+
+In order to make use of VHOST-USER based interfaces, the container needs to be backed
+by huge pages. `HugePages` support is required for the large memory pool allocation used for
+DPDK packet buffers.  This is a feature which must be configured within the Linux Kernel. See
+[the DPDK documentation](https://doc.dpdk.org/guides/linux_gsg/sys_reqs.html#use-of-hugepages-in-the-linux-environment)
+for details on how to enable for the host. After enabling huge pages support on the host system,
+update the Kata configuration to enable huge page support in the guest kernel:
+
+```
+$ sudo sed -i -e 's/^# *\(enable_hugepages\).*=.*$/\1 = true/g' /usr/share/defaults/kata-containers/configuration.toml
+```
+
+
+## Install VPP
+
+Follow the [VPP installation instructions](https://wiki.fd.io/view/VPP/Installing_VPP_binaries_from_packages).
+
+After a successful installation, your host system is ready to start
+connecting Kata Containers with VPP bridges.
+
+### Install the VPP Docker\* plugin
+
+To create a Docker network and connect Kata Containers easily to that network through
+Docker, install a VPP Docker plugin.
+
+To install the plugin, follow the [plugin installation instructions](https://github.com/clearcontainers/vpp).
+
+This VPP plugin allows the creation of a VPP network. Every container added
+to this network is connected through an L2 bridge-domain provided by VPP.
+
+## Example: Launch two Kata Containers using VPP
+
+To use VPP, use Docker to create a network that makes use of VPP.
+For example:
+
+```
+$ sudo docker network create -d=vpp --ipam-driver=vpp --subnet=192.168.1.0/24 --gateway=192.168.1.1  vpp_net
+```
+
+Test connectivity by launching two containers:
+```
+$ sudo docker run --runtime=kata-runtime --net=vpp_net --ip=192.168.1.2 --mac-address=CA:FE:CA:FE:01:02 -it busybox bash -c "ip a; ip route; sleep 300"
+
+$ sudo docker run --runtime=kata-runtime --net=vpp_net --ip=192.168.1.3 --mac-address=CA:FE:CA:FE:01:03 -it busybox bash -c "ip a; ip route; ping 192.168.1.2"
+```
+
+These commands setup two Kata Containers connected via a VPP L2 bridge
+domain. The first of the two VMs displays the networking details and then
+sleeps providing a period of time for it to be pinged. The second
+VM displays its networking details and then pings the first VM, verifying
+connectivity between them.
+
+After verifying connectivity, cleanup with the following commands:
+
+```
+$ sudo docker kill $(sudo docker ps --no-trunc -aq)
+$ sudo docker rm $(sudo docker ps --no-trunc -aq)
+$ sudo docker network rm vpp_net
+$ sudo service vpp stop
+```
+

src/agent/Cargo.lock

@@ -1370,7 +1370,6 @@ dependencies = [
  "async-trait",
  "capctl",
  "caps",
- "cfg-if 0.1.10",
  "cgroups-rs",
  "futures",
  "inotify",

src/agent/Cargo.toml

@@ -76,13 +76,3 @@ lto = true
 
 [features]
 seccomp = ["rustjail/seccomp"]
-standard-oci-runtime = ["rustjail/standard-oci-runtime"]
-
-[[bin]]
-name = "kata-agent"
-path = "src/main.rs"
-
-[[bin]]
-name = "oci-kata-agent"
-path = "src/main.rs"
-required-features = ["standard-oci-runtime"]

src/agent/Makefile

@@ -14,6 +14,10 @@ PROJECT_COMPONENT = kata-agent
 
 TARGET = $(PROJECT_COMPONENT)
 
+SOURCES := \
+  $(shell find . 2>&1 | grep -E '.*\.rs$$') \
+  Cargo.toml
+
 VERSION_FILE := ./VERSION
 VERSION := $(shell grep -v ^\# $(VERSION_FILE))
 COMMIT_NO := $(shell git rev-parse HEAD 2>/dev/null || true)
@@ -33,16 +37,8 @@ ifeq ($(SECCOMP),yes)
     override EXTRA_RUSTFEATURES += seccomp
 endif
 
-##VAR STANDARD_OCI_RUNTIME=yes|no define if agent enables standard oci runtime feature
-STANDARD_OCI_RUNTIME := no
-
-# Enable standard oci runtime feature of rust build
-ifeq ($(STANDARD_OCI_RUNTIME),yes)
-    override EXTRA_RUSTFEATURES += standard-oci-runtime
-endif
-
 ifneq ($(EXTRA_RUSTFEATURES),)
-    override EXTRA_RUSTFEATURES := --features "$(EXTRA_RUSTFEATURES)"
+    override EXTRA_RUSTFEATURES := --features $(EXTRA_RUSTFEATURES)
 endif
 
 include ../../utils.mk
@@ -112,14 +108,14 @@ $(TARGET): $(GENERATED_CODE) logging-crate-tests $(TARGET_PATH)
 logging-crate-tests:
 	make -C $(CWD)/../libs/logging
 
-$(TARGET_PATH): show-summary
+$(TARGET_PATH): $(SOURCES) | show-summary
 	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
 
 $(GENERATED_FILES): %: %.in
 	@sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@"
 
 ##TARGET optimize: optimized  build
-optimize: show-summary show-header
+optimize: $(SOURCES) | show-summary show-header
 	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
 
 ##TARGET install: install agent

src/agent/rustjail/Cargo.toml

@@ -25,7 +25,6 @@ path-absolutize = "1.2.0"
 anyhow = "1.0.32"
 cgroups = { package = "cgroups-rs", version = "0.2.8" }
 rlimit = "0.5.3"
-cfg-if = "0.1.0"
 
 tokio = { version = "1.2.0", features = ["sync", "io-util", "process", "time", "macros"] }
 futures = "0.3.17"
@@ -39,4 +38,3 @@ tempfile = "3.1.0"
 
 [features]
 seccomp = ["libseccomp"]
-standard-oci-runtime = []

src/agent/rustjail/src/cgroups/notifier.rs

@@ -151,12 +151,12 @@ async fn register_memory_event(
     let eventfd = eventfd(0, EfdFlags::EFD_CLOEXEC)?;
 
     let event_control_path = Path::new(&cg_dir).join("cgroup.event_control");
-
-    let data = if arg.is_empty() {
-        format!("{} {}", eventfd, event_file.as_raw_fd())
+    let data;
+    if arg.is_empty() {
+        data = format!("{} {}", eventfd, event_file.as_raw_fd());
     } else {
-        format!("{} {} {}", eventfd, event_file.as_raw_fd(), arg)
-    };
+        data = format!("{} {} {}", eventfd, event_file.as_raw_fd(), arg);
+    }
 
     fs::write(&event_control_path, data)?;
 

src/agent/rustjail/src/console.rs

@@ -1,82 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//
-// Copyright 2021 Sony Group Corporation
-//
-
-use anyhow::{anyhow, Result};
-use nix::errno::Errno;
-use nix::pty;
-use nix::sys::{socket, uio};
-use nix::unistd::{self, dup2};
-use std::os::unix::io::{AsRawFd, RawFd};
-use std::path::Path;
-
-pub fn setup_console_socket(csocket_path: &str) -> Result<Option<RawFd>> {
-    if csocket_path.is_empty() {
-        return Ok(None);
-    }
-
-    let socket_fd = socket::socket(
-        socket::AddressFamily::Unix,
-        socket::SockType::Stream,
-        socket::SockFlag::empty(),
-        None,
-    )?;
-
-    match socket::connect(
-        socket_fd,
-        &socket::SockAddr::Unix(socket::UnixAddr::new(Path::new(csocket_path))?),
-    ) {
-        Ok(()) => Ok(Some(socket_fd)),
-        Err(errno) => Err(anyhow!("failed to open console fd: {}", errno)),
-    }
-}
-
-pub fn setup_master_console(socket_fd: RawFd) -> Result<()> {
-    let pseudo = pty::openpty(None, None)?;
-
-    let pty_name: &[u8] = b"/dev/ptmx";
-    let iov = [uio::IoVec::from_slice(pty_name)];
-    let fds = [pseudo.master];
-    let cmsg = socket::ControlMessage::ScmRights(&fds);
-
-    socket::sendmsg(socket_fd, &iov, &[cmsg], socket::MsgFlags::empty(), None)?;
-
-    unistd::setsid()?;
-    let ret = unsafe { libc::ioctl(pseudo.slave, libc::TIOCSCTTY) };
-    Errno::result(ret).map_err(|e| anyhow!(e).context("ioctl TIOCSCTTY"))?;
-
-    dup2(pseudo.slave, std::io::stdin().as_raw_fd())?;
-    dup2(pseudo.slave, std::io::stdout().as_raw_fd())?;
-    dup2(pseudo.slave, std::io::stderr().as_raw_fd())?;
-
-    unistd::close(socket_fd)?;
-
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::skip_if_not_root;
-    use std::fs::File;
-    use std::os::unix::net::UnixListener;
-    use std::path::PathBuf;
-    use tempfile::{self, tempdir};
-
-    const CONSOLE_SOCKET: &str = "console-socket";
-
-    #[test]
-    fn test_setup_console_socket() {
-        let dir = tempdir()
-            .map_err(|e| anyhow!(e).context("tempdir failed"))
-            .unwrap();
-        let socket_path = dir.path().join(CONSOLE_SOCKET);
-
-        let _listener = UnixListener::bind(&socket_path).unwrap();
-
-        let ret = setup_console_socket(socket_path.to_str().unwrap());
-
-        assert!(ret.is_ok());
-    }
-}

src/agent/rustjail/src/container.rs

@@ -23,8 +23,6 @@ use crate::cgroups::fs::Manager as FsManager;
 #[cfg(test)]
 use crate::cgroups::mock::Manager as FsManager;
 use crate::cgroups::Manager;
-#[cfg(feature = "standard-oci-runtime")]
-use crate::console;
 use crate::log_child;
 use crate::process::Process;
 #[cfg(feature = "seccomp")]
@@ -66,7 +64,7 @@ use tokio::sync::Mutex;
 
 use crate::utils;
 
-pub const EXEC_FIFO_FILENAME: &str = "exec.fifo";
+const EXEC_FIFO_FILENAME: &str = "exec.fifo";
 
 const INIT: &str = "INIT";
 const NO_PIVOT: &str = "NO_PIVOT";
@@ -76,10 +74,6 @@ const CLOG_FD: &str = "CLOG_FD";
 const FIFO_FD: &str = "FIFO_FD";
 const HOME_ENV_KEY: &str = "HOME";
 const PIDNS_FD: &str = "PIDNS_FD";
-const CONSOLE_SOCKET_FD: &str = "CONSOLE_SOCKET_FD";
-
-#[cfg(feature = "standard-oci-runtime")]
-const OCI_AGENT_BINARY: &str = "oci-kata-agent";
 
 #[derive(Debug)]
 pub struct ContainerStatus {
@@ -88,7 +82,7 @@ pub struct ContainerStatus {
 }
 
 impl ContainerStatus {
-    pub fn new() -> Self {
+    fn new() -> Self {
         ContainerStatus {
             pre_status: ContainerState::Created,
             cur_status: ContainerState::Created,
@@ -105,12 +99,6 @@ impl ContainerStatus {
     }
 }
 
-impl Default for ContainerStatus {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
 pub type Config = CreateOpts;
 type NamespaceType = String;
 
@@ -118,7 +106,7 @@ lazy_static! {
     // This locker ensures the child exit signal will be received by the right receiver.
     pub static ref WAIT_PID_LOCKER: Arc<Mutex<bool>> = Arc::new(Mutex::new(false));
 
-    pub static ref NAMESPACES: HashMap<&'static str, CloneFlags> = {
+    static ref NAMESPACES: HashMap<&'static str, CloneFlags> = {
         let mut m = HashMap::new();
         m.insert("user", CloneFlags::CLONE_NEWUSER);
         m.insert("ipc", CloneFlags::CLONE_NEWIPC);
@@ -131,7 +119,7 @@ lazy_static! {
     };
 
 // type to name hashmap, better to be in NAMESPACES
-    pub static ref TYPETONAME: HashMap<&'static str, &'static str> = {
+    static ref TYPETONAME: HashMap<&'static str, &'static str> = {
         let mut m = HashMap::new();
         m.insert("ipc", "ipc");
         m.insert("user", "user");
@@ -248,8 +236,6 @@ pub struct LinuxContainer {
     pub status: ContainerStatus,
     pub created: SystemTime,
     pub logger: Logger,
-    #[cfg(feature = "standard-oci-runtime")]
-    pub console_socket: PathBuf,
 }
 
 #[derive(Serialize, Deserialize, Debug)]
@@ -373,6 +359,7 @@ fn do_init_child(cwfd: RawFd) -> Result<()> {
             )));
         }
     }
+
     log_child!(cfd_log, "child process start run");
     let buf = read_sync(crfd)?;
     let spec_str = std::str::from_utf8(&buf)?;
@@ -392,9 +379,6 @@ fn do_init_child(cwfd: RawFd) -> Result<()> {
 
     let cm: FsManager = serde_json::from_str(cm_str)?;
 
-    #[cfg(feature = "standard-oci-runtime")]
-    let csocket_fd = console::setup_console_socket(&std::env::var(CONSOLE_SOCKET_FD)?)?;
-
     let p = if spec.process.is_some() {
         spec.process.as_ref().unwrap()
     } else {
@@ -686,19 +670,10 @@ fn do_init_child(cwfd: RawFd) -> Result<()> {
     let _ = unistd::close(crfd);
     let _ = unistd::close(cwfd);
 
+    unistd::setsid().context("create a new session")?;
     if oci_process.terminal {
-        cfg_if::cfg_if! {
-            if #[cfg(feature = "standard-oci-runtime")] {
-                if let Some(csocket_fd) = csocket_fd {
-                    console::setup_master_console(csocket_fd)?;
-                } else {
-                    return Err(anyhow!("failed to get console master socket fd"));
-                }
-            }
-            else {
-                unistd::setsid().context("create a new session")?;
-                unsafe { libc::ioctl(0, libc::TIOCSCTTY) };
-            }
+        unsafe {
+            libc::ioctl(0, libc::TIOCSCTTY);
         }
     }
 
@@ -951,24 +926,8 @@ impl BaseContainer for LinuxContainer {
             let _ = unistd::close(pid);
         });
 
-        cfg_if::cfg_if! {
-            if #[cfg(feature = "standard-oci-runtime")] {
-                let exec_path = PathBuf::from(OCI_AGENT_BINARY);
-            }
-            else {
-                let exec_path = std::env::current_exe()?;
-            }
-        }
-
+        let exec_path = std::env::current_exe()?;
         let mut child = std::process::Command::new(exec_path);
-
-        #[allow(unused_mut)]
-        let mut console_name = PathBuf::from("");
-        #[cfg(feature = "standard-oci-runtime")]
-        if !self.console_socket.as_os_str().is_empty() {
-            console_name = self.console_socket.clone();
-        }
-
         let mut child = child
             .arg("init")
             .stdin(child_stdin)
@@ -978,8 +937,7 @@ impl BaseContainer for LinuxContainer {
             .env(NO_PIVOT, format!("{}", self.config.no_pivot_root))
             .env(CRFD_FD, format!("{}", crfd))
             .env(CWFD_FD, format!("{}", cwfd))
-            .env(CLOG_FD, format!("{}", cfd_log))
-            .env(CONSOLE_SOCKET_FD, console_name);
+            .env(CLOG_FD, format!("{}", cfd_log));
 
         if p.init {
             child = child.env(FIFO_FD, format!("{}", fifofd));
@@ -1074,7 +1032,19 @@ impl BaseContainer for LinuxContainer {
         let st = self.oci_state()?;
 
         for pid in self.processes.keys() {
-            signal::kill(Pid::from_raw(*pid), Some(Signal::SIGKILL))?;
+            match signal::kill(Pid::from_raw(*pid), Some(Signal::SIGKILL)) {
+                Err(Errno::ESRCH) => {
+                    info!(
+                        self.logger,
+                        "kill encounters ESRCH, pid: {}, container: {}",
+                        pid,
+                        self.id.clone()
+                    );
+                    continue;
+                }
+                Err(err) => return Err(anyhow!(err)),
+                Ok(_) => continue,
+            }
         }
 
         if spec.hooks.is_some() {
@@ -1461,16 +1431,8 @@ impl LinuxContainer {
                 .unwrap()
                 .as_secs(),
             logger: logger.new(o!("module" => "rustjail", "subsystem" => "container", "cid" => id)),
-            #[cfg(feature = "standard-oci-runtime")]
-            console_socket: Path::new("").to_path_buf(),
         })
     }
-
-    #[cfg(feature = "standard-oci-runtime")]
-    pub fn set_console_socket(&mut self, console_socket: &Path) -> Result<()> {
-        self.console_socket = console_socket.to_path_buf();
-        Ok(())
-    }
 }
 
 fn setgroups(grps: &[libc::gid_t]) -> Result<()> {
@@ -1510,7 +1472,7 @@ use std::process::Stdio;
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 
-pub async fn execute_hook(logger: &Logger, h: &Hook, st: &OCIState) -> Result<()> {
+async fn execute_hook(logger: &Logger, h: &Hook, st: &OCIState) -> Result<()> {
     let logger = logger.new(o!("action" => "execute-hook"));
 
     let binary = PathBuf::from(h.path.as_str());

src/agent/rustjail/src/lib.rs

@@ -30,8 +30,6 @@ extern crate regex;
 
 pub mod capabilities;
 pub mod cgroups;
-#[cfg(feature = "standard-oci-runtime")]
-pub mod console;
 pub mod container;
 pub mod mount;
 pub mod pipestream;
@@ -353,12 +351,13 @@ fn seccomp_grpc_to_oci(sec: &grpc::LinuxSeccomp) -> oci::LinuxSeccomp {
 
         for sys in sec.Syscalls.iter() {
             let mut args = Vec::new();
+            let errno_ret: u32;
 
-            let errno_ret: u32 = if sys.has_errnoret() {
-                sys.get_errnoret()
+            if sys.has_errnoret() {
+                errno_ret = sys.get_errnoret();
             } else {
-                libc::EPERM as u32
-            };
+                errno_ret = libc::EPERM as u32;
+            }
 
             for arg in sys.Args.iter() {
                 args.push(oci::LinuxSeccompArg {
@@ -514,7 +513,6 @@ pub fn grpc_to_oci(grpc: &grpc::Spec) -> oci::Spec {
 
 #[cfg(test)]
 mod tests {
-    use super::*;
     #[macro_export]
     macro_rules! skip_if_not_root {
         () => {
@@ -524,595 +522,4 @@ mod tests {
             }
         };
     }
-
-    // Parameters:
-    //
-    // 1: expected Result
-    // 2: actual Result
-    // 3: string used to identify the test on error
-    #[macro_export]
-    macro_rules! assert_result {
-        ($expected_result:expr, $actual_result:expr, $msg:expr) => {
-            if $expected_result.is_ok() {
-                let expected_value = $expected_result.as_ref().unwrap();
-                let actual_value = $actual_result.unwrap();
-                assert!(*expected_value == actual_value, "{}", $msg);
-            } else {
-                assert!($actual_result.is_err(), "{}", $msg);
-
-                let expected_error = $expected_result.as_ref().unwrap_err();
-                let expected_error_msg = format!("{:?}", expected_error);
-
-                let actual_error_msg = format!("{:?}", $actual_result.unwrap_err());
-
-                assert!(expected_error_msg == actual_error_msg, "{}", $msg);
-            }
-        };
-    }
-
-    #[test]
-    fn test_process_grpc_to_oci() {
-        #[derive(Debug)]
-        struct TestData {
-            grpcproc: grpc::Process,
-            result: oci::Process,
-        }
-
-        let tests = &[
-            TestData {
-                // All fields specified
-                grpcproc: grpc::Process {
-                    Terminal: true,
-                    ConsoleSize: protobuf::SingularPtrField::<grpc::Box>::some(grpc::Box {
-                        Height: 123,
-                        Width: 456,
-                        ..Default::default()
-                    }),
-                    User: protobuf::SingularPtrField::<grpc::User>::some(grpc::User {
-                        UID: 1234,
-                        GID: 5678,
-                        AdditionalGids: Vec::from([910, 1112]),
-                        Username: String::from("username"),
-                        ..Default::default()
-                    }),
-                    Args: protobuf::RepeatedField::from(Vec::from([
-                        String::from("arg1"),
-                        String::from("arg2"),
-                    ])),
-                    Env: protobuf::RepeatedField::from(Vec::from([String::from("env")])),
-                    Cwd: String::from("cwd"),
-                    Capabilities: protobuf::SingularPtrField::some(grpc::LinuxCapabilities {
-                        Bounding: protobuf::RepeatedField::from(Vec::from([String::from("bnd")])),
-                        Effective: protobuf::RepeatedField::from(Vec::from([String::from("eff")])),
-                        Inheritable: protobuf::RepeatedField::from(Vec::from([String::from(
-                            "inher",
-                        )])),
-                        Permitted: protobuf::RepeatedField::from(Vec::from([String::from("perm")])),
-                        Ambient: protobuf::RepeatedField::from(Vec::from([String::from("amb")])),
-                        ..Default::default()
-                    }),
-                    Rlimits: protobuf::RepeatedField::from(Vec::from([
-                        grpc::POSIXRlimit {
-                            Type: String::from("r#type"),
-                            Hard: 123,
-                            Soft: 456,
-                            ..Default::default()
-                        },
-                        grpc::POSIXRlimit {
-                            Type: String::from("r#type2"),
-                            Hard: 789,
-                            Soft: 1011,
-                            ..Default::default()
-                        },
-                    ])),
-                    NoNewPrivileges: true,
-                    ApparmorProfile: String::from("apparmor profile"),
-                    OOMScoreAdj: 123456,
-                    SelinuxLabel: String::from("Selinux Label"),
-                    ..Default::default()
-                },
-                result: oci::Process {
-                    terminal: true,
-                    console_size: Some(oci::Box {
-                        height: 123,
-                        width: 456,
-                    }),
-                    user: oci::User {
-                        uid: 1234,
-                        gid: 5678,
-                        additional_gids: Vec::from([910, 1112]),
-                        username: String::from("username"),
-                    },
-                    args: Vec::from([String::from("arg1"), String::from("arg2")]),
-                    env: Vec::from([String::from("env")]),
-                    cwd: String::from("cwd"),
-                    capabilities: Some(oci::LinuxCapabilities {
-                        bounding: Vec::from([String::from("bnd")]),
-                        effective: Vec::from([String::from("eff")]),
-                        inheritable: Vec::from([String::from("inher")]),
-                        permitted: Vec::from([String::from("perm")]),
-                        ambient: Vec::from([String::from("amb")]),
-                    }),
-                    rlimits: Vec::from([
-                        oci::PosixRlimit {
-                            r#type: String::from("r#type"),
-                            hard: 123,
-                            soft: 456,
-                        },
-                        oci::PosixRlimit {
-                            r#type: String::from("r#type2"),
-                            hard: 789,
-                            soft: 1011,
-                        },
-                    ]),
-                    no_new_privileges: true,
-                    apparmor_profile: String::from("apparmor profile"),
-                    oom_score_adj: Some(123456),
-                    selinux_label: String::from("Selinux Label"),
-                },
-            },
-            TestData {
-                // None ConsoleSize
-                grpcproc: grpc::Process {
-                    ConsoleSize: protobuf::SingularPtrField::<grpc::Box>::none(),
-                    OOMScoreAdj: 0,
-                    ..Default::default()
-                },
-                result: oci::Process {
-                    console_size: None,
-                    oom_score_adj: Some(0),
-                    ..Default::default()
-                },
-            },
-            TestData {
-                // None User
-                grpcproc: grpc::Process {
-                    User: protobuf::SingularPtrField::<grpc::User>::none(),
-                    OOMScoreAdj: 0,
-                    ..Default::default()
-                },
-                result: oci::Process {
-                    user: oci::User {
-                        uid: 0,
-                        gid: 0,
-                        additional_gids: vec![],
-                        username: String::from(""),
-                    },
-                    oom_score_adj: Some(0),
-                    ..Default::default()
-                },
-            },
-            TestData {
-                // None Capabilities
-                grpcproc: grpc::Process {
-                    Capabilities: protobuf::SingularPtrField::none(),
-                    OOMScoreAdj: 0,
-                    ..Default::default()
-                },
-                result: oci::Process {
-                    capabilities: None,
-                    oom_score_adj: Some(0),
-                    ..Default::default()
-                },
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-
-            let result = process_grpc_to_oci(&d.grpcproc);
-
-            let msg = format!("{}, result: {:?}", msg, result);
-
-            assert_eq!(d.result, result, "{}", msg);
-        }
-    }
-
-    #[test]
-    fn test_root_grpc_to_oci() {
-        #[derive(Debug)]
-        struct TestData {
-            grpcroot: grpc::Root,
-            result: oci::Root,
-        }
-
-        let tests = &[
-            TestData {
-                // Default fields
-                grpcroot: grpc::Root {
-                    ..Default::default()
-                },
-                result: oci::Root {
-                    ..Default::default()
-                },
-            },
-            TestData {
-                // Specified fields, readonly false
-                grpcroot: grpc::Root {
-                    Path: String::from("path"),
-                    Readonly: false,
-                    ..Default::default()
-                },
-                result: oci::Root {
-                    path: String::from("path"),
-                    readonly: false,
-                    ..Default::default()
-                },
-            },
-            TestData {
-                // Specified fields, readonly true
-                grpcroot: grpc::Root {
-                    Path: String::from("path"),
-                    Readonly: true,
-                    ..Default::default()
-                },
-                result: oci::Root {
-                    path: String::from("path"),
-                    readonly: true,
-                    ..Default::default()
-                },
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-
-            let result = root_grpc_to_oci(&d.grpcroot);
-
-            let msg = format!("{}, result: {:?}", msg, result);
-
-            assert_eq!(d.result, result, "{}", msg);
-        }
-    }
-
-    #[test]
-    fn test_hooks_grpc_to_oci() {
-        #[derive(Debug)]
-        struct TestData {
-            grpchooks: grpc::Hooks,
-            result: oci::Hooks,
-        }
-
-        let tests = &[
-            TestData {
-                // Default fields
-                grpchooks: grpc::Hooks {
-                    ..Default::default()
-                },
-                result: oci::Hooks {
-                    ..Default::default()
-                },
-            },
-            TestData {
-                // All specified
-                grpchooks: grpc::Hooks {
-                    Prestart: protobuf::RepeatedField::from(Vec::from([
-                        grpc::Hook {
-                            Path: String::from("prestartpath"),
-                            Args: protobuf::RepeatedField::from(Vec::from([
-                                String::from("arg1"),
-                                String::from("arg2"),
-                            ])),
-                            Env: protobuf::RepeatedField::from(Vec::from([
-                                String::from("env1"),
-                                String::from("env2"),
-                            ])),
-                            Timeout: 10,
-                            ..Default::default()
-                        },
-                        grpc::Hook {
-                            Path: String::from("prestartpath2"),
-                            Args: protobuf::RepeatedField::from(Vec::from([
-                                String::from("arg3"),
-                                String::from("arg4"),
-                            ])),
-                            Env: protobuf::RepeatedField::from(Vec::from([
-                                String::from("env3"),
-                                String::from("env4"),
-                            ])),
-                            Timeout: 25,
-                            ..Default::default()
-                        },
-                    ])),
-                    Poststart: protobuf::RepeatedField::from(Vec::from([grpc::Hook {
-                        Path: String::from("poststartpath"),
-                        Args: protobuf::RepeatedField::from(Vec::from([
-                            String::from("arg1"),
-                            String::from("arg2"),
-                        ])),
-                        Env: protobuf::RepeatedField::from(Vec::from([
-                            String::from("env1"),
-                            String::from("env2"),
-                        ])),
-                        Timeout: 10,
-                        ..Default::default()
-                    }])),
-                    Poststop: protobuf::RepeatedField::from(Vec::from([grpc::Hook {
-                        Path: String::from("poststoppath"),
-                        Args: protobuf::RepeatedField::from(Vec::from([
-                            String::from("arg1"),
-                            String::from("arg2"),
-                        ])),
-                        Env: protobuf::RepeatedField::from(Vec::from([
-                            String::from("env1"),
-                            String::from("env2"),
-                        ])),
-                        Timeout: 10,
-                        ..Default::default()
-                    }])),
-                    ..Default::default()
-                },
-                result: oci::Hooks {
-                    prestart: Vec::from([
-                        oci::Hook {
-                            path: String::from("prestartpath"),
-                            args: Vec::from([String::from("arg1"), String::from("arg2")]),
-                            env: Vec::from([String::from("env1"), String::from("env2")]),
-                            timeout: Some(10),
-                        },
-                        oci::Hook {
-                            path: String::from("prestartpath2"),
-                            args: Vec::from([String::from("arg3"), String::from("arg4")]),
-                            env: Vec::from([String::from("env3"), String::from("env4")]),
-                            timeout: Some(25),
-                        },
-                    ]),
-                    poststart: Vec::from([oci::Hook {
-                        path: String::from("poststartpath"),
-                        args: Vec::from([String::from("arg1"), String::from("arg2")]),
-                        env: Vec::from([String::from("env1"), String::from("env2")]),
-                        timeout: Some(10),
-                    }]),
-                    poststop: Vec::from([oci::Hook {
-                        path: String::from("poststoppath"),
-                        args: Vec::from([String::from("arg1"), String::from("arg2")]),
-                        env: Vec::from([String::from("env1"), String::from("env2")]),
-                        timeout: Some(10),
-                    }]),
-                },
-            },
-            TestData {
-                // Prestart empty
-                grpchooks: grpc::Hooks {
-                    Prestart: protobuf::RepeatedField::from(Vec::from([])),
-                    Poststart: protobuf::RepeatedField::from(Vec::from([grpc::Hook {
-                        Path: String::from("poststartpath"),
-                        Args: protobuf::RepeatedField::from(Vec::from([
-                            String::from("arg1"),
-                            String::from("arg2"),
-                        ])),
-                        Env: protobuf::RepeatedField::from(Vec::from([
-                            String::from("env1"),
-                            String::from("env2"),
-                        ])),
-                        Timeout: 10,
-                        ..Default::default()
-                    }])),
-                    Poststop: protobuf::RepeatedField::from(Vec::from([grpc::Hook {
-                        Path: String::from("poststoppath"),
-                        Args: protobuf::RepeatedField::from(Vec::from([
-                            String::from("arg1"),
-                            String::from("arg2"),
-                        ])),
-                        Env: protobuf::RepeatedField::from(Vec::from([
-                            String::from("env1"),
-                            String::from("env2"),
-                        ])),
-                        Timeout: 10,
-                        ..Default::default()
-                    }])),
-                    ..Default::default()
-                },
-                result: oci::Hooks {
-                    prestart: Vec::from([]),
-                    poststart: Vec::from([oci::Hook {
-                        path: String::from("poststartpath"),
-                        args: Vec::from([String::from("arg1"), String::from("arg2")]),
-                        env: Vec::from([String::from("env1"), String::from("env2")]),
-                        timeout: Some(10),
-                    }]),
-                    poststop: Vec::from([oci::Hook {
-                        path: String::from("poststoppath"),
-                        args: Vec::from([String::from("arg1"), String::from("arg2")]),
-                        env: Vec::from([String::from("env1"), String::from("env2")]),
-                        timeout: Some(10),
-                    }]),
-                },
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-
-            let result = hooks_grpc_to_oci(&d.grpchooks);
-
-            let msg = format!("{}, result: {:?}", msg, result);
-
-            assert_eq!(d.result, result, "{}", msg);
-        }
-    }
-
-    #[test]
-    fn test_mount_grpc_to_oci() {
-        #[derive(Debug)]
-        struct TestData {
-            grpcmount: grpc::Mount,
-            result: oci::Mount,
-        }
-
-        let tests = &[
-            TestData {
-                // Default fields
-                grpcmount: grpc::Mount {
-                    ..Default::default()
-                },
-                result: oci::Mount {
-                    ..Default::default()
-                },
-            },
-            TestData {
-                grpcmount: grpc::Mount {
-                    destination: String::from("destination"),
-                    source: String::from("source"),
-                    field_type: String::from("fieldtype"),
-                    options: protobuf::RepeatedField::from(Vec::from([
-                        String::from("option1"),
-                        String::from("option2"),
-                    ])),
-                    ..Default::default()
-                },
-                result: oci::Mount {
-                    destination: String::from("destination"),
-                    source: String::from("source"),
-                    r#type: String::from("fieldtype"),
-                    options: Vec::from([String::from("option1"), String::from("option2")]),
-                },
-            },
-            TestData {
-                grpcmount: grpc::Mount {
-                    destination: String::from("destination"),
-                    source: String::from("source"),
-                    field_type: String::from("fieldtype"),
-                    options: protobuf::RepeatedField::from(Vec::new()),
-                    ..Default::default()
-                },
-                result: oci::Mount {
-                    destination: String::from("destination"),
-                    source: String::from("source"),
-                    r#type: String::from("fieldtype"),
-                    options: Vec::new(),
-                },
-            },
-            TestData {
-                grpcmount: grpc::Mount {
-                    destination: String::new(),
-                    source: String::from("source"),
-                    field_type: String::from("fieldtype"),
-                    options: protobuf::RepeatedField::from(Vec::from([String::from("option1")])),
-                    ..Default::default()
-                },
-                result: oci::Mount {
-                    destination: String::new(),
-                    source: String::from("source"),
-                    r#type: String::from("fieldtype"),
-                    options: Vec::from([String::from("option1")]),
-                },
-            },
-            TestData {
-                grpcmount: grpc::Mount {
-                    destination: String::from("destination"),
-                    source: String::from("source"),
-                    field_type: String::new(),
-                    options: protobuf::RepeatedField::from(Vec::from([String::from("option1")])),
-                    ..Default::default()
-                },
-                result: oci::Mount {
-                    destination: String::from("destination"),
-                    source: String::from("source"),
-                    r#type: String::new(),
-                    options: Vec::from([String::from("option1")]),
-                },
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-
-            let result = mount_grpc_to_oci(&d.grpcmount);
-
-            let msg = format!("{}, result: {:?}", msg, result);
-
-            assert_eq!(d.result, result, "{}", msg);
-        }
-    }
-
-    #[test]
-    fn test_hook_grpc_to_oci<'a>() {
-        #[derive(Debug)]
-        struct TestData<'a> {
-            grpchook: &'a [grpc::Hook],
-            result: Vec<oci::Hook>,
-        }
-
-        let tests = &[
-            TestData {
-                // Default fields
-                grpchook: &[
-                    grpc::Hook {
-                        Timeout: 0,
-                        ..Default::default()
-                    },
-                    grpc::Hook {
-                        Timeout: 0,
-                        ..Default::default()
-                    },
-                ],
-                result: vec![
-                    oci::Hook {
-                        timeout: Some(0),
-                        ..Default::default()
-                    },
-                    oci::Hook {
-                        timeout: Some(0),
-                        ..Default::default()
-                    },
-                ],
-            },
-            TestData {
-                // Specified fields
-                grpchook: &[
-                    grpc::Hook {
-                        Path: String::from("path"),
-                        Args: protobuf::RepeatedField::from(Vec::from([
-                            String::from("arg1"),
-                            String::from("arg2"),
-                        ])),
-                        Env: protobuf::RepeatedField::from(Vec::from([
-                            String::from("env1"),
-                            String::from("env2"),
-                        ])),
-                        Timeout: 10,
-                        ..Default::default()
-                    },
-                    grpc::Hook {
-                        Path: String::from("path2"),
-                        Args: protobuf::RepeatedField::from(Vec::from([
-                            String::from("arg3"),
-                            String::from("arg4"),
-                        ])),
-                        Env: protobuf::RepeatedField::from(Vec::from([
-                            String::from("env3"),
-                            String::from("env4"),
-                        ])),
-                        Timeout: 20,
-                        ..Default::default()
-                    },
-                ],
-                result: vec![
-                    oci::Hook {
-                        path: String::from("path"),
-                        args: Vec::from([String::from("arg1"), String::from("arg2")]),
-                        env: Vec::from([String::from("env1"), String::from("env2")]),
-                        timeout: Some(10),
-                    },
-                    oci::Hook {
-                        path: String::from("path2"),
-                        args: Vec::from([String::from("arg3"), String::from("arg4")]),
-                        env: Vec::from([String::from("env3"), String::from("env4")]),
-                        timeout: Some(20),
-                    },
-                ],
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-
-            let result = hook_grpc_to_oci(d.grpchook);
-
-            let msg = format!("{}, result: {:?}", msg, result);
-
-            assert_eq!(d.result, result, "{}", msg);
-        }
-    }
 }

src/agent/rustjail/src/mount.rs

@@ -32,21 +32,16 @@ use crate::log_child;
 
 // Info reveals information about a particular mounted filesystem. This
 // struct is populated from the content in the /proc/<pid>/mountinfo file.
-#[derive(std::fmt::Debug, PartialEq)]
+#[derive(std::fmt::Debug)]
 pub struct Info {
     mount_point: String,
     optional: String,
     fstype: String,
 }
 
-const MOUNTINFO_FORMAT: &str = "{d} {d} {d}:{d} {} {} {} {}";
-const MOUNTINFO_PATH: &str = "/proc/self/mountinfo";
+const MOUNTINFOFORMAT: &str = "{d} {d} {d}:{d} {} {} {} {}";
 const PROC_PATH: &str = "/proc";
 
-const ERR_FAILED_PARSE_MOUNTINFO: &str = "failed to parse mountinfo file";
-const ERR_FAILED_PARSE_MOUNTINFO_FINAL_FIELDS: &str =
-    "failed to parse final fields in mountinfo file";
-
 // since libc didn't defined this const for musl, thus redefined it here.
 #[cfg(all(target_os = "linux", target_env = "gnu", not(target_arch = "s390x")))]
 const PROC_SUPER_MAGIC: libc::c_long = 0x00009fa0;
@@ -523,7 +518,7 @@ pub fn pivot_rootfs<P: ?Sized + NixPath + std::fmt::Debug>(path: &P) -> Result<(
 }
 
 fn rootfs_parent_mount_private(path: &str) -> Result<()> {
-    let mount_infos = parse_mount_table(MOUNTINFO_PATH)?;
+    let mount_infos = parse_mount_table()?;
 
     let mut max_len = 0;
     let mut mount_point = String::from("");
@@ -551,8 +546,8 @@ fn rootfs_parent_mount_private(path: &str) -> Result<()> {
 
 // Parse /proc/self/mountinfo because comparing Dev and ino does not work from
 // bind mounts
-fn parse_mount_table(mountinfo_path: &str) -> Result<Vec<Info>> {
-    let file = File::open(mountinfo_path)?;
+fn parse_mount_table() -> Result<Vec<Info>> {
+    let file = File::open("/proc/self/mountinfo")?;
     let reader = BufReader::new(file);
     let mut infos = Vec::new();
 
@@ -574,7 +569,7 @@ fn parse_mount_table(mountinfo_path: &str) -> Result<Vec<Info>> {
 
         let (_id, _parent, _major, _minor, _root, mount_point, _opts, optional) = scan_fmt!(
             &line,
-            MOUNTINFO_FORMAT,
+            MOUNTINFOFORMAT,
             i32,
             i32,
             i32,
@@ -583,17 +578,12 @@ fn parse_mount_table(mountinfo_path: &str) -> Result<Vec<Info>> {
             String,
             String,
             String
-        )
-        .map_err(|_| anyhow!(ERR_FAILED_PARSE_MOUNTINFO))?;
+        )?;
 
         let fields: Vec<&str> = line.split(" - ").collect();
         if fields.len() == 2 {
-            let final_fields: Vec<&str> = fields[1].split_whitespace().collect();
-
-            if final_fields.len() != 3 {
-                return Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO_FINAL_FIELDS));
-            }
-            let fstype = final_fields[0].to_string();
+            let (fstype, _source, _vfs_opts) =
+                scan_fmt!(fields[1], "{} {} {}", String, String, String)?;
 
             let mut optional_new = String::new();
             if optional != "-" {
@@ -608,7 +598,7 @@ fn parse_mount_table(mountinfo_path: &str) -> Result<Vec<Info>> {
 
             infos.push(info);
         } else {
-            return Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO));
+            return Err(anyhow!("failed to parse mount info file".to_string()));
         }
     }
 
@@ -629,7 +619,7 @@ fn chroot<P: ?Sized + NixPath>(_path: &P) -> Result<(), nix::Error> {
 
 pub fn ms_move_root(rootfs: &str) -> Result<bool> {
     unistd::chdir(rootfs)?;
-    let mount_infos = parse_mount_table(MOUNTINFO_PATH)?;
+    let mount_infos = parse_mount_table()?;
 
     let root_path = Path::new(rootfs);
     let abs_root_buf = root_path.absolutize()?;
@@ -1056,12 +1046,10 @@ fn readonly_path(path: &str) -> Result<()> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::assert_result;
     use crate::skip_if_not_root;
     use std::fs::create_dir;
     use std::fs::create_dir_all;
     use std::fs::remove_dir_all;
-    use std::io;
     use std::os::unix::fs;
     use std::os::unix::io::AsRawFd;
     use tempfile::tempdir;
@@ -1298,113 +1286,6 @@ mod tests {
         let ret = stat::stat(path);
         assert!(ret.is_ok(), "Should pass. Got: {:?}", ret);
     }
-
-    #[test]
-    fn test_mount_from() {
-        #[derive(Debug)]
-        struct TestData<'a> {
-            source: &'a str,
-            destination: &'a str,
-            r#type: &'a str,
-            flags: MsFlags,
-            error_contains: &'a str,
-
-            // if true, a directory will be created at path in source
-            make_source_directory: bool,
-            // if true, a file will be created at path in source
-            make_source_file: bool,
-        }
-
-        impl Default for TestData<'_> {
-            fn default() -> Self {
-                TestData {
-                    source: "tmp",
-                    destination: "dest",
-                    r#type: "tmpfs",
-                    flags: MsFlags::empty(),
-                    error_contains: "",
-                    make_source_directory: true,
-                    make_source_file: false,
-                }
-            }
-        }
-
-        let tests = &[
-            TestData {
-                ..Default::default()
-            },
-            TestData {
-                flags: MsFlags::MS_BIND,
-                ..Default::default()
-            },
-            TestData {
-                r#type: "bind",
-                ..Default::default()
-            },
-            TestData {
-                r#type: "cgroup2",
-                ..Default::default()
-            },
-            TestData {
-                r#type: "bind",
-                make_source_directory: false,
-                error_contains: &format!("{}", std::io::Error::from_raw_os_error(libc::ENOENT)),
-                ..Default::default()
-            },
-            TestData {
-                r#type: "bind",
-                make_source_directory: false,
-                make_source_file: true,
-                ..Default::default()
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-            let tempdir = tempdir().unwrap();
-
-            let (rfd, wfd) = unistd::pipe2(OFlag::O_CLOEXEC).unwrap();
-            defer!({
-                unistd::close(rfd).unwrap();
-                unistd::close(wfd).unwrap();
-            });
-
-            let source_path = tempdir.path().join(d.source).to_str().unwrap().to_string();
-            if d.make_source_directory {
-                std::fs::create_dir_all(&source_path).unwrap();
-            } else if d.make_source_file {
-                std::fs::write(&source_path, []).unwrap();
-            }
-
-            let mount = Mount {
-                source: source_path,
-                destination: d.destination.to_string(),
-                r#type: d.r#type.to_string(),
-                options: vec![],
-            };
-
-            let result = mount_from(
-                wfd,
-                &mount,
-                tempdir.path().to_str().unwrap(),
-                d.flags,
-                "",
-                "",
-            );
-
-            let msg = format!("{}: result: {:?}", msg, result);
-
-            if d.error_contains.is_empty() {
-                assert!(result.is_ok(), "{}", msg);
-            } else {
-                assert!(result.is_err(), "{}", msg);
-
-                let error_msg = format!("{}", result.unwrap_err());
-                assert!(error_msg.contains(d.error_contains), "{}", msg);
-            }
-        }
-    }
-
     #[test]
     fn test_check_proc_mount() {
         let mount = oci::Mount {
@@ -1520,121 +1401,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn test_parse_mount_table() {
-        #[derive(Debug)]
-        struct TestData<'a> {
-            mountinfo_data: Option<&'a str>,
-            result: Result<Vec<Info>>,
-        }
-
-        let tests = &[
-            TestData {
-                mountinfo_data: Some(
-                    "22 933 0:20 / /sys rw,nodev shared:2 - sysfs sysfs rw,noexec",
-                ),
-                result: Ok(vec![Info {
-                    mount_point: "/sys".to_string(),
-                    optional: "shared:2".to_string(),
-                    fstype: "sysfs".to_string(),
-                }]),
-            },
-            TestData {
-                mountinfo_data: Some(
-                    r#"22 933 0:20 / /sys rw,nodev - sysfs sysfs rw,noexec
-                       81 13 1:2 / /tmp/dir rw shared:2 - tmpfs tmpfs rw"#,
-                ),
-                result: Ok(vec![
-                    Info {
-                        mount_point: "/sys".to_string(),
-                        optional: "".to_string(),
-                        fstype: "sysfs".to_string(),
-                    },
-                    Info {
-                        mount_point: "/tmp/dir".to_string(),
-                        optional: "shared:2".to_string(),
-                        fstype: "tmpfs".to_string(),
-                    },
-                ]),
-            },
-            TestData {
-                mountinfo_data: Some(
-                    "22 933 0:20 /foo\040-\040bar /sys rw,nodev shared:2 - sysfs sysfs rw,noexec",
-                ),
-                result: Ok(vec![Info {
-                    mount_point: "/sys".to_string(),
-                    optional: "shared:2".to_string(),
-                    fstype: "sysfs".to_string(),
-                }]),
-            },
-            TestData {
-                mountinfo_data: Some(""),
-                result: Ok(vec![]),
-            },
-            TestData {
-                mountinfo_data: Some("invalid line data - sysfs sysfs rw"),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO)),
-            },
-            TestData {
-                mountinfo_data: Some("22 96 0:21 / /sys rw,noexec - sysfs"),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO_FINAL_FIELDS)),
-            },
-            TestData {
-                mountinfo_data: Some("22 96 0:21 / /sys rw,noexec - sysfs sysfs rw rw"),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO_FINAL_FIELDS)),
-            },
-            TestData {
-                mountinfo_data: Some("22 96 0:21 / /sys rw,noexec shared:2 - x - x"),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO)),
-            },
-            TestData {
-                mountinfo_data: Some("-"),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO)),
-            },
-            TestData {
-                mountinfo_data: Some("--"),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO)),
-            },
-            TestData {
-                mountinfo_data: Some("- -"),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO)),
-            },
-            TestData {
-                mountinfo_data: Some(" - "),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO)),
-            },
-            TestData {
-                mountinfo_data: Some(
-                    r#"22 933 0:20 / /sys rw,nodev - sysfs sysfs rw,noexec
-                       invalid line
-                       81 13 1:2 / /tmp/dir rw shared:2 - tmpfs tmpfs rw"#,
-                ),
-                result: Err(anyhow!(ERR_FAILED_PARSE_MOUNTINFO)),
-            },
-            TestData {
-                mountinfo_data: None,
-                result: Err(anyhow!(io::Error::from_raw_os_error(libc::ENOENT))),
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-
-            let tempdir = tempdir().unwrap();
-            let mountinfo_path = tempdir.path().join("mountinfo");
-
-            if let Some(mountinfo_data) = d.mountinfo_data {
-                std::fs::write(&mountinfo_path, mountinfo_data).unwrap();
-            }
-
-            let result = parse_mount_table(mountinfo_path.to_str().unwrap());
-
-            let msg = format!("{}: result: {:?}", msg, result);
-
-            assert_result!(d.result, result, msg);
-        }
-    }
-
     #[test]
     fn test_dev_rel_path() {
         // Valid device paths

src/agent/rustjail/src/specconv.rs

@@ -5,7 +5,7 @@
 
 use oci::Spec;
 
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+#[derive(Debug)]
 pub struct CreateOpts {
     pub cgroup_name: String,
     pub use_systemd_cgroup: bool,

src/agent/rustjail/src/utils.rs

@@ -97,13 +97,12 @@ mod tests {
         let temp_passwd = format!("{}/passwd", tmpdir_path);
 
         let mut tempf = File::create(temp_passwd.as_str()).unwrap();
-        let passwd_entries = "root:x:0:0:root:/root0:/bin/bash
-root:x:1:0:root:/root1:/bin/bash
-#root:x:1:0:root:/rootx:/bin/bash
-root:x:2:0:root:/root2:/bin/bash
-root:x:3:0:root:/root3
-root:x:3:0:root:/root3:/bin/bash";
-        writeln!(tempf, "{}", passwd_entries).unwrap();
+        writeln!(tempf, "root:x:0:0:root:/root0:/bin/bash").unwrap();
+        writeln!(tempf, "root:x:1:0:root:/root1:/bin/bash").unwrap();
+        writeln!(tempf, "#root:x:1:0:root:/rootx:/bin/bash").unwrap();
+        writeln!(tempf, "root:x:2:0:root:/root2:/bin/bash").unwrap();
+        writeln!(tempf, "root:x:3:0:root:/root3").unwrap();
+        writeln!(tempf, "root:x:3:0:root:/root3:/bin/bash").unwrap();
 
         let entry = get_entry_by_uid(0, temp_passwd.as_str()).unwrap();
         assert_eq!(entry.dir.as_str(), "/root0");

src/agent/src/main.rs

@@ -125,7 +125,9 @@ fn announce(logger: &Logger, config: &AgentConfig) {
 // output to the vsock port specified, or stdout.
 async fn create_logger_task(rfd: RawFd, vsock_port: u32, shutdown: Receiver<bool>) -> Result<()> {
     let mut reader = PipeStream::from_fd(rfd);
-    let mut writer: Box<dyn AsyncWrite + Unpin + Send> = if vsock_port > 0 {
+    let mut writer: Box<dyn AsyncWrite + Unpin + Send>;
+
+    if vsock_port > 0 {
         let listenfd = socket::socket(
             AddressFamily::Vsock,
             SockType::Stream,
@@ -137,10 +139,10 @@ async fn create_logger_task(rfd: RawFd, vsock_port: u32, shutdown: Receiver<bool
         socket::bind(listenfd, &addr)?;
         socket::listen(listenfd, 1)?;
 
-        Box::new(util::get_vsock_stream(listenfd).await?)
+        writer = Box::new(util::get_vsock_stream(listenfd).await?);
     } else {
-        Box::new(tokio::io::stdout())
-    };
+        writer = Box::new(tokio::io::stdout());
+    }
 
     let _ = util::interruptable_io_copier(&mut reader, &mut writer, shutdown).await;
 
@@ -416,59 +418,3 @@ fn reset_sigpipe() {
 
 use crate::config::AgentConfig;
 use std::os::unix::io::{FromRawFd, RawFd};
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::test_utils::test_utils::TestUserType;
-
-    #[tokio::test]
-    async fn test_create_logger_task() {
-        #[derive(Debug)]
-        struct TestData {
-            vsock_port: u32,
-            test_user: TestUserType,
-            result: Result<()>,
-        }
-
-        let tests = &[
-            TestData {
-                // non-root user cannot use privileged vsock port
-                vsock_port: 1,
-                test_user: TestUserType::NonRootOnly,
-                result: Err(anyhow!(nix::errno::Errno::from_i32(libc::EACCES))),
-            },
-            TestData {
-                // passing vsock_port 0 causes logger task to write to stdout
-                vsock_port: 0,
-                test_user: TestUserType::Any,
-                result: Ok(()),
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            if d.test_user == TestUserType::RootOnly {
-                skip_if_not_root!();
-            } else if d.test_user == TestUserType::NonRootOnly {
-                skip_if_root!();
-            }
-
-            let msg = format!("test[{}]: {:?}", i, d);
-            let (rfd, wfd) = unistd::pipe2(OFlag::O_CLOEXEC).unwrap();
-            defer!({
-                // rfd is closed by the use of PipeStream in the crate_logger_task function,
-                // but we will attempt to close in case of a failure
-                let _ = unistd::close(rfd);
-                unistd::close(wfd).unwrap();
-            });
-
-            let (shutdown_tx, shutdown_rx) = channel(true);
-
-            shutdown_tx.send(true).unwrap();
-            let result = create_logger_task(rfd, d.vsock_port, shutdown_rx).await;
-
-            let msg = format!("{}, result: {:?}", msg, result);
-            assert_result!(d.result, result, msg);
-        }
-    }
-}

src/agent/src/metrics.rs

@@ -344,25 +344,25 @@ fn set_gauge_vec_meminfo(gv: &prometheus::GaugeVec, meminfo: &procfs::Meminfo) {
 #[instrument]
 fn set_gauge_vec_cpu_time(gv: &prometheus::GaugeVec, cpu: &str, cpu_time: &procfs::CpuTime) {
     gv.with_label_values(&[cpu, "user"])
-        .set(cpu_time.user_ms() as f64);
+        .set(cpu_time.user as f64);
     gv.with_label_values(&[cpu, "nice"])
-        .set(cpu_time.nice_ms() as f64);
+        .set(cpu_time.nice as f64);
     gv.with_label_values(&[cpu, "system"])
-        .set(cpu_time.system_ms() as f64);
+        .set(cpu_time.system as f64);
     gv.with_label_values(&[cpu, "idle"])
-        .set(cpu_time.idle_ms() as f64);
+        .set(cpu_time.idle as f64);
     gv.with_label_values(&[cpu, "iowait"])
-        .set(cpu_time.iowait_ms().unwrap_or(0) as f64);
+        .set(cpu_time.iowait.unwrap_or(0) as f64);
     gv.with_label_values(&[cpu, "irq"])
-        .set(cpu_time.irq_ms().unwrap_or(0) as f64);
+        .set(cpu_time.irq.unwrap_or(0) as f64);
     gv.with_label_values(&[cpu, "softirq"])
-        .set(cpu_time.softirq_ms().unwrap_or(0) as f64);
+        .set(cpu_time.softirq.unwrap_or(0) as f64);
     gv.with_label_values(&[cpu, "steal"])
-        .set(cpu_time.steal_ms().unwrap_or(0) as f64);
+        .set(cpu_time.steal.unwrap_or(0) as f64);
     gv.with_label_values(&[cpu, "guest"])
-        .set(cpu_time.guest_ms().unwrap_or(0) as f64);
+        .set(cpu_time.guest.unwrap_or(0) as f64);
     gv.with_label_values(&[cpu, "guest_nice"])
-        .set(cpu_time.guest_nice_ms().unwrap_or(0) as f64);
+        .set(cpu_time.guest_nice.unwrap_or(0) as f64);
 }
 
 #[instrument]

src/agent/src/mount.rs

@@ -91,11 +91,11 @@ lazy_static! {
 }
 
 #[derive(Debug, PartialEq)]
-pub struct InitMount<'a> {
-    fstype: &'a str,
-    src: &'a str,
-    dest: &'a str,
-    options: Vec<&'a str>,
+pub struct InitMount {
+    fstype: &'static str,
+    src: &'static str,
+    dest: &'static str,
+    options: Vec<&'static str>,
 }
 
 #[rustfmt::skip]
@@ -121,7 +121,7 @@ lazy_static!{
 
 #[rustfmt::skip]
 lazy_static! {
-    pub static ref INIT_ROOTFS_MOUNTS: Vec<InitMount<'static>> = vec![
+    pub static ref INIT_ROOTFS_MOUNTS: Vec<InitMount> = vec![
         InitMount{fstype: "proc", src: "proc", dest: "/proc", options: vec!["nosuid", "nodev", "noexec"]},
         InitMount{fstype: "sysfs", src: "sysfs", dest: "/sys", options: vec!["nosuid", "nodev", "noexec"]},
         InitMount{fstype: "devtmpfs", src: "dev", dest: "/dev", options: vec!["nosuid"]},
@@ -869,7 +869,7 @@ pub fn get_cgroup_mounts(
     logger: &Logger,
     cg_path: &str,
     unified_cgroup_hierarchy: bool,
-) -> Result<Vec<InitMount<'static>>> {
+) -> Result<Vec<InitMount>> {
     // cgroup v2
     // https://github.com/kata-containers/agent/blob/8c9bbadcd448c9a67690fbe11a860aaacc69813c/agent.go#L1249
     if unified_cgroup_hierarchy {
@@ -1017,7 +1017,6 @@ fn parse_options(option_list: Vec<String>) -> HashMap<String, String> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::test_utils::test_utils::TestUserType;
     use crate::{skip_if_not_root, skip_loop_if_not_root, skip_loop_if_root};
     use protobuf::RepeatedField;
     use protocols::agent::FSGroup;
@@ -1027,6 +1026,13 @@ mod tests {
     use std::path::PathBuf;
     use tempfile::tempdir;
 
+    #[derive(Debug, PartialEq)]
+    enum TestUserType {
+        RootOnly,
+        NonRootOnly,
+        Any,
+    }
+
     #[test]
     fn test_mount() {
         #[derive(Debug)]
@@ -1125,7 +1131,7 @@ mod tests {
             let dest_filename: String;
 
             if !d.src.is_empty() {
-                src = dir.path().join(d.src);
+                src = dir.path().join(d.src.to_string());
                 src_filename = src
                     .to_str()
                     .expect("failed to convert src to filename")
@@ -1135,7 +1141,7 @@ mod tests {
             }
 
             if !d.dest.is_empty() {
-                dest = dir.path().join(d.dest);
+                dest = dir.path().join(d.dest.to_string());
                 dest_filename = dest
                     .to_str()
                     .expect("failed to convert dest to filename")
@@ -1586,233 +1592,6 @@ mod tests {
         assert!(testfile.is_file());
     }
 
-    #[test]
-    fn test_mount_storage() {
-        #[derive(Debug)]
-        struct TestData<'a> {
-            test_user: TestUserType,
-            storage: Storage,
-            error_contains: &'a str,
-
-            make_source_dir: bool,
-            make_mount_dir: bool,
-            deny_mount_permission: bool,
-        }
-
-        impl Default for TestData<'_> {
-            fn default() -> Self {
-                TestData {
-                    test_user: TestUserType::Any,
-                    storage: Storage {
-                        mount_point: "mnt".to_string(),
-                        source: "src".to_string(),
-                        fstype: "tmpfs".to_string(),
-                        ..Default::default()
-                    },
-                    make_source_dir: true,
-                    make_mount_dir: false,
-                    deny_mount_permission: false,
-                    error_contains: "",
-                }
-            }
-        }
-
-        let tests = &[
-            TestData {
-                test_user: TestUserType::NonRootOnly,
-                error_contains: "EPERM: Operation not permitted",
-                ..Default::default()
-            },
-            TestData {
-                test_user: TestUserType::RootOnly,
-                ..Default::default()
-            },
-            TestData {
-                storage: Storage {
-                    mount_point: "mnt".to_string(),
-                    source: "src".to_string(),
-                    fstype: "bind".to_string(),
-                    ..Default::default()
-                },
-                make_source_dir: false,
-                make_mount_dir: true,
-                error_contains: "Could not create mountpoint",
-                ..Default::default()
-            },
-            TestData {
-                test_user: TestUserType::NonRootOnly,
-                deny_mount_permission: true,
-                error_contains: "Could not create mountpoint",
-                ..Default::default()
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-            if d.test_user == TestUserType::RootOnly {
-                skip_loop_if_not_root!(msg);
-            } else if d.test_user == TestUserType::NonRootOnly {
-                skip_loop_if_root!(msg);
-            }
-
-            let drain = slog::Discard;
-            let logger = slog::Logger::root(drain, o!());
-
-            let tempdir = tempdir().unwrap();
-
-            let source = tempdir.path().join(&d.storage.source);
-            let mount_point = tempdir.path().join(&d.storage.mount_point);
-
-            let storage = Storage {
-                source: source.to_str().unwrap().to_string(),
-                mount_point: mount_point.to_str().unwrap().to_string(),
-                ..d.storage.clone()
-            };
-
-            if d.make_source_dir {
-                fs::create_dir_all(&storage.source).unwrap();
-            }
-            if d.make_mount_dir {
-                fs::create_dir_all(&storage.mount_point).unwrap();
-            }
-
-            if d.deny_mount_permission {
-                fs::set_permissions(
-                    mount_point.parent().unwrap(),
-                    fs::Permissions::from_mode(0o000),
-                )
-                .unwrap();
-            }
-
-            let result = mount_storage(&logger, &storage);
-
-            // restore permissions so tempdir can be cleaned up
-            if d.deny_mount_permission {
-                fs::set_permissions(
-                    mount_point.parent().unwrap(),
-                    fs::Permissions::from_mode(0o755),
-                )
-                .unwrap();
-            }
-
-            if result.is_ok() {
-                nix::mount::umount(&mount_point).unwrap();
-            }
-
-            let msg = format!("{}: result: {:?}", msg, result);
-            if d.error_contains.is_empty() {
-                assert!(result.is_ok(), "{}", msg);
-            } else {
-                assert!(result.is_err(), "{}", msg);
-                let error_msg = format!("{}", result.unwrap_err());
-                assert!(error_msg.contains(d.error_contains), "{}", msg);
-            }
-        }
-    }
-
-    #[test]
-    fn test_mount_to_rootfs() {
-        #[derive(Debug)]
-        struct TestData<'a> {
-            test_user: TestUserType,
-            src: &'a str,
-            options: Vec<&'a str>,
-            error_contains: &'a str,
-            deny_mount_dir_permission: bool,
-            // if true src will be prepended with a temporary directory
-            mask_src: bool,
-        }
-
-        impl Default for TestData<'_> {
-            fn default() -> Self {
-                TestData {
-                    test_user: TestUserType::Any,
-                    src: "src",
-                    options: vec![],
-                    error_contains: "",
-                    deny_mount_dir_permission: false,
-                    mask_src: true,
-                }
-            }
-        }
-
-        let tests = &[
-            TestData {
-                test_user: TestUserType::NonRootOnly,
-                error_contains: "EPERM: Operation not permitted",
-                ..Default::default()
-            },
-            TestData {
-                test_user: TestUserType::NonRootOnly,
-                src: "dev",
-                mask_src: false,
-                ..Default::default()
-            },
-            TestData {
-                test_user: TestUserType::RootOnly,
-                ..Default::default()
-            },
-            TestData {
-                test_user: TestUserType::NonRootOnly,
-                deny_mount_dir_permission: true,
-                error_contains: "could not create directory",
-                ..Default::default()
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-            if d.test_user == TestUserType::RootOnly {
-                skip_loop_if_not_root!(msg);
-            } else if d.test_user == TestUserType::NonRootOnly {
-                skip_loop_if_root!(msg);
-            }
-
-            let drain = slog::Discard;
-            let logger = slog::Logger::root(drain, o!());
-            let tempdir = tempdir().unwrap();
-
-            let src = if d.mask_src {
-                tempdir.path().join(&d.src)
-            } else {
-                Path::new(d.src).to_path_buf()
-            };
-            let dest = tempdir.path().join("mnt");
-            let init_mount = InitMount {
-                fstype: "tmpfs",
-                src: src.to_str().unwrap(),
-                dest: dest.to_str().unwrap(),
-                options: d.options.clone(),
-            };
-
-            if d.deny_mount_dir_permission {
-                fs::set_permissions(dest.parent().unwrap(), fs::Permissions::from_mode(0o000))
-                    .unwrap();
-            }
-
-            let result = mount_to_rootfs(&logger, &init_mount);
-
-            // restore permissions so tempdir can be cleaned up
-            if d.deny_mount_dir_permission {
-                fs::set_permissions(dest.parent().unwrap(), fs::Permissions::from_mode(0o755))
-                    .unwrap();
-            }
-
-            if result.is_ok() && d.mask_src {
-                nix::mount::umount(&dest).unwrap();
-            }
-
-            let msg = format!("{}: result: {:?}", msg, result);
-            if d.error_contains.is_empty() {
-                assert!(result.is_ok(), "{}", msg);
-            } else {
-                assert!(result.is_err(), "{}", msg);
-                let error_msg = format!("{}", result.unwrap_err());
-                assert!(error_msg.contains(d.error_contains), "{}", msg);
-            }
-        }
-    }
-
     #[test]
     fn test_get_pagesize_and_size_from_option() {
         let expected_pagesize = 2048;
@@ -1869,57 +1648,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn test_parse_mount_flags_and_options() {
-        #[derive(Debug)]
-        struct TestData<'a> {
-            options_vec: Vec<&'a str>,
-            result: (MsFlags, &'a str),
-        }
-
-        let tests = &[
-            TestData {
-                options_vec: vec![],
-                result: (MsFlags::empty(), ""),
-            },
-            TestData {
-                options_vec: vec!["ro"],
-                result: (MsFlags::MS_RDONLY, ""),
-            },
-            TestData {
-                options_vec: vec!["rw"],
-                result: (MsFlags::empty(), ""),
-            },
-            TestData {
-                options_vec: vec!["ro", "rw"],
-                result: (MsFlags::empty(), ""),
-            },
-            TestData {
-                options_vec: vec!["ro", "nodev"],
-                result: (MsFlags::MS_RDONLY | MsFlags::MS_NODEV, ""),
-            },
-            TestData {
-                options_vec: vec!["option1", "nodev", "option2"],
-                result: (MsFlags::MS_NODEV, "option1,option2"),
-            },
-            TestData {
-                options_vec: vec!["rbind", "", "ro"],
-                result: (MsFlags::MS_BIND | MsFlags::MS_REC | MsFlags::MS_RDONLY, ""),
-            },
-        ];
-
-        for (i, d) in tests.iter().enumerate() {
-            let msg = format!("test[{}]: {:?}", i, d);
-
-            let result = parse_mount_flags_and_options(d.options_vec.clone());
-
-            let msg = format!("{}: result: {:?}", msg, result);
-
-            let expected_result = (d.result.0, d.result.1.to_owned());
-            assert_eq!(expected_result, result, "{}", msg);
-        }
-    }
-
     #[test]
     fn test_set_ownership() {
         skip_if_not_root!();

src/agent/src/random.rs

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 
-use anyhow::{ensure, Result};
+use anyhow::Result;
 use nix::errno::Errno;
 use nix::fcntl::{self, OFlag};
 use nix::sys::stat::Mode;
@@ -13,7 +13,7 @@ use tracing::instrument;
 
 pub const RNGDEV: &str = "/dev/random";
 pub const RNDADDTOENTCNT: libc::c_int = 0x40045201;
-pub const RNDRESEEDCRNG: libc::c_int = 0x5207;
+pub const RNDRESEEDRNG: libc::c_int = 0x5207;
 
 // Handle the differing ioctl(2) request types for different targets
 #[cfg(target_env = "musl")]
@@ -24,9 +24,6 @@ type IoctlRequestType = libc::c_ulong;
 #[instrument]
 pub fn reseed_rng(data: &[u8]) -> Result<()> {
     let len = data.len() as libc::c_long;
-
-    ensure!(len > 0, "missing entropy data");
-
     fs::write(RNGDEV, data)?;
 
     let f = {
@@ -44,52 +41,8 @@ pub fn reseed_rng(data: &[u8]) -> Result<()> {
     };
     Errno::result(ret).map(drop)?;
 
-    let ret = unsafe { libc::ioctl(f.as_raw_fd(), RNDRESEEDCRNG as IoctlRequestType, 0) };
+    let ret = unsafe { libc::ioctl(f.as_raw_fd(), RNDRESEEDRNG as IoctlRequestType, 0) };
     Errno::result(ret).map(drop)?;
 
     Ok(())
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::skip_if_not_root;
-    use std::fs::File;
-    use std::io::prelude::*;
-
-    #[test]
-    fn test_reseed_rng() {
-        skip_if_not_root!();
-        const POOL_SIZE: usize = 512;
-        let mut f = File::open("/dev/urandom").unwrap();
-        let mut seed = [0; POOL_SIZE];
-        let n = f.read(&mut seed).unwrap();
-        // Ensure the buffer was filled.
-        assert!(n == POOL_SIZE);
-        let ret = reseed_rng(&seed);
-        assert!(ret.is_ok());
-    }
-
-    #[test]
-    fn test_reseed_rng_not_root() {
-        const POOL_SIZE: usize = 512;
-        let mut f = File::open("/dev/urandom").unwrap();
-        let mut seed = [0; POOL_SIZE];
-        let n = f.read(&mut seed).unwrap();
-        // Ensure the buffer was filled.
-        assert!(n == POOL_SIZE);
-        let ret = reseed_rng(&seed);
-        if nix::unistd::Uid::effective().is_root() {
-            assert!(ret.is_ok());
-        } else {
-            assert!(!ret.is_ok());
-        }
-    }
-
-    #[test]
-    fn test_reseed_rng_zero_data() {
-        let seed = [];
-        let ret = reseed_rng(&seed);
-        assert!(!ret.is_ok());
-    }
-}

src/agent/src/rpc.rs

@@ -40,13 +40,11 @@ use rustjail::specconv::CreateOpts;
 
 use nix::errno::Errno;
 use nix::mount::MsFlags;
-use nix::sys::stat;
+use nix::sys::{stat, statfs};
 use nix::unistd::{self, Pid};
 use rustjail::cgroups::Manager;
 use rustjail::process::ProcessOperations;
 
-use sysinfo::{DiskExt, System, SystemExt};
-
 use crate::device::{
     add_devices, get_virtio_blk_pci_device_name, update_device_cgroup, update_env_pci,
 };
@@ -71,7 +69,6 @@ use tracing::instrument;
 
 use libc::{self, c_char, c_ushort, pid_t, winsize, TIOCSWINSZ};
 use std::fs;
-use std::os::unix::fs::MetadataExt;
 use std::os::unix::prelude::PermissionsExt;
 use std::process::{Command, Stdio};
 use std::time::Duration;
@@ -1468,20 +1465,12 @@ fn get_memory_info(
 fn get_volume_capacity_stats(path: &str) -> Result<VolumeUsage> {
     let mut usage = VolumeUsage::new();
 
-    let s = System::new();
-    for disk in s.disks() {
-        if let Some(v) = disk.name().to_str() {
-            if v.to_string().eq(path) {
-                usage.available = disk.available_space();
-                usage.total = disk.total_space();
-                usage.used = usage.total - usage.available;
-                usage.unit = VolumeUsage_Unit::BYTES; // bytes
-                break;
-            }
-        } else {
-            return Err(anyhow!(nix::Error::EINVAL));
-        }
-    }
+    let stat = statfs::statfs(path)?;
+    let block_size = stat.block_size() as u64;
+    usage.total = stat.blocks() * block_size;
+    usage.available = stat.blocks_free() * block_size;
+    usage.used = usage.total - usage.available;
+    usage.unit = VolumeUsage_Unit::BYTES;
 
     Ok(usage)
 }
@@ -1489,20 +1478,11 @@ fn get_volume_capacity_stats(path: &str) -> Result<VolumeUsage> {
 fn get_volume_inode_stats(path: &str) -> Result<VolumeUsage> {
     let mut usage = VolumeUsage::new();
 
-    let s = System::new();
-    for disk in s.disks() {
-        if let Some(v) = disk.name().to_str() {
-            if v.to_string().eq(path) {
-                let meta = fs::metadata(disk.mount_point())?;
-                let inode = meta.ino();
-                usage.used = inode;
-                usage.unit = VolumeUsage_Unit::INODES;
-                break;
-            }
-        } else {
-            return Err(anyhow!(nix::Error::EINVAL));
-        }
-    }
+    let stat = statfs::statfs(path)?;
+    usage.total = stat.files();
+    usage.available = stat.files_free();
+    usage.used = usage.total - usage.available;
+    usage.unit = VolumeUsage_Unit::INODES;
 
     Ok(usage)
 }
@@ -1682,7 +1662,7 @@ fn is_signal_handled(proc_status_file: &str, signum: u32) -> bool {
                 warn!(sl!(), "parse the SigCgt field failed");
                 return false;
             }
-            let sig_cgt_str = mask_vec[1];
+            let sig_cgt_str = mask_vec[1].trim();
             let sig_cgt_mask = match u64::from_str_radix(sig_cgt_str, 16) {
                 Ok(h) => h,
                 Err(_) => {
@@ -1802,7 +1782,7 @@ async fn do_add_swap(sandbox: &Arc<Mutex<Sandbox>>, req: &AddSwapRequest) -> Res
 // - config.json at /<CONTAINER_BASE>/<cid>/config.json
 // - container rootfs bind mounted at /<CONTAINER_BASE>/<cid>/rootfs
 // - modify container spec root to point to /<CONTAINER_BASE>/<cid>/rootfs
-pub fn setup_bundle(cid: &str, spec: &mut Spec) -> Result<PathBuf> {
+fn setup_bundle(cid: &str, spec: &mut Spec) -> Result<PathBuf> {
     let spec_root = if let Some(sr) = &spec.root {
         sr
     } else {
@@ -1894,7 +1874,11 @@ fn load_kernel_module(module: &protocols::agent::KernelModule) -> Result<()> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::{assert_result, namespace::Namespace, protocols::agent_ttrpc::AgentService as _};
+    use crate::{
+        assert_result, namespace::Namespace, protocols::agent_ttrpc::AgentService as _,
+        skip_if_not_root,
+    };
+    use nix::mount;
     use oci::{Hook, Hooks, Linux, LinuxNamespace};
     use tempfile::{tempdir, TempDir};
     use ttrpc::{r#async::TtrpcContext, MessageHeader};
@@ -2453,6 +2437,26 @@ OtherField:other
                 signum: 4,
                 result: true,
             },
+            TestData {
+                status_file_data: Some("SigCgt:\t000000004b813efb"),
+                signum: 4,
+                result: true,
+            },
+            TestData {
+                status_file_data: Some("SigCgt: 000000004b813efb"),
+                signum: 4,
+                result: true,
+            },
+            TestData {
+                status_file_data: Some("SigCgt:000000004b813efb "),
+                signum: 4,
+                result: true,
+            },
+            TestData {
+                status_file_data: Some("SigCgt:\t000000004b813efb "),
+                signum: 4,
+                result: true,
+            },
             TestData {
                 status_file_data: Some("SigCgt:000000004b813efb"),
                 signum: 3,
@@ -2749,4 +2753,66 @@ OtherField:other
             }
         }
     }
+
+    #[tokio::test]
+    async fn test_volume_capacity_stats() {
+        skip_if_not_root!();
+
+        // Verify error if path does not exist
+        assert!(get_volume_capacity_stats("/does-not-exist").is_err());
+
+        // Create a new tmpfs mount, and verify the initial values
+        let mount_dir = tempfile::tempdir().unwrap();
+        mount::mount(
+            Some("tmpfs"),
+            mount_dir.path().to_str().unwrap(),
+            Some("tmpfs"),
+            mount::MsFlags::empty(),
+            None::<&str>,
+        )
+        .unwrap();
+        let mut stats = get_volume_capacity_stats(mount_dir.path().to_str().unwrap()).unwrap();
+        assert_eq!(stats.used, 0);
+        assert_ne!(stats.available, 0);
+        let available = stats.available;
+
+        // Verify that writing a file will result in increased utilization
+        fs::write(mount_dir.path().join("file.dat"), "foobar").unwrap();
+        stats = get_volume_capacity_stats(mount_dir.path().to_str().unwrap()).unwrap();
+
+        assert_eq!(stats.used, 4 * 1024);
+        assert_eq!(stats.available, available - 4 * 1024);
+    }
+
+    #[tokio::test]
+    async fn test_get_volume_inode_stats() {
+        skip_if_not_root!();
+
+        // Verify error if path does not exist
+        assert!(get_volume_inode_stats("/does-not-exist").is_err());
+
+        // Create a new tmpfs mount, and verify the initial values
+        let mount_dir = tempfile::tempdir().unwrap();
+        mount::mount(
+            Some("tmpfs"),
+            mount_dir.path().to_str().unwrap(),
+            Some("tmpfs"),
+            mount::MsFlags::empty(),
+            None::<&str>,
+        )
+        .unwrap();
+        let mut stats = get_volume_inode_stats(mount_dir.path().to_str().unwrap()).unwrap();
+        assert_eq!(stats.used, 1);
+        assert_ne!(stats.available, 0);
+        let available = stats.available;
+
+        // Verify that creating a directory and writing a file will result in increased utilization
+        let dir = mount_dir.path().join("foobar");
+        fs::create_dir_all(&dir).unwrap();
+        fs::write(dir.as_path().join("file.dat"), "foobar").unwrap();
+        stats = get_volume_inode_stats(mount_dir.path().to_str().unwrap()).unwrap();
+
+        assert_eq!(stats.used, 3);
+        assert_eq!(stats.available, available - 2);
+    }
 }

src/agent/src/signal.rs

@@ -58,16 +58,17 @@ async fn handle_sigchild(logger: Logger, sandbox: Arc<Mutex<Sandbox>>) -> Result
             }
 
             let mut p = process.unwrap();
+            let ret: i32;
 
-            let ret: i32 = match wait_status {
-                WaitStatus::Exited(_, c) => c,
-                WaitStatus::Signaled(_, sig, _) => sig as i32,
+            match wait_status {
+                WaitStatus::Exited(_, c) => ret = c,
+                WaitStatus::Signaled(_, sig, _) => ret = sig as i32,
                 _ => {
                     info!(logger, "got wrong status for process";
                                   "child-status" => format!("{:?}", wait_status));
                     continue;
                 }
-            };
+            }
 
             p.exit_code = ret;
             let _ = p.exit_tx.take();

src/agent/src/test_utils.rs

@@ -5,14 +5,7 @@
 #![allow(clippy::module_inception)]
 
 #[cfg(test)]
-pub mod test_utils {
-    #[derive(Debug, PartialEq)]
-    pub enum TestUserType {
-        RootOnly,
-        NonRootOnly,
-        Any,
-    }
-
+mod test_utils {
     #[macro_export]
     macro_rules! skip_if_root {
         () => {

src/agent/src/util.rs

@@ -237,6 +237,8 @@ mod tests {
                 JoinError,
             >;
 
+            let result: std::result::Result<u64, std::io::Error>;
+
             select! {
                 res = handle => spawn_result = res,
                 _ = &mut timeout => panic!("timed out"),
@@ -244,7 +246,7 @@ mod tests {
 
             assert!(spawn_result.is_ok());
 
-            let result: std::result::Result<u64, std::io::Error> = spawn_result.unwrap();
+            result = spawn_result.unwrap();
 
             assert!(result.is_ok());
 
@@ -276,6 +278,8 @@ mod tests {
 
         let spawn_result: std::result::Result<std::result::Result<u64, std::io::Error>, JoinError>;
 
+        let result: std::result::Result<u64, std::io::Error>;
+
         select! {
             res = handle => spawn_result = res,
             _ = &mut timeout => panic!("timed out"),
@@ -283,7 +287,7 @@ mod tests {
 
         assert!(spawn_result.is_ok());
 
-        let result: std::result::Result<u64, std::io::Error> = spawn_result.unwrap();
+        result = spawn_result.unwrap();
 
         assert!(result.is_ok());
 
@@ -316,6 +320,8 @@ mod tests {
 
         let spawn_result: std::result::Result<std::result::Result<u64, std::io::Error>, JoinError>;
 
+        let result: std::result::Result<u64, std::io::Error>;
+
         select! {
             res = handle => spawn_result = res,
             _ = &mut timeout => panic!("timed out"),
@@ -323,7 +329,7 @@ mod tests {
 
         assert!(spawn_result.is_ok());
 
-        let result: std::result::Result<u64, std::io::Error> = spawn_result.unwrap();
+        result = spawn_result.unwrap();
 
         assert!(result.is_ok());
 

src/agent/vsock-exporter/src/lib.rs

@@ -178,11 +178,13 @@ impl Builder {
     pub fn init(self) -> Exporter {
         let Builder { port, cid, logger } = self;
 
-        let cid_str: String = if self.cid == libc::VMADDR_CID_ANY {
-            ANY_CID.to_string()
+        let cid_str: String;
+
+        if self.cid == libc::VMADDR_CID_ANY {
+            cid_str = ANY_CID.to_string();
         } else {
-            format!("{}", self.cid)
-        };
+            cid_str = format!("{}", self.cid);
+        }
 
         Exporter {
             port,

src/libs/Cargo.toml

@@ -1,6 +0,0 @@
-[workspace]
-members = [
-    "logging",
-    "safe-path",
-]
-resolver = "2"

src/libs/README.md

@@ -1,10 +0,0 @@
-The `src/libs` directory hosts library crates which may be shared by multiple Kata Containers components
-or published to [`crates.io`](https://crates.io/index.html).
-
-### Library Crates
-Currently it provides following library crates:
-
-| Library | Description |
-|-|-|-|
-| [logging](logging/) | Facilities to setup logging subsystem based slog. |
-| [safe-path](safe-path/) | Utilities to safely resolve filesystem paths. |

src/libs/logging/Cargo.lock

@@ -1,5 +1,7 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
+version = 3
+
 [[package]]
 name = "arc-swap"
 version = "1.5.0"
@@ -39,9 +41,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e54ea8bc3fb1ee042f5aace6e3c6e025d3874866da222930f70ce62aceba0bfa"
+checksum = "06ed27e177f16d65f0f0c22a213e17c696ace5dd64b14258b52f9417ccb52db4"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -49,30 +51,23 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.6"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcae03edb34f947e64acdb1c33ec169824e20657e9ecb61cef6c8c74dcb8120"
+checksum = "d82cfc11ce7f2c3faef78d8a684447b40d503d9681acebed6cb728d45940c4db"
 dependencies = [
  "cfg-if",
  "lazy_static",
 ]
 
 [[package]]
-name = "fastrand"
-version = "1.6.0"
+name = "getrandom"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "779d043b6a0b90cc4c0ed7ee380a6504394cee7efd7db050e3774eee387324b2"
-dependencies = [
- "instant",
-]
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
 dependencies = [
  "cfg-if",
+ "libc",
+ "wasi",
 ]
 
 [[package]]
@@ -89,9 +84,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.113"
+version = "0.2.112"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eef78b64d87775463c549fbd80e19249ef436ea3bf1de2a1eb7e717ec7fab1e9"
+checksum = "1b03d17f364a3a042d5e5d46b053bbbf82c92c9430c592dd4c064dc6ee997125"
 
 [[package]]
 name = "logging"
@@ -130,6 +125,52 @@ version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
 
+[[package]]
+name = "ppv-lite86"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed0cfbc8191465bed66e1718596ee0b0b35d5ee1f41c5df2189d0fe8bde535ba"
+
+[[package]]
+name = "rand"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e7573632e6454cf6b99d7aac4ccca54be06da05aca2ef7423d22d27d4d4bcd8"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+ "rand_hc",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d51e9f596de227fda2ea6c84607f5558e196eeaf43c986b724ba4fb8fdf497e7"
+dependencies = [
+ "rand_core",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.2.10"
@@ -154,25 +195,17 @@ version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73b4b750c782965c211b42f022f59af1fbceabdd026623714f104152f1ec149f"
 
-[[package]]
-name = "safe-path"
-version = "0.1.0"
-dependencies = [
- "libc",
- "tempfile",
-]
-
 [[package]]
 name = "serde"
-version = "1.0.133"
+version = "1.0.131"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97565067517b60e2d1ea8b268e59ce036de907ac523ad83a0475da04e818989a"
+checksum = "b4ad69dfbd3e45369132cc64e6748c2d65cdfb001a2b1c232d128b4ad60561c1"
 
 [[package]]
 name = "serde_json"
-version = "1.0.75"
+version = "1.0.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c059c05b48c5c0067d4b4b2b4f0732dd65feb52daf7e0ea09cd87e7dadc1af79"
+checksum = "bcbd0344bc6533bc7ec56df11d42fb70f1b912351c0825ccb7211b59d8af7cf5"
 dependencies = [
  "itoa",
  "ryu",
@@ -228,13 +261,13 @@ checksum = "f764005d11ee5f36500a149ace24e00e3da98b0158b3e2d53a7495660d3f4d60"
 
 [[package]]
 name = "tempfile"
-version = "3.3.0"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+checksum = "dac1c663cfc93810f88aed9b8941d48cabf856a1b111c29a40439018d870eb22"
 dependencies = [
  "cfg-if",
- "fastrand",
  "libc",
+ "rand",
  "redox_syscall",
  "remove_dir_all",
  "winapi",
@@ -251,20 +284,19 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.1.44"
+version = "0.1.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+checksum = "ca8a50ef2360fbd1eeb0ecd46795a87a19024eb4b53c5dc916ca1fd95fe62438"
 dependencies = [
  "libc",
- "wasi",
  "winapi",
 ]
 
 [[package]]
 name = "wasi"
-version = "0.10.0+wasi-snapshot-preview1"
+version = "0.10.2+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
 
 [[package]]
 name = "winapi"

src/libs/protocols/.gitignore

@@ -1,7 +1,6 @@
 Cargo.lock
 src/agent.rs
 src/agent_ttrpc.rs
-src/csi.rs
 src/empty.rs
 src/health.rs
 src/health_ttrpc.rs

src/libs/protocols/hack/update-generated-proto.sh

@@ -7,14 +7,14 @@
 # //
 
 die() {
-    cat <<EOF >&2
+    cat <<EOT >&2
 ====================================================================
 ====                compile protocols failed                    ====
 
 $1
 
 ====================================================================
-EOF
+EOT
     exit 1
 }
 

src/libs/safe-path/Cargo.toml

@@ -1,18 +0,0 @@
-[package]
-name = "safe-path"
-version = "0.1.0"
-description = "A library to safely handle file system paths for container runtimes"
-keywords = ["kata", "container", "path", "securejoin"]
-categories = ["parser-implementations", "filesystem"]
-authors = ["The Kata Containers community <kata-dev@lists.katacontainers.io>"]
-repository = "https://github.com/kata-containers/kata-containers.git"
-homepage = "https://katacontainers.io/"
-readme = "README.md"
-license = "Apache-2.0"
-edition = "2018"
-
-[dependencies]
-libc = "0.2.100"
-
-[dev-dependencies]
-tempfile = "3.2.0"

src/libs/safe-path/README.md

@@ -1,21 +0,0 @@
-Safe Path
-====================
-[![CI](https://github.com/magiclen/path-absolutize/actions/workflows/ci.yml/badge.svg)](https://github.com/magiclen/path-absolutize/actions/workflows/ci.yml)
-
-A library to safely handle filesystem paths, typically for container runtimes.
-
-There are often path related attacks, such as symlink based attacks, TOCTTOU attacks. The `safe-path` crate
-provides several functions and utility structures to protect against path resolution related attacks.
-
-## Support
-
-**Operating Systems**:
-- Linux
-
-## Reference
-- [`filepath-securejoin`](https://github.com/cyphar/filepath-securejoin): secure_join() written in Go.
-- [CVE-2021-30465](https://github.com/advisories/GHSA-c3xm-pvg7-gh7r): symlink related TOCTOU flaw in `runC`.
-
-## License
-
-This code is licensed under [Apache-2.0](../../../LICENSE).

src/libs/safe-path/src/lib.rs

@@ -1,65 +0,0 @@
-// Copyright (c) 2022 Alibaba Cloud
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-//! A library to safely handle filesystem paths, typically for container runtimes.
-//!
-//! Linux [mount namespace](https://man7.org/linux/man-pages/man7/mount_namespaces.7.html)
-//! provides isolation of the list of mounts seen by the processes in each
-//! [namespace](https://man7.org/linux/man-pages/man7/namespaces.7.html) instance.
-//! Thus, the processes in each of the mount namespace instances will see distinct single-directory
-//! hierarchies.
-//!
-//! Containers are used to isolate workloads from the host system. Container on Linux systems
-//! depends on the mount namespace to build an isolated root filesystem for each container,
-//! thus protect the host and containers from each other. When creating containers, the container
-//! runtime needs to setup filesystem mounts for container rootfs/volumes. Configuration for
-//! mounts/paths may be indirectly controlled by end users through:
-//! - container images
-//! - Kubernetes pod specifications
-//! - hook command line arguments
-//!
-//! These volume configuration information may be controlled by end users/malicious attackers,
-//! so it must not be trusted by container runtimes. When the container runtime is preparing mount
-//! namespace for a container, it must be very careful to validate user input configuration
-//! information and ensure data out of the container rootfs directory won't be affected
-//! by the container. There are several types of attacks related to container mount namespace:
-//! - symlink based attack
-//! - Time of check to time of use (TOCTTOU)
-//!
-//! This crate provides several mechanisms for container runtimes to safely handle filesystem paths
-//! when preparing mount namespace for containers.
-//! - [scoped_join()](crate::scoped_join()): safely join `unsafe_path` to `root`, and ensure
-//!   `unsafe_path` is scoped under `root`.
-//! - [scoped_resolve()](crate::scoped_resolve()): resolve `unsafe_path` to a relative path,
-//!   rooted at and constrained by `root`.
-//! - [struct PinnedPathBuf](crate::PinnedPathBuf): safe version of `PathBuf` to protect from
-//!   TOCTTOU style of attacks, which ensures:
-//!     - the value of [`PinnedPathBuf::as_path()`] never changes.
-//!     - the path returned by [`PinnedPathBuf::as_path()`] is always a symlink.
-//!     - the filesystem object referenced by the symlink [`PinnedPathBuf::as_path()`] never changes.
-//!     - the value of [`PinnedPathBuf::target()`] never changes.
-//! - [struct ScopedDirBuilder](crate::ScopedDirBuilder): safe version of `DirBuilder` to protect
-//!   from symlink race and TOCTTOU style of attacks, which enhances security by:
-//!     - ensuring the new directories are created under a specified `root` directory.
-//!     - avoiding symlink race attacks during making directories.
-//!     - returning a [PinnedPathBuf] for the last level of directory, so it could be used for other
-//!       operations safely.
-//!
-//! The work is inspired by:
-//! - [`filepath-securejoin`](https://github.com/cyphar/filepath-securejoin): secure_join() written
-//! in Go.
-//! - [CVE-2021-30465](https://github.com/advisories/GHSA-c3xm-pvg7-gh7r): symlink related TOCTOU
-//! flaw in `runC`.
-
-#![deny(missing_docs)]
-
-mod pinned_path_buf;
-pub use pinned_path_buf::PinnedPathBuf;
-
-mod scoped_dir_builder;
-pub use scoped_dir_builder::ScopedDirBuilder;
-
-mod scoped_path_resolver;
-pub use scoped_path_resolver::{scoped_join, scoped_resolve};

src/libs/safe-path/src/pinned_path_buf.rs

@@ -1,444 +0,0 @@
-// Copyright (c) 2022 Alibaba Cloud
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-use std::ffi::{CString, OsStr};
-use std::fs::{self, File, Metadata, OpenOptions};
-use std::io::{Error, ErrorKind, Result};
-use std::ops::Deref;
-use std::os::unix::ffi::OsStrExt;
-use std::os::unix::fs::OpenOptionsExt;
-use std::os::unix::io::{AsRawFd, FromRawFd, RawFd};
-use std::path::{Component, Path, PathBuf};
-
-use crate::scoped_join;
-
-/// A safe version of [`PathBuf`] pinned to an underlying filesystem object to protect from
-/// `TOCTTOU` style of attacks.
-///
-/// A [`PinnedPathBuf`] is a resolved path buffer pinned to an underlying filesystem object, which
-/// guarantees:
-/// - the value of [`PinnedPathBuf::as_path()`] never changes.
-/// - the path returned by [`PinnedPathBuf::as_path()`] is always a symlink.
-/// - the filesystem object referenced by the symlink [`PinnedPathBuf::as_path()`] never changes.
-/// - the value of [`PinnedPathBuf::target()`] never changes.
-///
-/// Note:
-/// - Though the filesystem object referenced by the symlink [`PinnedPathBuf::as_path()`] never
-///   changes, the value of `fs::read_link(PinnedPathBuf::as_path())` may change due to filesystem
-///   operations.
-/// - The value of [`PinnedPathBuf::target()`] is a cached version of
-///   `fs::read_link(PinnedPathBuf::as_path())` generated when creating the `PinnedPathBuf` object.
-/// - It's a sign of possible attacks if `[PinnedPathBuf::target()]` doesn't match
-///   `fs::read_link(PinnedPathBuf::as_path())`.
-/// - Once the [`PinnedPathBuf`] object gets dropped, the [`Path`] returned by
-///   [`PinnedPathBuf::as_path()`] becomes invalid.
-///
-/// With normal [`PathBuf`], there's a race window for attackers between time to validate a path and
-/// time to use the path. An attacker may maliciously change filesystem object referenced by the
-/// path by using symlinks to compose an attack.
-///
-/// The [`PinnedPathBuf`] is introduced to protect from such attacks, by using the
-/// `/proc/self/fd/xxx` files on Linux. The `/proc/self/fd/xxx` file on Linux is a symlink to the
-/// real target corresponding to the process's file descriptor `xxx`. And the target filesystem
-/// object referenced by the symlink will be kept stable until the file descriptor has been closed.
-/// Combined with `O_PATH`, a safe version of `PathBuf` could be built by:
-/// - Generate a safe path from `root` and `path` by using [`crate::scoped_join()`].
-/// - Open the safe path with O_PATH | O_CLOEXEC flags, say the fd number is `fd_num`.
-/// - Read the symlink target of `/proc/self/fd/fd_num`.
-/// - Compare the symlink target with the safe path, it's safe if these two paths equal.
-/// - Use the proc file path as a safe version of [`PathBuf`].
-/// - Close the `fd_num` when dropping the [`PinnedPathBuf`] object.
-#[derive(Debug)]
-pub struct PinnedPathBuf {
-    handle: File,
-    path: PathBuf,
-    target: PathBuf,
-}
-
-impl PinnedPathBuf {
-    /// Create a [`PinnedPathBuf`] object from `root` and `path`.
-    ///
-    /// The `path` must be a subdirectory of `root`, otherwise error will be returned.
-    pub fn new<R: AsRef<Path>, U: AsRef<Path>>(root: R, path: U) -> Result<Self> {
-        let path = scoped_join(root, path)?;
-        Self::from_path(path)
-    }
-
-    /// Create a `PinnedPathBuf` from `path`.
-    ///
-    /// If the resolved value of `path` doesn't equal to `path`, an error will be returned.
-    pub fn from_path<P: AsRef<Path>>(orig_path: P) -> Result<Self> {
-        let orig_path = orig_path.as_ref();
-        let handle = Self::open_by_path(orig_path)?;
-        Self::new_from_file(handle, orig_path)
-    }
-
-    /// Try to clone the [`PinnedPathBuf`] object.
-    pub fn try_clone(&self) -> Result<Self> {
-        let fd = unsafe { libc::dup(self.path_fd()) };
-        if fd < 0 {
-            Err(Error::last_os_error())
-        } else {
-            Ok(Self {
-                handle: unsafe { File::from_raw_fd(fd) },
-                path: Self::get_proc_path(fd),
-                target: self.target.clone(),
-            })
-        }
-    }
-
-    /// Return the underlying file descriptor representing the pinned path.
-    ///
-    /// Following operations are supported by the returned `RawFd`:
-    /// - fchdir
-    /// - fstat/fstatfs
-    /// - openat/linkat/fchownat/fstatat/readlinkat/mkdirat/*at
-    /// - fcntl(F_GETFD, F_SETFD, F_GETFL)
-    pub fn path_fd(&self) -> RawFd {
-        self.handle.as_raw_fd()
-    }
-
-    /// Get the symlink path referring the target filesystem object.
-    pub fn as_path(&self) -> &Path {
-        self.path.as_path()
-    }
-
-    /// Get the cached real path of the target filesystem object.
-    ///
-    /// The target path is cached version of `fs::read_link(PinnedPathBuf::as_path())` generated
-    /// when creating the `PinnedPathBuf` object. On the other hand, the value of
-    /// `fs::read_link(PinnedPathBuf::as_path())` may change due to underlying filesystem operations.
-    /// So it's a sign of possible attacks if `PinnedPathBuf::target()` does not match
-    /// `fs::read_link(PinnedPathBuf::as_path())`.
-    pub fn target(&self) -> &Path {
-        &self.target
-    }
-
-    /// Get [`Metadata`] about the path handle.
-    pub fn metadata(&self) -> Result<Metadata> {
-        self.handle.metadata()
-    }
-
-    /// Open a direct child of the filesystem objected referenced by the `PinnedPathBuf` object.
-    pub fn open_child(&self, path_comp: &OsStr) -> Result<Self> {
-        let name = Self::prepare_path_component(path_comp)?;
-        let oflags = libc::O_PATH | libc::O_CLOEXEC;
-        let res = unsafe { libc::openat(self.path_fd(), name.as_ptr(), oflags, 0) };
-        if res < 0 {
-            Err(Error::last_os_error())
-        } else {
-            let handle = unsafe { File::from_raw_fd(res) };
-            Self::new_from_file(handle, self.target.join(path_comp))
-        }
-    }
-
-    /// Create or open a child directory if current object is a directory.
-    pub fn mkdir(&self, path_comp: &OsStr, mode: libc::mode_t) -> Result<Self> {
-        let path_name = Self::prepare_path_component(path_comp)?;
-        let res = unsafe { libc::mkdirat(self.handle.as_raw_fd(), path_name.as_ptr(), mode) };
-        if res < 0 {
-            Err(Error::last_os_error())
-        } else {
-            self.open_child(path_comp)
-        }
-    }
-
-    /// Open a directory/file by path.
-    ///
-    /// Obtain a file descriptor that can be used for two purposes:
-    /// - indicate a location in the filesystem tree
-    /// - perform operations that act purely at the file descriptor level
-    fn open_by_path<P: AsRef<Path>>(path: P) -> Result<File> {
-        // When O_PATH is specified in flags, flag bits other than O_CLOEXEC, O_DIRECTORY, and
-        // O_NOFOLLOW are ignored.
-        let o_flags = libc::O_PATH | libc::O_CLOEXEC;
-        OpenOptions::new()
-            .read(true)
-            .custom_flags(o_flags)
-            .open(path.as_ref())
-    }
-
-    fn get_proc_path<F: AsRawFd>(file: F) -> PathBuf {
-        PathBuf::from(format!("/proc/self/fd/{}", file.as_raw_fd()))
-    }
-
-    fn new_from_file<P: AsRef<Path>>(handle: File, orig_path: P) -> Result<Self> {
-        let path = Self::get_proc_path(handle.as_raw_fd());
-        let link_path = fs::read_link(path.as_path())?;
-        if link_path != orig_path.as_ref() {
-            Err(Error::new(
-                ErrorKind::Other,
-                format!(
-                    "Path changed from {} to {} on open, possible attack",
-                    orig_path.as_ref().display(),
-                    link_path.display()
-                ),
-            ))
-        } else {
-            Ok(PinnedPathBuf {
-                handle,
-                path,
-                target: link_path,
-            })
-        }
-    }
-
-    #[inline]
-    fn prepare_path_component(path_comp: &OsStr) -> Result<CString> {
-        let path = Path::new(path_comp);
-        let mut comps = path.components();
-        let name = comps.next();
-        if !matches!(name, Some(Component::Normal(_))) || comps.next().is_some() {
-            return Err(Error::new(
-                ErrorKind::Other,
-                format!("Path component {} is invalid", path_comp.to_string_lossy()),
-            ));
-        }
-        let name = name.unwrap();
-        if name.as_os_str() != path_comp {
-            return Err(Error::new(
-                ErrorKind::Other,
-                format!("Path component {} is invalid", path_comp.to_string_lossy()),
-            ));
-        }
-
-        CString::new(path_comp.as_bytes()).map_err(|_e| {
-            Error::new(
-                ErrorKind::Other,
-                format!("Path component {} is invalid", path_comp.to_string_lossy()),
-            )
-        })
-    }
-}
-
-impl Deref for PinnedPathBuf {
-    type Target = PathBuf;
-
-    fn deref(&self) -> &Self::Target {
-        &self.path
-    }
-}
-
-impl AsRef<Path> for PinnedPathBuf {
-    fn as_ref(&self) -> &Path {
-        self.path.as_path()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::ffi::OsString;
-    use std::fs::DirBuilder;
-    use std::io::Write;
-    use std::os::unix::fs::{symlink, MetadataExt};
-    use std::sync::{Arc, Barrier};
-    use std::thread;
-
-    #[test]
-    fn test_pinned_path_buf() {
-        // Create a root directory, which itself contains symlinks.
-        let rootfs_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        DirBuilder::new()
-            .create(rootfs_dir.path().join("b"))
-            .unwrap();
-        symlink(rootfs_dir.path().join("b"), rootfs_dir.path().join("a")).unwrap();
-        let rootfs_path = &rootfs_dir.path().join("a");
-
-        // Create a file and a symlink to it.
-        fs::create_dir(rootfs_path.join("symlink_dir")).unwrap();
-        symlink("/endpoint", rootfs_path.join("symlink_dir/endpoint")).unwrap();
-        fs::write(rootfs_path.join("endpoint"), "test").unwrap();
-
-        // Pin the target and validate the path/content.
-        let path = PinnedPathBuf::new(rootfs_path.to_path_buf(), "symlink_dir/endpoint").unwrap();
-        assert!(!path.is_dir());
-        let path_ref = path.deref();
-        let target = fs::read_link(path_ref).unwrap();
-        assert_eq!(target, rootfs_path.join("endpoint").canonicalize().unwrap());
-        let content = fs::read_to_string(&path).unwrap();
-        assert_eq!(&content, "test");
-
-        // Remove the target file and validate that we could still read data from the pinned path.
-        fs::remove_file(&target).unwrap();
-        fs::read_to_string(&target).unwrap_err();
-        let content = fs::read_to_string(&path).unwrap();
-        assert_eq!(&content, "test");
-    }
-
-    #[test]
-    fn test_pinned_path_buf_race() {
-        let root_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        let root_path = root_dir.path();
-        let barrier = Arc::new(Barrier::new(2));
-
-        fs::write(root_path.join("a"), b"a").unwrap();
-        fs::write(root_path.join("b"), b"b").unwrap();
-        fs::write(root_path.join("c"), b"c").unwrap();
-        symlink("a", root_path.join("s")).unwrap();
-
-        let root_path2 = root_path.to_path_buf();
-        let barrier2 = barrier.clone();
-        let thread = thread::spawn(move || {
-            // step 1
-            barrier2.wait();
-            fs::remove_file(root_path2.join("a")).unwrap();
-            symlink("b", root_path2.join("a")).unwrap();
-            barrier2.wait();
-
-            // step 2
-            barrier2.wait();
-            fs::remove_file(root_path2.join("b")).unwrap();
-            symlink("c", root_path2.join("b")).unwrap();
-            barrier2.wait();
-        });
-
-        let path = scoped_join(&root_path, "s").unwrap();
-        let data = fs::read_to_string(&path).unwrap();
-        assert_eq!(&data, "a");
-        assert!(path.is_file());
-        barrier.wait();
-        barrier.wait();
-        // Verify the target has been redirected.
-        let data = fs::read_to_string(&path).unwrap();
-        assert_eq!(&data, "b");
-        PinnedPathBuf::from_path(&path).unwrap_err();
-
-        let pinned_path = PinnedPathBuf::new(&root_path, "s").unwrap();
-        let data = fs::read_to_string(&pinned_path).unwrap();
-        assert_eq!(&data, "b");
-
-        // step2
-        barrier.wait();
-        barrier.wait();
-        // Verify it still points to the old target.
-        let data = fs::read_to_string(&pinned_path).unwrap();
-        assert_eq!(&data, "b");
-
-        thread.join().unwrap();
-    }
-
-    #[test]
-    fn test_new_pinned_path_buf() {
-        let rootfs_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        let rootfs_path = rootfs_dir.path();
-        let path = PinnedPathBuf::from_path(rootfs_path).unwrap();
-        let _ = OpenOptions::new().read(true).open(&path).unwrap();
-    }
-
-    #[test]
-    fn test_pinned_path_try_clone() {
-        let rootfs_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        let rootfs_path = rootfs_dir.path();
-        let path = PinnedPathBuf::from_path(rootfs_path).unwrap();
-        let path2 = path.try_clone().unwrap();
-        assert_ne!(path.as_path(), path2.as_path());
-    }
-
-    #[test]
-    fn test_new_pinned_path_buf_from_nonexist_file() {
-        let rootfs_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        let rootfs_path = rootfs_dir.path();
-        PinnedPathBuf::new(rootfs_path, "does_not_exist").unwrap_err();
-    }
-
-    #[test]
-    fn test_new_pinned_path_buf_without_read_perm() {
-        let rootfs_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        let rootfs_path = rootfs_dir.path();
-        let path = rootfs_path.join("write_only_file");
-
-        let mut file = OpenOptions::new()
-            .read(false)
-            .write(true)
-            .create(true)
-            .mode(0o200)
-            .open(&path)
-            .unwrap();
-        file.write_all(&[0xa5u8]).unwrap();
-        let md = fs::metadata(&path).unwrap();
-        let umask = unsafe { libc::umask(0022) };
-        unsafe { libc::umask(umask) };
-        assert_eq!(md.mode() & 0o700, 0o200 & !umask);
-        PinnedPathBuf::from_path(&path).unwrap();
-    }
-
-    #[test]
-    fn test_pinned_path_buf_path_fd() {
-        let rootfs_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        let rootfs_path = rootfs_dir.path();
-        let path = rootfs_path.join("write_only_file");
-
-        let mut file = OpenOptions::new()
-            .read(false)
-            .write(true)
-            .create(true)
-            .mode(0o200)
-            .open(&path)
-            .unwrap();
-        file.write_all(&[0xa5u8]).unwrap();
-        let handle = PinnedPathBuf::from_path(&path).unwrap();
-        // Check that `fstat()` etc works with the fd returned by `path_fd()`.
-        let fd = handle.path_fd();
-        let mut stat: libc::stat = unsafe { std::mem::zeroed() };
-        let res = unsafe { libc::fstat(fd, &mut stat as *mut _) };
-        assert_eq!(res, 0);
-    }
-
-    #[test]
-    fn test_pinned_path_buf_open_child() {
-        let rootfs_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        let rootfs_path = rootfs_dir.path();
-        let path = PinnedPathBuf::from_path(rootfs_path).unwrap();
-
-        fs::write(path.join("child"), "test").unwrap();
-        let path = path.open_child(OsStr::new("child")).unwrap();
-        let content = fs::read_to_string(&path).unwrap();
-        assert_eq!(&content, "test");
-
-        path.open_child(&OsString::from("__does_not_exist__"))
-            .unwrap_err();
-        path.open_child(&OsString::from("test/a")).unwrap_err();
-    }
-
-    #[test]
-    fn test_prepare_path_component() {
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from(".")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("..")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("/")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("//")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a/b")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("./b")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a/.")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a/..")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a/./")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a/../")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a/./a")).is_err());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a/../a")).is_err());
-
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a")).is_ok());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a.b")).is_ok());
-        assert!(PinnedPathBuf::prepare_path_component(&OsString::from("a..b")).is_ok());
-    }
-
-    #[test]
-    fn test_target_fs_object_changed() {
-        let rootfs_dir = tempfile::tempdir().expect("failed to create tmpdir");
-        let rootfs_path = rootfs_dir.path();
-        let file = rootfs_path.join("child");
-        fs::write(&file, "test").unwrap();
-
-        let path = PinnedPathBuf::from_path(&file).unwrap();
-        let path3 = fs::read_link(path.as_path()).unwrap();
-        assert_eq!(&path3, path.target());
-        fs::rename(file, rootfs_path.join("child2")).unwrap();
-        let path4 = fs::read_link(path.as_path()).unwrap();
-        assert_ne!(&path4, path.target());
-        fs::remove_file(rootfs_path.join("child2")).unwrap();
-        let path5 = fs::read_link(path.as_path()).unwrap();
-        assert_ne!(&path4, &path5);
-    }
-}

src/libs/safe-path/src/scoped_dir_builder.rs

@@ -1,294 +0,0 @@
-// Copyright (c) 2022 Alibaba Cloud
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-use std::io::{Error, ErrorKind, Result};
-use std::path::Path;
-
-use crate::{scoped_join, scoped_resolve, PinnedPathBuf};
-
-const DIRECTORY_MODE_DEFAULT: u32 = 0o777;
-const DIRECTORY_MODE_MASK: u32 = 0o777;
-
-/// Safe version of `DirBuilder` to protect from TOCTOU style of attacks.
-///
-/// The `ScopedDirBuilder` is a counterpart for `DirBuilder`, with safety enhancements of:
-/// - ensuring the new directories are created under a specified `root` directory.
-/// - ensuring all created directories are still scoped under `root` even under symlink based
-///   attacks.
-/// - returning a [PinnedPathBuf] for the last level of directory, so it could be used for other
-///   operations safely.
-#[derive(Debug)]
-pub struct ScopedDirBuilder {
-    root: PinnedPathBuf,
-    mode: u32,
-    recursive: bool,
-}
-
-impl ScopedDirBuilder {
-    /// Create a new instance of `ScopedDirBuilder` with with default mode/security settings.
-    pub fn new<P: AsRef<Path>>(root: P) -> Result<Self> {
-        let root = root.as_ref().canonicalize()?;
-        let root = PinnedPathBuf::from_path(root)?;
-        if !root.metadata()?.is_dir() {
-            return Err(Error::new(
-                ErrorKind::Other,
-                format!("Invalid root path: {}", root.display()),
-            ));
-        }
-
-        Ok(ScopedDirBuilder {
-            root,
-            mode: DIRECTORY_MODE_DEFAULT,
-            recursive: false,
-        })
-    }
-
-    /// Indicates that directories should be created recursively, creating all parent directories.
-    ///
-    /// Parents that do not exist are created with the same security and permissions settings.
-    pub fn recursive(&mut self, recursive: bool) -> &mut Self {
-        self.recursive = recursive;
-        self
-    }
-
-    /// Sets the mode to create new directories with. This option defaults to 0o755.
-    pub fn mode(&mut self, mode: u32) -> &mut Self {
-        self.mode = mode & DIRECTORY_MODE_MASK;
-        self
-    }
-
-    /// Creates the specified directory with the options configured in this builder.
-    ///
-    /// This is a helper to create subdirectory with an absolute path, without stripping off
-    /// `self.root`. So error will be returned if path does start with `self.root`.
-    /// It is considered an error if the directory already exists unless recursive mode is enabled.
-    pub fn create_with_unscoped_path<P: AsRef<Path>>(&self, path: P) -> Result<PinnedPathBuf> {
-        if !path.as_ref().is_absolute() {
-            return Err(Error::new(
-                ErrorKind::Other,
-                format!(
-                    "Expected absolute directory path: {}",
-                    path.as_ref().display()
-                ),
-            ));
-        }
-        // Partially canonicalize `path` so we can strip the `root` part.
-        let scoped_path = scoped_join("/", path)?;
-        let stripped_path = scoped_path.strip_prefix(self.root.target()).map_err(|_| {
-            Error::new(
-                ErrorKind::Other,
-                format!(
-                    "Path {} is not under {}",
-                    scoped_path.display(),
-                    self.root.target().display()
-                ),
-            )
-        })?;
-
-        self.do_mkdir(&stripped_path)
-    }
-
-    /// Creates sub-directory with the options configured in this builder.
-    ///
-    /// It is considered an error if the directory already exists unless recursive mode is enabled.
-    pub fn create<P: AsRef<Path>>(&self, path: P) -> Result<PinnedPathBuf> {
-        let path = scoped_resolve(&self.root, path)?;
-        self.do_mkdir(&path)
-    }
-
-    fn do_mkdir(&self, path: &Path) -> Result<PinnedPathBuf> {
-        assert!(path.is_relative());
-        if path.file_name().is_none() {
-            if !self.recursive {
-                return Err(Error::new(
-                    ErrorKind::AlreadyExists,
-                    "directory already exists",
-                ));
-            } else {
-                return self.root.try_clone();
-            }
-        }
-
-        // Safe because `path` have at least one level.
-        let levels = path.iter().count() - 1;
-        let mut dir = self.root.try_clone()?;
-        for (idx, comp) in path.iter().enumerate() {
-            match dir.open_child(comp) {
-                Ok(v) => {
-                    if !v.metadata()?.is_dir() {
-                        return Err(Error::new(
-                            ErrorKind::Other,
-                            format!("Path {} is not a directory", v.display()),
-                        ));
-                    } else if !self.recursive && idx == levels {
-                        return Err(Error::new(
-                            ErrorKind::AlreadyExists,
-                            "directory already exists",
-                        ));
-                    }
-                    dir = v;
-                }
-                Err(_e) => {
-                    if !self.recursive && idx != levels {
-                        return Err(Error::new(
-                            ErrorKind::NotFound,
-                            format!("parent directory does not exist"),
-                        ));
-                    }
-                    dir = dir.mkdir(comp, self.mode)?;
-                }
-            }
-        }
-
-        Ok(dir)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::fs;
-    use std::fs::DirBuilder;
-    use std::os::unix::fs::{symlink, MetadataExt};
-    use tempfile::tempdir;
-
-    #[test]
-    fn test_scoped_dir_builder() {
-        // create temporary directory to emulate container rootfs with symlink
-        let rootfs_dir = tempdir().expect("failed to create tmpdir");
-        DirBuilder::new()
-            .create(rootfs_dir.path().join("b"))
-            .unwrap();
-        symlink(rootfs_dir.path().join("b"), rootfs_dir.path().join("a")).unwrap();
-        let rootfs_path = &rootfs_dir.path().join("a");
-
-        // root directory doesn't exist
-        ScopedDirBuilder::new(rootfs_path.join("__does_not_exist__")).unwrap_err();
-        ScopedDirBuilder::new("__does_not_exist__").unwrap_err();
-
-        // root is a file
-        fs::write(rootfs_path.join("txt"), "test").unwrap();
-        ScopedDirBuilder::new(rootfs_path.join("txt")).unwrap_err();
-
-        let mut builder = ScopedDirBuilder::new(&rootfs_path).unwrap();
-
-        // file with the same name already exists.
-        builder
-            .create_with_unscoped_path(rootfs_path.join("txt"))
-            .unwrap_err();
-        // parent is a file
-        builder.create("/txt/a").unwrap_err();
-        // Not starting with root
-        builder.create_with_unscoped_path("/txt/a").unwrap_err();
-        // creating "." without recursive mode should fail
-        builder
-            .create_with_unscoped_path(rootfs_path.join("."))
-            .unwrap_err();
-        // parent doesn't exist
-        builder
-            .create_with_unscoped_path(rootfs_path.join("a/b"))
-            .unwrap_err();
-        builder.create("a/b/c").unwrap_err();
-
-        let path = builder.create("a").unwrap();
-        assert!(rootfs_path.join("a").is_dir());
-        assert_eq!(path.target(), rootfs_path.join("a").canonicalize().unwrap());
-
-        // Creating an existing directory without recursive mode should fail.
-        builder
-            .create_with_unscoped_path(rootfs_path.join("a"))
-            .unwrap_err();
-
-        // Creating an existing directory with recursive mode should succeed.
-        builder.recursive(true);
-        let path = builder
-            .create_with_unscoped_path(rootfs_path.join("a"))
-            .unwrap();
-        assert_eq!(path.target(), rootfs_path.join("a").canonicalize().unwrap());
-        let path = builder.create(".").unwrap();
-        assert_eq!(path.target(), rootfs_path.canonicalize().unwrap());
-
-        let umask = unsafe { libc::umask(0022) };
-        unsafe { libc::umask(umask) };
-
-        builder.mode(0o740);
-        let path = builder.create("a/b/c/d").unwrap();
-        assert_eq!(
-            path.target(),
-            rootfs_path.join("a/b/c/d").canonicalize().unwrap()
-        );
-        assert!(rootfs_path.join("a/b/c/d").is_dir());
-        assert_eq!(
-            rootfs_path.join("a").metadata().unwrap().mode() & 0o777,
-            DIRECTORY_MODE_DEFAULT & !umask,
-        );
-        assert_eq!(
-            rootfs_path.join("a/b").metadata().unwrap().mode() & 0o777,
-            0o740 & !umask
-        );
-        assert_eq!(
-            rootfs_path.join("a/b/c").metadata().unwrap().mode() & 0o777,
-            0o740 & !umask
-        );
-        assert_eq!(
-            rootfs_path.join("a/b/c/d").metadata().unwrap().mode() & 0o777,
-            0o740 & !umask
-        );
-
-        // Creating should fail if some components are not directory.
-        builder.create("txt/e/f").unwrap_err();
-        fs::write(rootfs_path.join("a/b/txt"), "test").unwrap();
-        builder.create("a/b/txt/h/i").unwrap_err();
-    }
-
-    #[test]
-    fn test_create_root() {
-        let mut builder = ScopedDirBuilder::new("/").unwrap();
-        builder.recursive(true);
-        builder.create("/").unwrap();
-        builder.create(".").unwrap();
-        builder.create("..").unwrap();
-        builder.create("../../.").unwrap();
-        builder.create("").unwrap();
-        builder.create_with_unscoped_path("/").unwrap();
-        builder.create_with_unscoped_path("/..").unwrap();
-        builder.create_with_unscoped_path("/../.").unwrap();
-    }
-
-    #[test]
-    fn test_create_with_absolute_path() {
-        // create temporary directory to emulate container rootfs with symlink
-        let rootfs_dir = tempdir().expect("failed to create tmpdir");
-        DirBuilder::new()
-            .create(rootfs_dir.path().join("b"))
-            .unwrap();
-        symlink(rootfs_dir.path().join("b"), rootfs_dir.path().join("a")).unwrap();
-        let rootfs_path = &rootfs_dir.path().join("a");
-
-        let mut builder = ScopedDirBuilder::new(&rootfs_path).unwrap();
-        builder.create_with_unscoped_path("/").unwrap_err();
-        builder
-            .create_with_unscoped_path(rootfs_path.join("../__xxxx___xxx__"))
-            .unwrap_err();
-        builder
-            .create_with_unscoped_path(rootfs_path.join("c/d"))
-            .unwrap_err();
-
-        // Return `AlreadyExist` when recursive is false
-        builder.create_with_unscoped_path(&rootfs_path).unwrap_err();
-        builder
-            .create_with_unscoped_path(rootfs_path.join("."))
-            .unwrap_err();
-
-        builder.recursive(true);
-        builder.create_with_unscoped_path(&rootfs_path).unwrap();
-        builder
-            .create_with_unscoped_path(rootfs_path.join("."))
-            .unwrap();
-        builder
-            .create_with_unscoped_path(rootfs_path.join("c/d"))
-            .unwrap();
-    }
-}

src/libs/safe-path/src/scoped_path_resolver.rs

@@ -1,415 +0,0 @@
-// Copyright (c) 2022 Alibaba Cloud
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-use std::io::{Error, ErrorKind, Result};
-use std::path::{Component, Path, PathBuf};
-
-// Follow the same configuration as
-// [secure_join](https://github.com/cyphar/filepath-securejoin/blob/master/join.go#L51)
-const MAX_SYMLINK_DEPTH: u32 = 255;
-
-fn do_scoped_resolve<R: AsRef<Path>, U: AsRef<Path>>(
-    root: R,
-    unsafe_path: U,
-) -> Result<(PathBuf, PathBuf)> {
-    let root = root.as_ref().canonicalize()?;
-
-    let mut nlinks = 0u32;
-    let mut curr_path = unsafe_path.as_ref().to_path_buf();
-    'restart: loop {
-        let mut subpath = PathBuf::new();
-        let mut iter = curr_path.components();
-
-        'next_comp: while let Some(comp) = iter.next() {
-            match comp {
-                // Linux paths don't have prefixes.
-                Component::Prefix(_) => {
-                    return Err(Error::new(
-                        ErrorKind::Other,
-                        format!("Invalid path prefix in: {}", unsafe_path.as_ref().display()),
-                    ));
-                }
-                // `RootDir` should always be the first component, and Path::components() ensures
-                // that.
-                Component::RootDir | Component::CurDir => {
-                    continue 'next_comp;
-                }
-                Component::ParentDir => {
-                    subpath.pop();
-                }
-                Component::Normal(n) => {
-                    let path = root.join(&subpath).join(n);
-                    if let Ok(v) = path.read_link() {
-                        nlinks += 1;
-                        if nlinks > MAX_SYMLINK_DEPTH {
-                            return Err(Error::new(
-                                ErrorKind::Other,
-                                format!(
-                                    "Too many levels of symlinks: {}",
-                                    unsafe_path.as_ref().display()
-                                ),
-                            ));
-                        }
-                        curr_path = if v.is_absolute() {
-                            v.join(iter.as_path())
-                        } else {
-                            subpath.join(v).join(iter.as_path())
-                        };
-                        continue 'restart;
-                    } else {
-                        subpath.push(n);
-                    }
-                }
-            }
-        }
-
-        return Ok((root, subpath));
-    }
-}
-
-/// Resolve `unsafe_path` to a relative path, rooted at and constrained by `root`.
-///
-/// The `scoped_resolve()` function assumes `root` exists and is an absolute path. It processes
-/// each path component in `unsafe_path` as below:
-/// - assume it's not a symlink and output if the component doesn't exist yet.
-/// - ignore if it's "/" or ".".
-/// - go to parent directory but constrained by `root` if it's "..".
-/// - recursively resolve to the real path if it's a symlink. All symlink resolutions will be
-///   constrained by `root`.
-/// - otherwise output the path component.
-///
-/// # Arguments
-/// - `root`: the absolute path to constrain the symlink resolution.
-/// - `unsafe_path`: the path to resolve.
-///
-/// Note that the guarantees provided by this function only apply if the path components in the
-/// returned PathBuf are not modified (in other words are not replaced with symlinks on the
-/// filesystem) after this function has returned. You may use [crate::PinnedPathBuf] to protect
-/// from such TOCTOU attacks.
-pub fn scoped_resolve<R: AsRef<Path>, U: AsRef<Path>>(root: R, unsafe_path: U) -> Result<PathBuf> {
-    do_scoped_resolve(root, unsafe_path).map(|(_root, path)| path)
-}
-
-/// Safely join `unsafe_path` to `root`, and ensure `unsafe_path` is scoped under `root`.
-///
-/// The `scoped_join()` function assumes `root` exists and is an absolute path. It safely joins the
-/// two given paths and ensures:
-/// - The returned path is guaranteed to be scoped inside `root`.
-/// - Any symbolic links in the path are evaluated with the given `root` treated as the root of the
-///   filesystem, similar to a chroot.
-///
-/// It's modelled after [secure_join](https://github.com/cyphar/filepath-securejoin), but only
-/// for Linux systems.
-///
-/// # Arguments
-/// - `root`: the absolute path to scope the symlink evaluation.
-/// - `unsafe_path`: the path to evaluated and joint with `root`. It is unsafe since it may try to
-///   escape from the `root` by using "../" or symlinks.
-///
-/// # Security
-/// On success return, the `scoped_join()` function guarantees that:
-/// - The resulting PathBuf must be a child path of `root` and will not contain any symlink path
-///   components (they will all get expanded).
-/// - When expanding symlinks, all symlink path components must be resolved relative to the provided
-///   `root`. In particular, this can be considered a userspace implementation of how chroot(2)
-///    operates on file paths.
-/// - Non-existent path components are unaffected.
-///
-/// Note that the guarantees provided by this function only apply if the path components in the
-/// returned string are not modified (in other words are not replaced with symlinks on the
-/// filesystem) after this function has returned. You may use [crate::PinnedPathBuf] to protect
-/// from such TOCTTOU attacks.
-pub fn scoped_join<R: AsRef<Path>, U: AsRef<Path>>(root: R, unsafe_path: U) -> Result<PathBuf> {
-    do_scoped_resolve(root, unsafe_path).map(|(root, path)| root.join(path))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::fs::DirBuilder;
-    use std::os::unix::fs;
-    use tempfile::tempdir;
-
-    #[allow(dead_code)]
-    #[derive(Debug)]
-    struct TestData<'a> {
-        name: &'a str,
-        rootfs: &'a Path,
-        unsafe_path: &'a str,
-        result: &'a str,
-    }
-
-    fn exec_tests(tests: &[TestData]) {
-        for (i, t) in tests.iter().enumerate() {
-            // Create a string containing details of the test
-            let msg = format!("test[{}]: {:?}", i, t);
-            let result = scoped_resolve(t.rootfs, t.unsafe_path).unwrap();
-            let msg = format!("{}, result: {:?}", msg, result);
-
-            // Perform the checks
-            assert_eq!(&result, Path::new(t.result), "{}", msg);
-        }
-    }
-
-    #[test]
-    fn test_scoped_resolve() {
-        // create temporary directory to emulate container rootfs with symlink
-        let rootfs_dir = tempdir().expect("failed to create tmpdir");
-        DirBuilder::new()
-            .create(rootfs_dir.path().join("b"))
-            .unwrap();
-        fs::symlink(rootfs_dir.path().join("b"), rootfs_dir.path().join("a")).unwrap();
-        let rootfs_path = &rootfs_dir.path().join("a");
-
-        let tests = [
-            TestData {
-                name: "normal path",
-                rootfs: rootfs_path,
-                unsafe_path: "a/b/c",
-                result: "a/b/c",
-            },
-            TestData {
-                name: "path with .. at beginning",
-                rootfs: rootfs_path,
-                unsafe_path: "../../../a/b/c",
-                result: "a/b/c",
-            },
-            TestData {
-                name: "path with complex .. pattern",
-                rootfs: rootfs_path,
-                unsafe_path: "../../../a/../../b/../../c",
-                result: "c",
-            },
-            TestData {
-                name: "path with .. in middle",
-                rootfs: rootfs_path,
-                unsafe_path: "/usr/bin/../../bin/ls",
-                result: "bin/ls",
-            },
-            TestData {
-                name: "path with . and ..",
-                rootfs: rootfs_path,
-                unsafe_path: "/usr/./bin/../../bin/./ls",
-                result: "bin/ls",
-            },
-            TestData {
-                name: "path with . at end",
-                rootfs: rootfs_path,
-                unsafe_path: "/usr/./bin/../../bin/./ls/.",
-                result: "bin/ls",
-            },
-            TestData {
-                name: "path try to escape by ..",
-                rootfs: rootfs_path,
-                unsafe_path: "/usr/./bin/../../../../bin/./ls/../ls",
-                result: "bin/ls",
-            },
-            TestData {
-                name: "path with .. at the end",
-                rootfs: rootfs_path,
-                unsafe_path: "/usr/./bin/../../bin/./ls/..",
-                result: "bin",
-            },
-            TestData {
-                name: "path ..",
-                rootfs: rootfs_path,
-                unsafe_path: "..",
-                result: "",
-            },
-            TestData {
-                name: "path .",
-                rootfs: rootfs_path,
-                unsafe_path: ".",
-                result: "",
-            },
-            TestData {
-                name: "path /",
-                rootfs: rootfs_path,
-                unsafe_path: "/",
-                result: "",
-            },
-            TestData {
-                name: "empty path",
-                rootfs: rootfs_path,
-                unsafe_path: "",
-                result: "",
-            },
-        ];
-
-        exec_tests(&tests);
-    }
-
-    #[test]
-    fn test_scoped_resolve_invalid() {
-        scoped_resolve("./root_is_not_absolute_path", ".").unwrap_err();
-        scoped_resolve("C:", ".").unwrap_err();
-        scoped_resolve(r#"\\server\test"#, ".").unwrap_err();
-        scoped_resolve(r#"http://localhost/test"#, ".").unwrap_err();
-        // Chinese Unicode characters
-        scoped_resolve(r#"您好"#, ".").unwrap_err();
-    }
-
-    #[test]
-    fn test_scoped_resolve_symlink() {
-        // create temporary directory to emulate container rootfs with symlink
-        let rootfs_dir = tempdir().expect("failed to create tmpdir");
-        let rootfs_path = &rootfs_dir.path();
-        std::fs::create_dir(rootfs_path.join("symlink_dir")).unwrap();
-
-        fs::symlink("../../../", rootfs_path.join("1")).unwrap();
-        let tests = [TestData {
-            name: "relative symlink beyond root",
-            rootfs: rootfs_path,
-            unsafe_path: "1",
-            result: "",
-        }];
-        exec_tests(&tests);
-
-        fs::symlink("/dddd", rootfs_path.join("2")).unwrap();
-        let tests = [TestData {
-            name: "abs symlink pointing to non-exist directory",
-            rootfs: rootfs_path,
-            unsafe_path: "2",
-            result: "dddd",
-        }];
-        exec_tests(&tests);
-
-        fs::symlink("/", rootfs_path.join("3")).unwrap();
-        let tests = [TestData {
-            name: "abs symlink pointing to /",
-            rootfs: rootfs_path,
-            unsafe_path: "3",
-            result: "",
-        }];
-        exec_tests(&tests);
-
-        fs::symlink("usr/bin/../bin/ls", rootfs_path.join("4")).unwrap();
-        let tests = [TestData {
-            name: "symlink with one ..",
-            rootfs: rootfs_path,
-            unsafe_path: "4",
-            result: "usr/bin/ls",
-        }];
-        exec_tests(&tests);
-
-        fs::symlink("usr/bin/../../bin/ls", rootfs_path.join("5")).unwrap();
-        let tests = [TestData {
-            name: "symlink with two ..",
-            rootfs: rootfs_path,
-            unsafe_path: "5",
-            result: "bin/ls",
-        }];
-        exec_tests(&tests);
-
-        fs::symlink(
-            "../usr/bin/../../../bin/ls",
-            rootfs_path.join("symlink_dir/6"),
-        )
-        .unwrap();
-        let tests = [TestData {
-            name: "symlink try to escape",
-            rootfs: rootfs_path,
-            unsafe_path: "symlink_dir/6",
-            result: "bin/ls",
-        }];
-        exec_tests(&tests);
-
-        // Detect symlink loop.
-        fs::symlink("/endpoint_b", rootfs_path.join("endpoint_a")).unwrap();
-        fs::symlink("/endpoint_a", rootfs_path.join("endpoint_b")).unwrap();
-        scoped_resolve(rootfs_path, "endpoint_a").unwrap_err();
-    }
-
-    #[test]
-    fn test_scoped_join() {
-        // create temporary directory to emulate container rootfs with symlink
-        let rootfs_dir = tempdir().expect("failed to create tmpdir");
-        let rootfs_path = &rootfs_dir.path();
-
-        assert_eq!(
-            scoped_join(&rootfs_path, "a").unwrap(),
-            rootfs_path.join("a")
-        );
-        assert_eq!(
-            scoped_join(&rootfs_path, "./a").unwrap(),
-            rootfs_path.join("a")
-        );
-        assert_eq!(
-            scoped_join(&rootfs_path, "././a").unwrap(),
-            rootfs_path.join("a")
-        );
-        assert_eq!(
-            scoped_join(&rootfs_path, "c/d/../../a").unwrap(),
-            rootfs_path.join("a")
-        );
-        assert_eq!(
-            scoped_join(&rootfs_path, "c/d/../../../.././a").unwrap(),
-            rootfs_path.join("a")
-        );
-        assert_eq!(
-            scoped_join(&rootfs_path, "../../a").unwrap(),
-            rootfs_path.join("a")
-        );
-        assert_eq!(
-            scoped_join(&rootfs_path, "./../a").unwrap(),
-            rootfs_path.join("a")
-        );
-    }
-
-    #[test]
-    fn test_scoped_join_symlink() {
-        // create temporary directory to emulate container rootfs with symlink
-        let rootfs_dir = tempdir().expect("failed to create tmpdir");
-        let rootfs_path = &rootfs_dir.path();
-        DirBuilder::new()
-            .recursive(true)
-            .create(rootfs_dir.path().join("b/c"))
-            .unwrap();
-        fs::symlink("b/c", rootfs_dir.path().join("a")).unwrap();
-
-        let target = rootfs_path.join("b/c");
-        assert_eq!(scoped_join(&rootfs_path, "a").unwrap(), target);
-        assert_eq!(scoped_join(&rootfs_path, "./a").unwrap(), target);
-        assert_eq!(scoped_join(&rootfs_path, "././a").unwrap(), target);
-        assert_eq!(scoped_join(&rootfs_path, "b/c/../../a").unwrap(), target);
-        assert_eq!(
-            scoped_join(&rootfs_path, "b/c/../../../.././a").unwrap(),
-            target
-        );
-        assert_eq!(scoped_join(&rootfs_path, "../../a").unwrap(), target);
-        assert_eq!(scoped_join(&rootfs_path, "./../a").unwrap(), target);
-        assert_eq!(scoped_join(&rootfs_path, "a/../../../a").unwrap(), target);
-        assert_eq!(scoped_join(&rootfs_path, "a/../../../b/c").unwrap(), target);
-    }
-
-    #[test]
-    fn test_scoped_join_symlink_loop() {
-        // create temporary directory to emulate container rootfs with symlink
-        let rootfs_dir = tempdir().expect("failed to create tmpdir");
-        let rootfs_path = &rootfs_dir.path();
-        fs::symlink("/endpoint_b", rootfs_path.join("endpoint_a")).unwrap();
-        fs::symlink("/endpoint_a", rootfs_path.join("endpoint_b")).unwrap();
-        scoped_join(rootfs_path, "endpoint_a").unwrap_err();
-    }
-
-    #[test]
-    fn test_scoped_join_unicode_character() {
-        // create temporary directory to emulate container rootfs with symlink
-        let rootfs_dir = tempdir().expect("failed to create tmpdir");
-        let rootfs_path = &rootfs_dir.path().canonicalize().unwrap();
-
-        let path = scoped_join(rootfs_path, "您好").unwrap();
-        assert_eq!(path, rootfs_path.join("您好"));
-
-        let path = scoped_join(rootfs_path, "../../../您好").unwrap();
-        assert_eq!(path, rootfs_path.join("您好"));
-
-        let path = scoped_join(rootfs_path, "。。/您好").unwrap();
-        assert_eq!(path, rootfs_path.join("。。/您好"));
-
-        let path = scoped_join(rootfs_path, "您好/../../test").unwrap();
-        assert_eq!(path, rootfs_path.join("test"));
-    }
-}

src/runtime/Makefile

@@ -592,7 +592,7 @@ generate-config: $(CONFIGS)
 test: hook go-test
 
 hook:
-	make -C pkg/katautils/mockhook
+	make -C virtcontainers hook
 
 go-test: $(GENERATED_FILES)
 	go clean -testcache

src/runtime/README.md

@@ -159,7 +159,7 @@ See [the community repository](https://github.com/kata-containers/community).
 
 ### Contact
 
-See [how to reach the community](https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#contact).
+See [how to reach the community](https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md#contact).
 
 ## Further information
 

src/runtime/cmd/kata-runtime/factory_test.go

@@ -8,6 +8,7 @@ package main
 import (
 	"context"
 	"flag"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -42,7 +43,9 @@ func TestFactoryCLIFunctionNoRuntimeConfig(t *testing.T) {
 func TestFactoryCLIFunctionInit(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	runtimeConfig, err := newTestRuntimeConfig(tmpdir, testConsole, true)
 	assert.NoError(err)
@@ -89,7 +92,9 @@ func TestFactoryCLIFunctionInit(t *testing.T) {
 func TestFactoryCLIFunctionDestroy(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	runtimeConfig, err := newTestRuntimeConfig(tmpdir, testConsole, true)
 	assert.NoError(err)
@@ -121,7 +126,9 @@ func TestFactoryCLIFunctionDestroy(t *testing.T) {
 func TestFactoryCLIFunctionStatus(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	runtimeConfig, err := newTestRuntimeConfig(tmpdir, testConsole, true)
 	assert.NoError(err)

src/runtime/cmd/kata-runtime/kata-check_amd64_test.go

@@ -71,7 +71,11 @@ func TestCCCheckCLIFunction(t *testing.T) {
 func TestCheckCheckKernelModulesNoNesting(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedSysModuleDir := sysModuleDir
 	savedProcCPUInfo := procCPUInfo
@@ -87,7 +91,7 @@ func TestCheckCheckKernelModulesNoNesting(t *testing.T) {
 		procCPUInfo = savedProcCPUInfo
 	}()
 
-	err := os.MkdirAll(sysModuleDir, testDirMode)
+	err = os.MkdirAll(sysModuleDir, testDirMode)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -152,7 +156,11 @@ func TestCheckCheckKernelModulesNoNesting(t *testing.T) {
 func TestCheckCheckKernelModulesNoUnrestrictedGuest(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedSysModuleDir := sysModuleDir
 	savedProcCPUInfo := procCPUInfo
@@ -168,7 +176,7 @@ func TestCheckCheckKernelModulesNoUnrestrictedGuest(t *testing.T) {
 		procCPUInfo = savedProcCPUInfo
 	}()
 
-	err := os.MkdirAll(sysModuleDir, testDirMode)
+	err = os.MkdirAll(sysModuleDir, testDirMode)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -247,7 +255,11 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedSysModuleDir := sysModuleDir
 	savedProcCPUInfo := procCPUInfo
@@ -263,7 +275,7 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 		procCPUInfo = savedProcCPUInfo
 	}()
 
-	err := os.MkdirAll(sysModuleDir, testDirMode)
+	err = os.MkdirAll(sysModuleDir, testDirMode)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -393,7 +405,11 @@ func TestArchKernelParamHandler(t *testing.T) {
 func TestKvmIsUsable(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedKvmDevice := kvmDevice
 	fakeKVMDevice := filepath.Join(dir, "kvm")
@@ -403,7 +419,7 @@ func TestKvmIsUsable(t *testing.T) {
 		kvmDevice = savedKvmDevice
 	}()
 
-	err := kvmIsUsable()
+	err = kvmIsUsable()
 	assert.Error(err)
 
 	err = createEmptyFile(fakeKVMDevice)
@@ -441,7 +457,9 @@ foo     : bar
 func TestSetCPUtype(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	savedArchRequiredCPUFlags := archRequiredCPUFlags
 	savedArchRequiredCPUAttribs := archRequiredCPUAttribs

src/runtime/cmd/kata-runtime/kata-check_arm64_test.go

@@ -67,7 +67,11 @@ foo     : bar
 		{validContents, validNormalizeVendorName, validNormalizeModelName, false},
 	}
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	savedProcCPUInfo := procCPUInfo
 
@@ -80,7 +84,7 @@ foo     : bar
 		procCPUInfo = savedProcCPUInfo
 	}()
 
-	_, _, err := getCPUDetails()
+	_, _, err = getCPUDetails()
 	// ENOENT
 	assert.Error(t, err)
 	assert.True(t, os.IsNotExist(err))

src/runtime/cmd/kata-runtime/kata-check_generic_test.go

@@ -9,6 +9,7 @@
 package main
 
 import (
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -17,7 +18,9 @@ import (
 func testSetCPUTypeGeneric(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	savedArchRequiredCPUFlags := archRequiredCPUFlags
 	savedArchRequiredCPUAttribs := archRequiredCPUAttribs

src/runtime/cmd/kata-runtime/kata-check_ppc64le_test.go

@@ -7,6 +7,7 @@ package main
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -117,7 +118,11 @@ func TestArchKernelParamHandler(t *testing.T) {
 func TestKvmIsUsable(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedKvmDevice := kvmDevice
 	fakeKVMDevice := filepath.Join(dir, "kvm")
@@ -127,7 +132,7 @@ func TestKvmIsUsable(t *testing.T) {
 		kvmDevice = savedKvmDevice
 	}()
 
-	err := kvmIsUsable()
+	err = kvmIsUsable()
 	assert.Error(err)
 
 	err = createEmptyFile(fakeKVMDevice)

src/runtime/cmd/kata-runtime/kata-check_s390x_test.go

@@ -7,6 +7,7 @@ package main
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -116,7 +117,11 @@ func TestArchKernelParamHandler(t *testing.T) {
 func TestKvmIsUsable(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedKvmDevice := kvmDevice
 	fakeKVMDevice := filepath.Join(dir, "kvm")
@@ -126,7 +131,7 @@ func TestKvmIsUsable(t *testing.T) {
 		kvmDevice = savedKvmDevice
 	}()
 
-	err := kvmIsUsable()
+	err = kvmIsUsable()
 	assert.Error(err)
 
 	err = createEmptyFile(fakeKVMDevice)

src/runtime/cmd/kata-runtime/kata-check_test.go

@@ -155,7 +155,11 @@ func makeCPUInfoFile(path, vendorID, flags string) error {
 
 // nolint: unused, deadcode
 func genericTestGetCPUDetails(t *testing.T, validVendor string, validModel string, validContents string, data []testCPUDetail) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	savedProcCPUInfo := procCPUInfo
 
@@ -168,7 +172,7 @@ func genericTestGetCPUDetails(t *testing.T, validVendor string, validModel strin
 		procCPUInfo = savedProcCPUInfo
 	}()
 
-	_, _, err := getCPUDetails()
+	_, _, err = getCPUDetails()
 	// ENOENT
 	assert.Error(t, err)
 	assert.True(t, os.IsNotExist(err))
@@ -193,7 +197,11 @@ func genericTestGetCPUDetails(t *testing.T, validVendor string, validModel strin
 func genericCheckCLIFunction(t *testing.T, cpuData []testCPUData, moduleData []testModuleData) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	_, config, err := makeRuntimeConfig(dir)
 	assert.NoError(err)
@@ -299,11 +307,15 @@ func TestCheckGetCPUInfo(t *testing.T) {
 		{"foo\n\nbar\nbaz\n\n", "foo", false},
 	}
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	file := filepath.Join(dir, "cpuinfo")
 	// file doesn't exist
-	_, err := getCPUInfo(file)
+	_, err = getCPUInfo(file)
 	assert.Error(err)
 
 	for _, d := range data {
@@ -515,7 +527,11 @@ func TestCheckHaveKernelModule(t *testing.T) {
 
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedModProbeCmd := modProbeCmd
 	savedSysModuleDir := sysModuleDir
@@ -529,7 +545,7 @@ func TestCheckHaveKernelModule(t *testing.T) {
 		sysModuleDir = savedSysModuleDir
 	}()
 
-	err := os.MkdirAll(sysModuleDir, testDirMode)
+	err = os.MkdirAll(sysModuleDir, testDirMode)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -561,7 +577,11 @@ func TestCheckHaveKernelModule(t *testing.T) {
 func TestCheckCheckKernelModules(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedModProbeCmd := modProbeCmd
 	savedSysModuleDir := sysModuleDir
@@ -575,7 +595,7 @@ func TestCheckCheckKernelModules(t *testing.T) {
 		sysModuleDir = savedSysModuleDir
 	}()
 
-	err := os.MkdirAll(sysModuleDir, testDirMode)
+	err = os.MkdirAll(sysModuleDir, testDirMode)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -642,7 +662,11 @@ func TestCheckCheckKernelModulesUnreadableFile(t *testing.T) {
 		t.Skip(ktu.TestDisabledNeedNonRoot)
 	}
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	testData := map[string]kernelModule{
 		"foo": {
@@ -667,7 +691,7 @@ func TestCheckCheckKernelModulesUnreadableFile(t *testing.T) {
 	}()
 
 	modPath := filepath.Join(sysModuleDir, "foo/parameters")
-	err := os.MkdirAll(modPath, testDirMode)
+	err = os.MkdirAll(modPath, testDirMode)
 	assert.NoError(err)
 
 	modParamFile := filepath.Join(modPath, "param1")
@@ -686,7 +710,11 @@ func TestCheckCheckKernelModulesUnreadableFile(t *testing.T) {
 func TestCheckCheckKernelModulesInvalidFileContents(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	testData := map[string]kernelModule{
 		"foo": {
@@ -711,7 +739,7 @@ func TestCheckCheckKernelModulesInvalidFileContents(t *testing.T) {
 	}()
 
 	modPath := filepath.Join(sysModuleDir, "foo/parameters")
-	err := os.MkdirAll(modPath, testDirMode)
+	err = os.MkdirAll(modPath, testDirMode)
 	assert.NoError(err)
 
 	modParamFile := filepath.Join(modPath, "param1")
@@ -727,7 +755,11 @@ func TestCheckCheckKernelModulesInvalidFileContents(t *testing.T) {
 func TestCheckCLIFunctionFail(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	_, config, err := makeRuntimeConfig(dir)
 	assert.NoError(err)
@@ -756,7 +788,11 @@ func TestCheckCLIFunctionFail(t *testing.T) {
 func TestCheckKernelParamHandler(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedModProbeCmd := modProbeCmd
 	savedSysModuleDir := sysModuleDir
@@ -834,7 +870,9 @@ func TestCheckKernelParamHandler(t *testing.T) {
 func TestArchRequiredKernelModules(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	_, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(err)
@@ -847,7 +885,11 @@ func TestArchRequiredKernelModules(t *testing.T) {
 		return
 	}
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	savedModProbeCmd := modProbeCmd
 	savedSysModuleDir := sysModuleDir

src/runtime/cmd/kata-runtime/kata-env_amd64_test.go

@@ -6,6 +6,7 @@
 package main
 
 import (
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -21,7 +22,9 @@ func getExpectedHostDetails(tmpdir string) (HostInfo, error) {
 func TestEnvGetEnvInfoSetsCPUType(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	savedArchRequiredCPUFlags := archRequiredCPUFlags
 	savedArchRequiredCPUAttribs := archRequiredCPUAttribs

src/runtime/cmd/kata-runtime/kata-env_generic_test.go

@@ -9,6 +9,7 @@
 package main
 
 import (
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -17,7 +18,9 @@ import (
 func testEnvGetEnvInfoSetsCPUTypeGeneric(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	savedArchRequiredCPUFlags := archRequiredCPUFlags
 	savedArchRequiredCPUAttribs := archRequiredCPUAttribs

src/runtime/cmd/kata-runtime/kata-env_test.go

@@ -364,7 +364,11 @@ func TestEnvGetMetaInfo(t *testing.T) {
 }
 
 func TestEnvGetHostInfo(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	expectedHostDetails, err := getExpectedHostDetails(tmpdir)
 	assert.NoError(t, err)
@@ -385,9 +389,13 @@ func TestEnvGetHostInfo(t *testing.T) {
 }
 
 func TestEnvGetHostInfoNoProcCPUInfo(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
-	_, err := getExpectedHostDetails(tmpdir)
+	_, err = getExpectedHostDetails(tmpdir)
 	assert.NoError(t, err)
 
 	err = os.Remove(procCPUInfo)
@@ -398,9 +406,13 @@ func TestEnvGetHostInfoNoProcCPUInfo(t *testing.T) {
 }
 
 func TestEnvGetHostInfoNoOSRelease(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
-	_, err := getExpectedHostDetails(tmpdir)
+	_, err = getExpectedHostDetails(tmpdir)
 	assert.NoError(t, err)
 
 	err = os.Remove(osRelease)
@@ -411,9 +423,13 @@ func TestEnvGetHostInfoNoOSRelease(t *testing.T) {
 }
 
 func TestEnvGetHostInfoNoProcVersion(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
-	_, err := getExpectedHostDetails(tmpdir)
+	_, err = getExpectedHostDetails(tmpdir)
 	assert.NoError(t, err)
 
 	err = os.Remove(procVersion)
@@ -424,7 +440,11 @@ func TestEnvGetHostInfoNoProcVersion(t *testing.T) {
 }
 
 func TestEnvGetEnvInfo(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	// Run test twice to ensure the individual component debug+trace
 	// options are tested.
@@ -454,7 +474,9 @@ func TestEnvGetEnvInfo(t *testing.T) {
 func TestEnvGetEnvInfoNoHypervisorVersion(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	configFile, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(err)
@@ -479,14 +501,20 @@ func TestEnvGetEnvInfoNoHypervisorVersion(t *testing.T) {
 func TestEnvGetEnvInfoAgentError(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
-	_, _, err := makeRuntimeConfig(tmpdir)
+	_, _, err = makeRuntimeConfig(tmpdir)
 	assert.NoError(err)
 }
 
 func TestEnvGetEnvInfoNoOSRelease(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	configFile, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(t, err)
@@ -502,7 +530,11 @@ func TestEnvGetEnvInfoNoOSRelease(t *testing.T) {
 }
 
 func TestEnvGetEnvInfoNoProcCPUInfo(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	configFile, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(t, err)
@@ -518,7 +550,11 @@ func TestEnvGetEnvInfoNoProcCPUInfo(t *testing.T) {
 }
 
 func TestEnvGetEnvInfoNoProcVersion(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	configFile, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(t, err)
@@ -534,7 +570,11 @@ func TestEnvGetEnvInfoNoProcVersion(t *testing.T) {
 }
 
 func TestEnvGetRuntimeInfo(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	configFile, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(t, err)
@@ -547,7 +587,11 @@ func TestEnvGetRuntimeInfo(t *testing.T) {
 }
 
 func TestEnvGetAgentInfo(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	_, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(t, err)
@@ -682,7 +726,11 @@ func testEnvShowJSONSettings(t *testing.T, tmpdir string, tmpfile *os.File) erro
 }
 
 func TestEnvShowSettings(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	tmpfile, err := os.CreateTemp("", "envShowSettings-")
 	assert.NoError(t, err)
@@ -699,7 +747,11 @@ func TestEnvShowSettings(t *testing.T) {
 }
 
 func TestEnvShowSettingsInvalidFile(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	tmpfile, err := os.CreateTemp("", "envShowSettings-")
 	assert.NoError(t, err)
@@ -719,7 +771,11 @@ func TestEnvShowSettingsInvalidFile(t *testing.T) {
 }
 
 func TestEnvHandleSettings(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	configFile, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(t, err)
@@ -749,7 +805,9 @@ func TestEnvHandleSettings(t *testing.T) {
 func TestEnvHandleSettingsInvalidParams(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	configFile, _, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(err)
@@ -801,7 +859,11 @@ func TestEnvHandleSettingsInvalidRuntimeConfigType(t *testing.T) {
 }
 
 func TestEnvCLIFunction(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	configFile, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(t, err)
@@ -842,7 +904,11 @@ func TestEnvCLIFunction(t *testing.T) {
 }
 
 func TestEnvCLIFunctionFail(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	configFile, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(t, err)
@@ -874,7 +940,9 @@ func TestEnvCLIFunctionFail(t *testing.T) {
 func TestGetHypervisorInfo(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	_, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(err)
@@ -894,7 +962,9 @@ func TestGetHypervisorInfo(t *testing.T) {
 func TestGetHypervisorInfoSocket(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	_, config, err := makeRuntimeConfig(tmpdir)
 	assert.NoError(err)

src/runtime/cmd/kata-runtime/kata-volume.go

@@ -7,10 +7,11 @@ package main
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/url"
 
 	containerdshim "github.com/kata-containers/kata-containers/src/runtime/pkg/containerd-shim-v2"
-	"github.com/kata-containers/kata-containers/src/runtime/pkg/direct-volume"
+	volume "github.com/kata-containers/kata-containers/src/runtime/pkg/direct-volume"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/utils/shimclient"
 
 	"github.com/urfave/cli"
@@ -89,12 +90,14 @@ var statsCommand = cli.Command{
 			Destination: &volumePath,
 		},
 	},
-	Action: func(c *cli.Context) (string, error) {
+	Action: func(c *cli.Context) error {
 		stats, err := Stats(volumePath)
 		if err != nil {
-			return "", cli.NewExitError(err.Error(), 1)
+			return cli.NewExitError(err.Error(), 1)
 		}
-		return string(stats), nil
+
+		fmt.Println(string(stats))
+		return nil
 	},
 }
 
@@ -127,8 +130,14 @@ func Stats(volumePath string) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	urlSafeDevicePath := url.PathEscape(volumePath)
-	body, err := shimclient.DoGet(sandboxId, defaultTimeout, containerdshim.DirectVolumeStatUrl+"/"+urlSafeDevicePath)
+	volumeMountInfo, err := volume.VolumeMountInfo(volumePath)
+	if err != nil {
+		return nil, err
+	}
+
+	urlSafeDevicePath := url.PathEscape(volumeMountInfo.Device)
+	body, err := shimclient.DoGet(sandboxId, defaultTimeout,
+		fmt.Sprintf("%s?%s=%s", containerdshim.DirectVolumeStatUrl, containerdshim.DirectVolumePathKey, urlSafeDevicePath))
 	if err != nil {
 		return nil, err
 	}
@@ -141,8 +150,13 @@ func Resize(volumePath string, size uint64) error {
 	if err != nil {
 		return err
 	}
+	volumeMountInfo, err := volume.VolumeMountInfo(volumePath)
+	if err != nil {
+		return err
+	}
+
 	resizeReq := containerdshim.ResizeRequest{
-		VolumePath: volumePath,
+		VolumePath: volumeMountInfo.Device,
 		Size:       size,
 	}
 	encoded, err := json.Marshal(resizeReq)

src/runtime/cmd/kata-runtime/main_test.go

@@ -258,12 +258,14 @@ func TestMainBeforeSubCommands(t *testing.T) {
 func TestMainBeforeSubCommandsInvalidLogFile(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "katatest")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	logFile := filepath.Join(tmpdir, "log")
 
 	// create the file as the wrong type to force a failure
-	err := os.MkdirAll(logFile, testDirMode)
+	err = os.MkdirAll(logFile, testDirMode)
 	assert.NoError(err)
 
 	set := flag.NewFlagSet("", 0)
@@ -279,7 +281,9 @@ func TestMainBeforeSubCommandsInvalidLogFile(t *testing.T) {
 func TestMainBeforeSubCommandsInvalidLogFormat(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "katatest")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	logFile := filepath.Join(tmpdir, "log")
 
@@ -298,7 +302,7 @@ func TestMainBeforeSubCommandsInvalidLogFormat(t *testing.T) {
 
 	ctx := createCLIContext(set)
 
-	err := beforeSubcommands(ctx)
+	err = beforeSubcommands(ctx)
 	assert.Error(err)
 	assert.NotNil(kataLog.Logger.Out)
 }
@@ -306,7 +310,9 @@ func TestMainBeforeSubCommandsInvalidLogFormat(t *testing.T) {
 func TestMainBeforeSubCommandsLoadConfigurationFail(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "katatest")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	logFile := filepath.Join(tmpdir, "log")
 	configFile := filepath.Join(tmpdir, "config")
@@ -339,7 +345,9 @@ func TestMainBeforeSubCommandsLoadConfigurationFail(t *testing.T) {
 func TestMainBeforeSubCommandsShowCCConfigPaths(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "katatest")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	set := flag.NewFlagSet("", 0)
 	set.Bool("show-default-config-paths", true, "")
@@ -401,7 +409,9 @@ func TestMainBeforeSubCommandsShowCCConfigPaths(t *testing.T) {
 func TestMainFatal(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "katatest")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	var exitStatus int
 	savedExitFunc := exitFunc
@@ -623,7 +633,9 @@ func TestMainCreateRuntime(t *testing.T) {
 func TestMainVersionPrinter(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "katatest")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	savedOutputFile := defaultOutputFile
 

src/runtime/cmd/kata-runtime/utils_test.go

@@ -17,14 +17,18 @@ import (
 )
 
 func TestFileExists(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "katatest")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	file := filepath.Join(dir, "foo")
 
 	assert.False(t, katautils.FileExists(file),
 		fmt.Sprintf("File %q should not exist", file))
 
-	err := createEmptyFile(file)
+	err = createEmptyFile(file)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -50,10 +54,14 @@ func TestGetKernelVersion(t *testing.T) {
 		{validContents, validVersion, false},
 	}
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	subDir := filepath.Join(tmpdir, "subdir")
-	err := os.MkdirAll(subDir, testDirMode)
+	err = os.MkdirAll(subDir, testDirMode)
 	assert.NoError(t, err)
 
 	_, err = getKernelVersion()
@@ -95,7 +103,11 @@ func TestGetDistroDetails(t *testing.T) {
 
 	const unknown = "<<unknown>>"
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(tmpdir)
 
 	testOSRelease := filepath.Join(tmpdir, "os-release")
 	testOSReleaseClr := filepath.Join(tmpdir, "os-release-clr")
@@ -119,7 +131,7 @@ VERSION_ID="%s"
 `, nonClrExpectedName, nonClrExpectedVersion)
 
 	subDir := filepath.Join(tmpdir, "subdir")
-	err := os.MkdirAll(subDir, testDirMode)
+	err = os.MkdirAll(subDir, testDirMode)
 	assert.NoError(t, err)
 
 	// override

src/runtime/config/configuration-clh.toml.in

@@ -125,8 +125,7 @@ virtio_fs_cache_size = @DEFVIRTIOFSCACHESIZE@
 #
 # Format example:
 #   ["-o", "arg1=xxx,arg2", "-o", "hello world", "--arg3=yyy"]
-# Examples:
-#   Set virtiofsd log level to debug : ["-o", "log_level=debug"] or ["-d"]
+#
 # see `virtiofsd -h` for possible options.
 virtio_fs_extra_args = @DEFVIRTIOFSEXTRAARGS@
 
@@ -180,78 +179,6 @@ block_device_driver = "virtio-blk"
 # but it will not abort container execution.
 #guest_hook_path = "/usr/share/oci/hooks"
 #
-# These options are related to network rate limiter at the VMM level, and are
-# based on the Cloud Hypervisor I/O throttling.  Those are disabled by default
-# and we strongly advise users to refer the Cloud Hypervisor official
-# documentation for a better understanding of its internals:
-# https://github.com/cloud-hypervisor/cloud-hypervisor/blob/main/docs/io_throttling.md
-# 
-# Bandwidth rate limiter options
-# 
-# net_rate_limiter_bw_max_rate controls network I/O bandwidth (size in bits/sec
-# for SB/VM).
-# The same value is used for inbound and outbound bandwidth.
-# Default 0-sized value means unlimited rate.
-#net_rate_limiter_bw_max_rate = 0
-#
-# net_rate_limiter_bw_one_time_burst increases the initial max rate and this
-# initial extra credit does *NOT* affect the overall limit and can be used for
-# an *initial* burst of data.
-# This is *optional* and only takes effect if net_rate_limiter_bw_max_rate is
-# set to a non zero value.
-#net_rate_limiter_bw_one_time_burst = 0
-#
-# Operation rate limiter options
-#
-# net_rate_limiter_ops_max_rate controls network I/O bandwidth (size in ops/sec
-# for SB/VM).
-# The same value is used for inbound and outbound bandwidth.
-# Default 0-sized value means unlimited rate.
-#net_rate_limiter_ops_max_rate = 0
-#
-# net_rate_limiter_ops_one_time_burst increases the initial max rate and this
-# initial extra credit does *NOT* affect the overall limit and can be used for
-# an *initial* burst of data.
-# This is *optional* and only takes effect if net_rate_limiter_bw_max_rate is
-# set to a non zero value.
-#net_rate_limiter_ops_one_time_burst = 0
-#
-# These options are related to disk rate limiter at the VMM level, and are
-# based on the Cloud Hypervisor I/O throttling.  Those are disabled by default
-# and we strongly advise users to refer the Cloud Hypervisor official
-# documentation for a better understanding of its internals:
-# https://github.com/cloud-hypervisor/cloud-hypervisor/blob/main/docs/io_throttling.md
-# 
-# Bandwidth rate limiter options
-# 
-# disk_rate_limiter_bw_max_rate controls disk I/O bandwidth (size in bits/sec
-# for SB/VM).
-# The same value is used for inbound and outbound bandwidth.
-# Default 0-sized value means unlimited rate.
-#disk_rate_limiter_bw_max_rate = 0
-#
-# disk_rate_limiter_bw_one_time_burst increases the initial max rate and this
-# initial extra credit does *NOT* affect the overall limit and can be used for
-# an *initial* burst of data.
-# This is *optional* and only takes effect if disk_rate_limiter_bw_max_rate is
-# set to a non zero value.
-#disk_rate_limiter_bw_one_time_burst = 0
-#
-# Operation rate limiter options
-#
-# disk_rate_limiter_ops_max_rate controls disk I/O bandwidth (size in ops/sec
-# for SB/VM).
-# The same value is used for inbound and outbound bandwidth.
-# Default 0-sized value means unlimited rate.
-#disk_rate_limiter_ops_max_rate = 0
-#
-# disk_rate_limiter_ops_one_time_burst increases the initial max rate and this
-# initial extra credit does *NOT* affect the overall limit and can be used for
-# an *initial* burst of data.
-# This is *optional* and only takes effect if disk_rate_limiter_bw_max_rate is
-# set to a non zero value.
-#disk_rate_limiter_ops_one_time_burst = 0
-
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
@@ -397,30 +324,3 @@ experimental=@DEFAULTEXPFEATURES@
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
 # enable_pprof = true
-
-# WARNING: All the options in the following section have not been implemented yet.
-# This section was added as a placeholder. DO NOT USE IT!
-[image]
-# Container image service.
-#
-# Offload the CRI image management service to the Kata agent.
-# (default: false)
-#service_offload = true
-
-# Container image decryption keys provisioning.
-# Applies only if service_offload is true.
-# Keys can be provisioned locally (e.g. through a special command or
-# a local file) or remotely (usually after the guest is remotely attested).
-# The provision setting is a complete URL that lets the Kata agent decide
-# which method to use in order to fetch the keys.
-#
-# Keys can be stored in a local file, in a measured and attested initrd:
-#provision=data:///local/key/file
-#
-# Keys could be fetched through a special command or binary from the
-# initrd (guest) image, e.g. a firmware call:
-#provision=file:///path/to/bin/fetcher/in/guest
-#
-# Keys can be remotely provisioned. The Kata agent fetches them from e.g.
-# a HTTPS URL:
-#provision=https://my-key-broker.foo/tenant/<tenant-id>

src/runtime/config/configuration-qemu.toml.in

@@ -168,8 +168,6 @@ virtio_fs_cache_size = @DEFVIRTIOFSCACHESIZE@
 #
 # Format example:
 #   ["-o", "arg1=xxx,arg2", "-o", "hello world", "--arg3=yyy"]
-# Examples:
-#   Set virtiofsd log level to debug : ["-o", "log_level=debug"] or ["-d"]
 #
 # see `virtiofsd -h` for possible options.
 virtio_fs_extra_args = @DEFVIRTIOFSEXTRAARGS@

src/runtime/pkg/containerd-shim-v2/create_test.go

@@ -376,7 +376,9 @@ func createAllRuntimeConfigFiles(dir, hypervisor string) (config string, err err
 func TestCreateLoadRuntimeConfig(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	config, err := createAllRuntimeConfigFiles(tmpdir, "qemu")
 	assert.NoError(err)

src/runtime/pkg/containerd-shim-v2/shim_management.go

@@ -32,6 +32,8 @@ import (
 )
 
 const (
+	DirectVolumePathKey = "path"
+
 	DirectVolumeStatUrl   = "/direct-volume/stats"
 	DirectVolumeResizeUrl = "/direct-volume/resize"
 )
@@ -139,7 +141,16 @@ func decodeAgentMetrics(body string) []*dto.MetricFamily {
 }
 
 func (s *service) serveVolumeStats(w http.ResponseWriter, r *http.Request) {
-	volumePath, err := url.PathUnescape(strings.TrimPrefix(r.URL.Path, DirectVolumeStatUrl))
+	val := r.URL.Query().Get(DirectVolumePathKey)
+	if val == "" {
+		msg := fmt.Sprintf("Required parameter %s not found", DirectVolumePathKey)
+		shimMgtLog.Info(msg)
+		w.WriteHeader(http.StatusBadRequest)
+		w.Write([]byte(msg))
+		return
+	}
+
+	volumePath, err := url.PathUnescape(val)
 	if err != nil {
 		shimMgtLog.WithError(err).Error("failed to unescape the volume stat url path")
 		w.WriteHeader(http.StatusInternalServerError)

src/runtime/pkg/containerd-shim-v2/stream_test.go

@@ -26,7 +26,9 @@ func TestNewTtyIOFifoReopen(t *testing.T) {
 	assert := assert.New(t)
 	ctx := context.TODO()
 
-	testDir := t.TempDir()
+	testDir, err := os.MkdirTemp("", "kata-")
+	assert.NoError(err)
+	defer os.RemoveAll(testDir)
 
 	fifoPath, err := os.MkdirTemp(testDir, "fifo-path-")
 	assert.NoError(err)
@@ -102,7 +104,9 @@ func TestIoCopy(t *testing.T) {
 	testBytes2 := []byte("Test2")
 	testBytes3 := []byte("Test3")
 
-	testDir := t.TempDir()
+	testDir, err := os.MkdirTemp("", "kata-")
+	assert.NoError(err)
+	defer os.RemoveAll(testDir)
 
 	fifoPath, err := os.MkdirTemp(testDir, "fifo-path-")
 	assert.NoError(err)

src/runtime/pkg/containerd-shim-v2/wait.go

@@ -53,6 +53,11 @@ func wait(ctx context.Context, s *service, c *container, execID string) (int32,
 			"container": c.id,
 			"pid":       processID,
 		}).Error("Wait for process failed")
+
+		// set return code if wait failed
+		if ret == 0 {
+			ret = exitCode255
+		}
 	}
 
 	timeStamp := time.Now()
@@ -78,7 +83,7 @@ func wait(ctx context.Context, s *service, c *container, execID string) (int32,
 				shimLog.WithField("sandbox", s.sandbox.ID()).Error("failed to delete sandbox")
 			}
 		} else {
-			if _, err = s.sandbox.StopContainer(ctx, c.id, false); err != nil {
+			if _, err = s.sandbox.StopContainer(ctx, c.id, true); err != nil {
 				shimLog.WithError(err).WithField("container", c.id).Warn("stop container failed")
 			}
 		}

src/runtime/pkg/direct-volume/utils_test.go

@@ -19,7 +19,9 @@ import (
 
 func TestAdd(t *testing.T) {
 	var err error
-	kataDirectVolumeRootPath = t.TempDir()
+	kataDirectVolumeRootPath, err = os.MkdirTemp(os.TempDir(), "add-test")
+	assert.Nil(t, err)
+	defer os.RemoveAll(kataDirectVolumeRootPath)
 	var volumePath = "/a/b/c"
 	actual := MountInfo{
 		VolumeType: "block",
@@ -58,7 +60,9 @@ func TestAdd(t *testing.T) {
 
 func TestRecordSandboxId(t *testing.T) {
 	var err error
-	kataDirectVolumeRootPath = t.TempDir()
+	kataDirectVolumeRootPath, err = os.MkdirTemp(os.TempDir(), "recordSanboxId-test")
+	assert.Nil(t, err)
+	defer os.RemoveAll(kataDirectVolumeRootPath)
 
 	var volumePath = "/a/b/c"
 	mntInfo := MountInfo{
@@ -84,7 +88,9 @@ func TestRecordSandboxId(t *testing.T) {
 
 func TestRecordSandboxIdNoMountInfoFile(t *testing.T) {
 	var err error
-	kataDirectVolumeRootPath = t.TempDir()
+	kataDirectVolumeRootPath, err = os.MkdirTemp(os.TempDir(), "recordSanboxId-test")
+	assert.Nil(t, err)
+	defer os.RemoveAll(kataDirectVolumeRootPath)
 
 	var volumePath = "/a/b/c"
 	sandboxId := uuid.Generate().String()

src/runtime/pkg/katatestutils/constraints_test.go

@@ -271,12 +271,14 @@ func TestGetFileContents(t *testing.T) {
 		{"foo\nbar"},
 	}
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(dir)
 
 	file := filepath.Join(dir, "foo")
 
 	// file doesn't exist
-	_, err := getFileContents(file)
+	_, err = getFileContents(file)
 	assert.Error(err)
 
 	for _, d := range data {

src/runtime/pkg/katautils/config.go

@@ -74,78 +74,70 @@ type factory struct {
 }
 
 type hypervisor struct {
-	Path                           string   `toml:"path"`
-	JailerPath                     string   `toml:"jailer_path"`
-	Kernel                         string   `toml:"kernel"`
-	CtlPath                        string   `toml:"ctlpath"`
-	Initrd                         string   `toml:"initrd"`
-	Image                          string   `toml:"image"`
-	Firmware                       string   `toml:"firmware"`
-	FirmwareVolume                 string   `toml:"firmware_volume"`
-	MachineAccelerators            string   `toml:"machine_accelerators"`
-	CPUFeatures                    string   `toml:"cpu_features"`
-	KernelParams                   string   `toml:"kernel_params"`
-	MachineType                    string   `toml:"machine_type"`
-	BlockDeviceDriver              string   `toml:"block_device_driver"`
-	EntropySource                  string   `toml:"entropy_source"`
-	SharedFS                       string   `toml:"shared_fs"`
-	VirtioFSDaemon                 string   `toml:"virtio_fs_daemon"`
-	VirtioFSCache                  string   `toml:"virtio_fs_cache"`
-	VhostUserStorePath             string   `toml:"vhost_user_store_path"`
-	FileBackedMemRootDir           string   `toml:"file_mem_backend"`
-	GuestHookPath                  string   `toml:"guest_hook_path"`
-	GuestMemoryDumpPath            string   `toml:"guest_memory_dump_path"`
-	HypervisorPathList             []string `toml:"valid_hypervisor_paths"`
-	JailerPathList                 []string `toml:"valid_jailer_paths"`
-	CtlPathList                    []string `toml:"valid_ctlpaths"`
-	VirtioFSDaemonList             []string `toml:"valid_virtio_fs_daemon_paths"`
-	VirtioFSExtraArgs              []string `toml:"virtio_fs_extra_args"`
-	PFlashList                     []string `toml:"pflashes"`
-	VhostUserStorePathList         []string `toml:"valid_vhost_user_store_paths"`
-	FileBackedMemRootList          []string `toml:"valid_file_mem_backends"`
-	EntropySourceList              []string `toml:"valid_entropy_sources"`
-	EnableAnnotations              []string `toml:"enable_annotations"`
-	RxRateLimiterMaxRate           uint64   `toml:"rx_rate_limiter_max_rate"`
-	TxRateLimiterMaxRate           uint64   `toml:"tx_rate_limiter_max_rate"`
-	MemOffset                      uint64   `toml:"memory_offset"`
-	DiskRateLimiterBwMaxRate       int64    `toml:"disk_rate_limiter_bw_max_rate"`
-	DiskRateLimiterBwOneTimeBurst  int64    `toml:"disk_rate_limiter_bw_one_time_burst"`
-	DiskRateLimiterOpsMaxRate      int64    `toml:"disk_rate_limiter_ops_max_rate"`
-	DiskRateLimiterOpsOneTimeBurst int64    `toml:"disk_rate_limiter_ops_one_time_burst"`
-	NetRateLimiterBwMaxRate        int64    `toml:"net_rate_limiter_bw_max_rate"`
-	NetRateLimiterBwOneTimeBurst   int64    `toml:"net_rate_limiter_bw_one_time_burst"`
-	NetRateLimiterOpsMaxRate       int64    `toml:"net_rate_limiter_ops_max_rate"`
-	NetRateLimiterOpsOneTimeBurst  int64    `toml:"net_rate_limiter_ops_one_time_burst"`
-	VirtioFSCacheSize              uint32   `toml:"virtio_fs_cache_size"`
-	DefaultMaxVCPUs                uint32   `toml:"default_maxvcpus"`
-	MemorySize                     uint32   `toml:"default_memory"`
-	MemSlots                       uint32   `toml:"memory_slots"`
-	DefaultBridges                 uint32   `toml:"default_bridges"`
-	Msize9p                        uint32   `toml:"msize_9p"`
-	PCIeRootPort                   uint32   `toml:"pcie_root_port"`
-	NumVCPUs                       int32    `toml:"default_vcpus"`
-	BlockDeviceCacheSet            bool     `toml:"block_device_cache_set"`
-	BlockDeviceCacheDirect         bool     `toml:"block_device_cache_direct"`
-	BlockDeviceCacheNoflush        bool     `toml:"block_device_cache_noflush"`
-	EnableVhostUserStore           bool     `toml:"enable_vhost_user_store"`
-	DisableBlockDeviceUse          bool     `toml:"disable_block_device_use"`
-	MemPrealloc                    bool     `toml:"enable_mem_prealloc"`
-	HugePages                      bool     `toml:"enable_hugepages"`
-	VirtioMem                      bool     `toml:"enable_virtio_mem"`
-	IOMMU                          bool     `toml:"enable_iommu"`
-	IOMMUPlatform                  bool     `toml:"enable_iommu_platform"`
-	Debug                          bool     `toml:"enable_debug"`
-	DisableNestingChecks           bool     `toml:"disable_nesting_checks"`
-	EnableIOThreads                bool     `toml:"enable_iothreads"`
-	DisableImageNvdimm             bool     `toml:"disable_image_nvdimm"`
-	HotplugVFIOOnRootBus           bool     `toml:"hotplug_vfio_on_root_bus"`
-	DisableVhostNet                bool     `toml:"disable_vhost_net"`
-	GuestMemoryDumpPaging          bool     `toml:"guest_memory_dump_paging"`
-	ConfidentialGuest              bool     `toml:"confidential_guest"`
-	GuestSwap                      bool     `toml:"enable_guest_swap"`
-	Rootless                       bool     `toml:"rootless"`
-	DisableSeccomp                 bool     `toml:"disable_seccomp"`
-	DisableSeLinux                 bool     `toml:"disable_selinux"`
+	Path                    string   `toml:"path"`
+	JailerPath              string   `toml:"jailer_path"`
+	Kernel                  string   `toml:"kernel"`
+	CtlPath                 string   `toml:"ctlpath"`
+	Initrd                  string   `toml:"initrd"`
+	Image                   string   `toml:"image"`
+	Firmware                string   `toml:"firmware"`
+	FirmwareVolume          string   `toml:"firmware_volume"`
+	MachineAccelerators     string   `toml:"machine_accelerators"`
+	CPUFeatures             string   `toml:"cpu_features"`
+	KernelParams            string   `toml:"kernel_params"`
+	MachineType             string   `toml:"machine_type"`
+	BlockDeviceDriver       string   `toml:"block_device_driver"`
+	EntropySource           string   `toml:"entropy_source"`
+	SharedFS                string   `toml:"shared_fs"`
+	VirtioFSDaemon          string   `toml:"virtio_fs_daemon"`
+	VirtioFSCache           string   `toml:"virtio_fs_cache"`
+	VhostUserStorePath      string   `toml:"vhost_user_store_path"`
+	FileBackedMemRootDir    string   `toml:"file_mem_backend"`
+	GuestHookPath           string   `toml:"guest_hook_path"`
+	GuestMemoryDumpPath     string   `toml:"guest_memory_dump_path"`
+	HypervisorPathList      []string `toml:"valid_hypervisor_paths"`
+	JailerPathList          []string `toml:"valid_jailer_paths"`
+	CtlPathList             []string `toml:"valid_ctlpaths"`
+	VirtioFSDaemonList      []string `toml:"valid_virtio_fs_daemon_paths"`
+	VirtioFSExtraArgs       []string `toml:"virtio_fs_extra_args"`
+	PFlashList              []string `toml:"pflashes"`
+	VhostUserStorePathList  []string `toml:"valid_vhost_user_store_paths"`
+	FileBackedMemRootList   []string `toml:"valid_file_mem_backends"`
+	EntropySourceList       []string `toml:"valid_entropy_sources"`
+	EnableAnnotations       []string `toml:"enable_annotations"`
+	RxRateLimiterMaxRate    uint64   `toml:"rx_rate_limiter_max_rate"`
+	TxRateLimiterMaxRate    uint64   `toml:"tx_rate_limiter_max_rate"`
+	MemOffset               uint64   `toml:"memory_offset"`
+	VirtioFSCacheSize       uint32   `toml:"virtio_fs_cache_size"`
+	DefaultMaxVCPUs         uint32   `toml:"default_maxvcpus"`
+	MemorySize              uint32   `toml:"default_memory"`
+	MemSlots                uint32   `toml:"memory_slots"`
+	DefaultBridges          uint32   `toml:"default_bridges"`
+	Msize9p                 uint32   `toml:"msize_9p"`
+	PCIeRootPort            uint32   `toml:"pcie_root_port"`
+	NumVCPUs                int32    `toml:"default_vcpus"`
+	BlockDeviceCacheSet     bool     `toml:"block_device_cache_set"`
+	BlockDeviceCacheDirect  bool     `toml:"block_device_cache_direct"`
+	BlockDeviceCacheNoflush bool     `toml:"block_device_cache_noflush"`
+	EnableVhostUserStore    bool     `toml:"enable_vhost_user_store"`
+	DisableBlockDeviceUse   bool     `toml:"disable_block_device_use"`
+	MemPrealloc             bool     `toml:"enable_mem_prealloc"`
+	HugePages               bool     `toml:"enable_hugepages"`
+	VirtioMem               bool     `toml:"enable_virtio_mem"`
+	IOMMU                   bool     `toml:"enable_iommu"`
+	IOMMUPlatform           bool     `toml:"enable_iommu_platform"`
+	Debug                   bool     `toml:"enable_debug"`
+	DisableNestingChecks    bool     `toml:"disable_nesting_checks"`
+	EnableIOThreads         bool     `toml:"enable_iothreads"`
+	DisableImageNvdimm      bool     `toml:"disable_image_nvdimm"`
+	HotplugVFIOOnRootBus    bool     `toml:"hotplug_vfio_on_root_bus"`
+	DisableVhostNet         bool     `toml:"disable_vhost_net"`
+	GuestMemoryDumpPaging   bool     `toml:"guest_memory_dump_paging"`
+	ConfidentialGuest       bool     `toml:"confidential_guest"`
+	GuestSwap               bool     `toml:"enable_guest_swap"`
+	Rootless                bool     `toml:"rootless"`
+	DisableSeccomp          bool     `toml:"disable_seccomp"`
+	DisableSeLinux          bool     `toml:"disable_selinux"`
 }
 
 type runtime struct {
@@ -477,47 +469,17 @@ func (h hypervisor) getInitrdAndImage() (initrd string, image string, err error)
 
 	image, errImage := h.image()
 
-	if h.ConfidentialGuest && h.MachineType == vc.QemuCCWVirtio {
-		if image != "" || initrd != "" {
-			return "", "", errors.New("Neither the image nor initrd path may be set for Secure Execution")
-		}
-	} else if image != "" && initrd != "" {
+	if image != "" && initrd != "" {
 		return "", "", errors.New("having both an image and an initrd defined in the configuration file is not supported")
-	} else if errInitrd != nil && errImage != nil {
+	}
+
+	if errInitrd != nil && errImage != nil {
 		return "", "", fmt.Errorf("Either initrd or image must be set to a valid path (initrd: %v) (image: %v)", errInitrd, errImage)
 	}
 
 	return
 }
 
-func (h hypervisor) getDiskRateLimiterBwMaxRate() int64 {
-	return h.DiskRateLimiterBwMaxRate
-}
-
-func (h hypervisor) getDiskRateLimiterBwOneTimeBurst() int64 {
-	if h.DiskRateLimiterBwOneTimeBurst != 0 && h.getDiskRateLimiterBwMaxRate() == 0 {
-		kataUtilsLogger.Warn("The DiskRateLimiterBwOneTimeBurst is set but DiskRateLimiterBwMaxRate is not set, this option will be ignored.")
-
-		h.DiskRateLimiterBwOneTimeBurst = 0
-	}
-
-	return h.DiskRateLimiterBwOneTimeBurst
-}
-
-func (h hypervisor) getDiskRateLimiterOpsMaxRate() int64 {
-	return h.DiskRateLimiterOpsMaxRate
-}
-
-func (h hypervisor) getDiskRateLimiterOpsOneTimeBurst() int64 {
-	if h.DiskRateLimiterOpsOneTimeBurst != 0 && h.getDiskRateLimiterOpsMaxRate() == 0 {
-		kataUtilsLogger.Warn("The DiskRateLimiterOpsOneTimeBurst is set but DiskRateLimiterOpsMaxRate is not set, this option will be ignored.")
-
-		h.DiskRateLimiterOpsOneTimeBurst = 0
-	}
-
-	return h.DiskRateLimiterOpsOneTimeBurst
-}
-
 func (h hypervisor) getRxRateLimiterCfg() uint64 {
 	return h.RxRateLimiterMaxRate
 }
@@ -526,34 +488,6 @@ func (h hypervisor) getTxRateLimiterCfg() uint64 {
 	return h.TxRateLimiterMaxRate
 }
 
-func (h hypervisor) getNetRateLimiterBwMaxRate() int64 {
-	return h.NetRateLimiterBwMaxRate
-}
-
-func (h hypervisor) getNetRateLimiterBwOneTimeBurst() int64 {
-	if h.NetRateLimiterBwOneTimeBurst != 0 && h.getNetRateLimiterBwMaxRate() == 0 {
-		kataUtilsLogger.Warn("The NetRateLimiterBwOneTimeBurst is set but NetRateLimiterBwMaxRate is not set, this option will be ignored.")
-
-		h.NetRateLimiterBwOneTimeBurst = 0
-	}
-
-	return h.NetRateLimiterBwOneTimeBurst
-}
-
-func (h hypervisor) getNetRateLimiterOpsMaxRate() int64 {
-	return h.NetRateLimiterOpsMaxRate
-}
-
-func (h hypervisor) getNetRateLimiterOpsOneTimeBurst() int64 {
-	if h.NetRateLimiterOpsOneTimeBurst != 0 && h.getNetRateLimiterOpsMaxRate() == 0 {
-		kataUtilsLogger.Warn("The NetRateLimiterOpsOneTimeBurst is set but NetRateLimiterOpsMaxRate is not set, this option will be ignored.")
-
-		h.NetRateLimiterOpsOneTimeBurst = 0
-	}
-
-	return h.NetRateLimiterOpsOneTimeBurst
-}
-
 func (h hypervisor) getIOMMUPlatform() bool {
 	if h.IOMMUPlatform {
 		kataUtilsLogger.Info("IOMMUPlatform is enabled by default.")
@@ -671,6 +605,16 @@ func newQemuHypervisorConfig(h hypervisor) (vc.HypervisorConfig, error) {
 		return vc.HypervisorConfig{}, err
 	}
 
+	if image != "" && initrd != "" {
+		return vc.HypervisorConfig{},
+			errors.New("having both an image and an initrd defined in the configuration file is not supported")
+	}
+
+	if image == "" && initrd == "" {
+		return vc.HypervisorConfig{},
+			errors.New("either image or initrd must be defined in the configuration file")
+	}
+
 	firmware, err := h.firmware()
 	if err != nil {
 		return vc.HypervisorConfig{}, err
@@ -892,60 +836,52 @@ func newClhHypervisorConfig(h hypervisor) (vc.HypervisorConfig, error) {
 	}
 
 	return vc.HypervisorConfig{
-		HypervisorPath:                 hypervisor,
-		HypervisorPathList:             h.HypervisorPathList,
-		KernelPath:                     kernel,
-		InitrdPath:                     initrd,
-		ImagePath:                      image,
-		FirmwarePath:                   firmware,
-		MachineAccelerators:            machineAccelerators,
-		KernelParams:                   vc.DeserializeParams(strings.Fields(kernelParams)),
-		HypervisorMachineType:          machineType,
-		NumVCPUs:                       h.defaultVCPUs(),
-		DefaultMaxVCPUs:                h.defaultMaxVCPUs(),
-		MemorySize:                     h.defaultMemSz(),
-		MemSlots:                       h.defaultMemSlots(),
-		MemOffset:                      h.defaultMemOffset(),
-		VirtioMem:                      h.VirtioMem,
-		EntropySource:                  h.GetEntropySource(),
-		EntropySourceList:              h.EntropySourceList,
-		DefaultBridges:                 h.defaultBridges(),
-		DisableBlockDeviceUse:          h.DisableBlockDeviceUse,
-		SharedFS:                       sharedFS,
-		VirtioFSDaemon:                 h.VirtioFSDaemon,
-		VirtioFSDaemonList:             h.VirtioFSDaemonList,
-		VirtioFSCacheSize:              h.VirtioFSCacheSize,
-		VirtioFSCache:                  h.VirtioFSCache,
-		MemPrealloc:                    h.MemPrealloc,
-		HugePages:                      h.HugePages,
-		FileBackedMemRootDir:           h.FileBackedMemRootDir,
-		FileBackedMemRootList:          h.FileBackedMemRootList,
-		Debug:                          h.Debug,
-		DisableNestingChecks:           h.DisableNestingChecks,
-		BlockDeviceDriver:              blockDriver,
-		BlockDeviceCacheSet:            h.BlockDeviceCacheSet,
-		BlockDeviceCacheDirect:         h.BlockDeviceCacheDirect,
-		BlockDeviceCacheNoflush:        h.BlockDeviceCacheNoflush,
-		EnableIOThreads:                h.EnableIOThreads,
-		Msize9p:                        h.msize9p(),
-		HotplugVFIOOnRootBus:           h.HotplugVFIOOnRootBus,
-		PCIeRootPort:                   h.PCIeRootPort,
-		DisableVhostNet:                true,
-		GuestHookPath:                  h.guestHookPath(),
-		VirtioFSExtraArgs:              h.VirtioFSExtraArgs,
-		SGXEPCSize:                     defaultSGXEPCSize,
-		EnableAnnotations:              h.EnableAnnotations,
-		DisableSeccomp:                 h.DisableSeccomp,
-		ConfidentialGuest:              h.ConfidentialGuest,
-		DisableSeLinux:                 h.DisableSeLinux,
-		NetRateLimiterBwMaxRate:        h.getNetRateLimiterBwMaxRate(),
-		NetRateLimiterBwOneTimeBurst:   h.getNetRateLimiterBwOneTimeBurst(),
-		NetRateLimiterOpsMaxRate:       h.getNetRateLimiterOpsMaxRate(),
-		NetRateLimiterOpsOneTimeBurst:  h.getNetRateLimiterOpsOneTimeBurst(),
-		DiskRateLimiterBwMaxRate:       h.getDiskRateLimiterBwMaxRate(),
-		DiskRateLimiterBwOneTimeBurst:  h.getDiskRateLimiterBwOneTimeBurst(),
-		DiskRateLimiterOpsMaxRate:      h.getDiskRateLimiterOpsMaxRate(),
-		DiskRateLimiterOpsOneTimeBurst: h.getDiskRateLimiterOpsOneTimeBurst(),
+		HypervisorPath:          hypervisor,
+		HypervisorPathList:      h.HypervisorPathList,
+		KernelPath:              kernel,
+		InitrdPath:              initrd,
+		ImagePath:               image,
+		FirmwarePath:            firmware,
+		MachineAccelerators:     machineAccelerators,
+		KernelParams:            vc.DeserializeParams(strings.Fields(kernelParams)),
+		HypervisorMachineType:   machineType,
+		NumVCPUs:                h.defaultVCPUs(),
+		DefaultMaxVCPUs:         h.defaultMaxVCPUs(),
+		MemorySize:              h.defaultMemSz(),
+		MemSlots:                h.defaultMemSlots(),
+		MemOffset:               h.defaultMemOffset(),
+		VirtioMem:               h.VirtioMem,
+		EntropySource:           h.GetEntropySource(),
+		EntropySourceList:       h.EntropySourceList,
+		DefaultBridges:          h.defaultBridges(),
+		DisableBlockDeviceUse:   h.DisableBlockDeviceUse,
+		SharedFS:                sharedFS,
+		VirtioFSDaemon:          h.VirtioFSDaemon,
+		VirtioFSDaemonList:      h.VirtioFSDaemonList,
+		VirtioFSCacheSize:       h.VirtioFSCacheSize,
+		VirtioFSCache:           h.VirtioFSCache,
+		MemPrealloc:             h.MemPrealloc,
+		HugePages:               h.HugePages,
+		FileBackedMemRootDir:    h.FileBackedMemRootDir,
+		FileBackedMemRootList:   h.FileBackedMemRootList,
+		Debug:                   h.Debug,
+		DisableNestingChecks:    h.DisableNestingChecks,
+		BlockDeviceDriver:       blockDriver,
+		BlockDeviceCacheSet:     h.BlockDeviceCacheSet,
+		BlockDeviceCacheDirect:  h.BlockDeviceCacheDirect,
+		BlockDeviceCacheNoflush: h.BlockDeviceCacheNoflush,
+		EnableIOThreads:         h.EnableIOThreads,
+		Msize9p:                 h.msize9p(),
+		HotplugVFIOOnRootBus:    h.HotplugVFIOOnRootBus,
+		PCIeRootPort:            h.PCIeRootPort,
+		DisableVhostNet:         true,
+		GuestHookPath:           h.guestHookPath(),
+		VirtioFSExtraArgs:       h.VirtioFSExtraArgs,
+		SGXEPCSize:              defaultSGXEPCSize,
+		EnableAnnotations:       h.EnableAnnotations,
+		DisableSeccomp:          h.DisableSeccomp,
+		ConfidentialGuest:       h.ConfidentialGuest,
+		DisableSeLinux:          h.DisableSeLinux,
 	}, nil
 }
 

src/runtime/pkg/katautils/config_test.go

@@ -279,13 +279,17 @@ func testLoadConfiguration(t *testing.T, dir string,
 }
 
 func TestConfigLoadConfiguration(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "load-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir, nil)
 }
 
 func TestConfigLoadConfigurationFailBrokenSymLink(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "runtime-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir,
 		func(config testRuntimeConfig, configFile string, ignoreLogging bool) (bool, error) {
@@ -293,7 +297,7 @@ func TestConfigLoadConfigurationFailBrokenSymLink(t *testing.T) {
 
 			if configFile == config.ConfigPathLink {
 				// break the symbolic link
-				err := os.Remove(config.ConfigPathLink)
+				err = os.Remove(config.ConfigPathLink)
 				if err != nil {
 					return expectFail, err
 				}
@@ -306,7 +310,9 @@ func TestConfigLoadConfigurationFailBrokenSymLink(t *testing.T) {
 }
 
 func TestConfigLoadConfigurationFailSymLinkLoop(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "runtime-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir,
 		func(config testRuntimeConfig, configFile string, ignoreLogging bool) (bool, error) {
@@ -314,13 +320,13 @@ func TestConfigLoadConfigurationFailSymLinkLoop(t *testing.T) {
 
 			if configFile == config.ConfigPathLink {
 				// remove the config file
-				err := os.Remove(config.ConfigPath)
+				err = os.Remove(config.ConfigPath)
 				if err != nil {
 					return expectFail, err
 				}
 
 				// now, create a sym-link loop
-				err = os.Symlink(config.ConfigPathLink, config.ConfigPath)
+				err := os.Symlink(config.ConfigPathLink, config.ConfigPath)
 				if err != nil {
 					return expectFail, err
 				}
@@ -333,13 +339,15 @@ func TestConfigLoadConfigurationFailSymLinkLoop(t *testing.T) {
 }
 
 func TestConfigLoadConfigurationFailMissingHypervisor(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "runtime-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir,
 		func(config testRuntimeConfig, configFile string, ignoreLogging bool) (bool, error) {
 			expectFail := true
 
-			err := os.Remove(config.RuntimeConfig.HypervisorConfig.HypervisorPath)
+			err = os.Remove(config.RuntimeConfig.HypervisorConfig.HypervisorPath)
 			if err != nil {
 				return expectFail, err
 			}
@@ -349,13 +357,15 @@ func TestConfigLoadConfigurationFailMissingHypervisor(t *testing.T) {
 }
 
 func TestConfigLoadConfigurationFailMissingImage(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "runtime-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir,
 		func(config testRuntimeConfig, configFile string, ignoreLogging bool) (bool, error) {
 			expectFail := true
 
-			err := os.Remove(config.RuntimeConfig.HypervisorConfig.ImagePath)
+			err = os.Remove(config.RuntimeConfig.HypervisorConfig.ImagePath)
 			if err != nil {
 				return expectFail, err
 			}
@@ -365,13 +375,15 @@ func TestConfigLoadConfigurationFailMissingImage(t *testing.T) {
 }
 
 func TestConfigLoadConfigurationFailMissingKernel(t *testing.T) {
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "runtime-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir,
 		func(config testRuntimeConfig, configFile string, ignoreLogging bool) (bool, error) {
 			expectFail := true
 
-			err := os.Remove(config.RuntimeConfig.HypervisorConfig.KernelPath)
+			err = os.Remove(config.RuntimeConfig.HypervisorConfig.KernelPath)
 			if err != nil {
 				return expectFail, err
 			}
@@ -385,14 +397,16 @@ func TestConfigLoadConfigurationFailUnreadableConfig(t *testing.T) {
 		t.Skip(ktu.TestDisabledNeedNonRoot)
 	}
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "runtime-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir,
 		func(config testRuntimeConfig, configFile string, ignoreLogging bool) (bool, error) {
 			expectFail := true
 
 			// make file unreadable by non-root user
-			err := os.Chmod(config.ConfigPath, 0000)
+			err = os.Chmod(config.ConfigPath, 0000)
 			if err != nil {
 				return expectFail, err
 			}
@@ -406,7 +420,9 @@ func TestConfigLoadConfigurationFailTOMLConfigFileInvalidContents(t *testing.T)
 		t.Skip(ktu.TestDisabledNeedNonRoot)
 	}
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "runtime-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir,
 		func(config testRuntimeConfig, configFile string, ignoreLogging bool) (bool, error) {
@@ -430,7 +446,9 @@ func TestConfigLoadConfigurationFailTOMLConfigFileDuplicatedData(t *testing.T) {
 		t.Skip(ktu.TestDisabledNeedNonRoot)
 	}
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "runtime-config-")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
 
 	testLoadConfiguration(t, tmpdir,
 		func(config testRuntimeConfig, configFile string, ignoreLogging bool) (bool, error) {
@@ -453,7 +471,11 @@ func TestConfigLoadConfigurationFailTOMLConfigFileDuplicatedData(t *testing.T) {
 }
 
 func TestMinimalRuntimeConfig(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp(testDir, "minimal-runtime-config-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	hypervisorPath := path.Join(dir, "hypervisor")
 	defaultHypervisorPath = hypervisorPath
@@ -488,7 +510,7 @@ func TestMinimalRuntimeConfig(t *testing.T) {
 	defaultKernelPath = kernelPath
 
 	for _, file := range []string{defaultImagePath, defaultInitrdPath, defaultHypervisorPath, defaultJailerPath, defaultKernelPath} {
-		err := WriteFile(file, "foo", testFileMode)
+		err = WriteFile(file, "foo", testFileMode)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -509,7 +531,7 @@ func TestMinimalRuntimeConfig(t *testing.T) {
 	utils.VHostVSockDevicePath = "/dev/null"
 
 	configPath := path.Join(dir, "runtime.toml")
-	err := createConfig(configPath, runtimeMinimalConfig)
+	err = createConfig(configPath, runtimeMinimalConfig)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -578,7 +600,11 @@ func TestMinimalRuntimeConfig(t *testing.T) {
 }
 
 func TestNewQemuHypervisorConfig(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp(testDir, "hypervisor-config-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	hypervisorPath := path.Join(dir, "hypervisor")
 	kernelPath := path.Join(dir, "kernel")
@@ -673,7 +699,11 @@ func TestNewQemuHypervisorConfig(t *testing.T) {
 }
 
 func TestNewFirecrackerHypervisorConfig(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp(testDir, "hypervisor-config-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	hypervisorPath := path.Join(dir, "hypervisor")
 	kernelPath := path.Join(dir, "kernel")
@@ -764,7 +794,9 @@ func TestNewFirecrackerHypervisorConfig(t *testing.T) {
 func TestNewQemuHypervisorConfigImageAndInitrd(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	imagePath := filepath.Join(tmpdir, "image")
 	initrdPath := filepath.Join(tmpdir, "initrd")
@@ -772,7 +804,7 @@ func TestNewQemuHypervisorConfigImageAndInitrd(t *testing.T) {
 	kernelPath := path.Join(tmpdir, "kernel")
 
 	for _, file := range []string{imagePath, initrdPath, hypervisorPath, kernelPath} {
-		err := createEmptyFile(file)
+		err = createEmptyFile(file)
 		assert.NoError(err)
 	}
 
@@ -794,7 +826,7 @@ func TestNewQemuHypervisorConfigImageAndInitrd(t *testing.T) {
 		PCIeRootPort:          pcieRootPort,
 	}
 
-	_, err := newQemuHypervisorConfig(hypervisor)
+	_, err = newQemuHypervisorConfig(hypervisor)
 
 	// specifying both an image+initrd is invalid
 	assert.Error(err)
@@ -804,40 +836,26 @@ func TestNewClhHypervisorConfig(t *testing.T) {
 
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	hypervisorPath := path.Join(tmpdir, "hypervisor")
 	kernelPath := path.Join(tmpdir, "kernel")
 	imagePath := path.Join(tmpdir, "image")
 	virtioFsDaemon := path.Join(tmpdir, "virtiofsd")
-	netRateLimiterBwMaxRate := int64(1000)
-	netRateLimiterBwOneTimeBurst := int64(1000)
-	netRateLimiterOpsMaxRate := int64(0)
-	netRateLimiterOpsOneTimeBurst := int64(1000)
-	diskRateLimiterBwMaxRate := int64(1000)
-	diskRateLimiterBwOneTimeBurst := int64(1000)
-	diskRateLimiterOpsMaxRate := int64(0)
-	diskRateLimiterOpsOneTimeBurst := int64(1000)
 
 	for _, file := range []string{imagePath, hypervisorPath, kernelPath, virtioFsDaemon} {
-		err := createEmptyFile(file)
+		err = createEmptyFile(file)
 		assert.NoError(err)
 	}
 
 	hypervisor := hypervisor{
-		Path:                           hypervisorPath,
-		Kernel:                         kernelPath,
-		Image:                          imagePath,
-		VirtioFSDaemon:                 virtioFsDaemon,
-		VirtioFSCache:                  "always",
-		NetRateLimiterBwMaxRate:        netRateLimiterBwMaxRate,
-		NetRateLimiterBwOneTimeBurst:   netRateLimiterBwOneTimeBurst,
-		NetRateLimiterOpsMaxRate:       netRateLimiterOpsMaxRate,
-		NetRateLimiterOpsOneTimeBurst:  netRateLimiterOpsOneTimeBurst,
-		DiskRateLimiterBwMaxRate:       diskRateLimiterBwMaxRate,
-		DiskRateLimiterBwOneTimeBurst:  diskRateLimiterBwOneTimeBurst,
-		DiskRateLimiterOpsMaxRate:      diskRateLimiterOpsMaxRate,
-		DiskRateLimiterOpsOneTimeBurst: diskRateLimiterOpsOneTimeBurst,
+		Path:           hypervisorPath,
+		Kernel:         kernelPath,
+		Image:          imagePath,
+		VirtioFSDaemon: virtioFsDaemon,
+		VirtioFSCache:  "always",
 	}
 	config, err := newClhHypervisorConfig(hypervisor)
 	if err != nil {
@@ -868,39 +886,6 @@ func TestNewClhHypervisorConfig(t *testing.T) {
 		t.Errorf("Expected VirtioFSCache %v, got %v", true, config.VirtioFSCache)
 	}
 
-	if config.NetRateLimiterBwMaxRate != netRateLimiterBwMaxRate {
-		t.Errorf("Expected value for network bandwidth rate limiter %v, got %v", netRateLimiterBwMaxRate, config.NetRateLimiterBwMaxRate)
-	}
-
-	if config.NetRateLimiterBwOneTimeBurst != netRateLimiterBwOneTimeBurst {
-		t.Errorf("Expected value for network bandwidth one time burst %v, got %v", netRateLimiterBwOneTimeBurst, config.NetRateLimiterBwOneTimeBurst)
-	}
-
-	if config.NetRateLimiterOpsMaxRate != netRateLimiterOpsMaxRate {
-		t.Errorf("Expected value for network operations rate limiter %v, got %v", netRateLimiterOpsMaxRate, config.NetRateLimiterOpsMaxRate)
-	}
-
-	// We expect 0 (zero) here as netRateLimiterOpsMaxRate is not set (set to zero).
-	if config.NetRateLimiterOpsOneTimeBurst != 0 {
-		t.Errorf("Expected value for network operations one time burst %v, got %v", netRateLimiterOpsOneTimeBurst, config.NetRateLimiterOpsOneTimeBurst)
-	}
-
-	if config.DiskRateLimiterBwMaxRate != diskRateLimiterBwMaxRate {
-		t.Errorf("Expected value for disk bandwidth rate limiter %v, got %v", diskRateLimiterBwMaxRate, config.DiskRateLimiterBwMaxRate)
-	}
-
-	if config.DiskRateLimiterBwOneTimeBurst != diskRateLimiterBwOneTimeBurst {
-		t.Errorf("Expected value for disk bandwidth one time burst %v, got %v", diskRateLimiterBwOneTimeBurst, config.DiskRateLimiterBwOneTimeBurst)
-	}
-
-	if config.DiskRateLimiterOpsMaxRate != diskRateLimiterOpsMaxRate {
-		t.Errorf("Expected value for disk operations rate limiter %v, got %v", diskRateLimiterOpsMaxRate, config.DiskRateLimiterOpsMaxRate)
-	}
-
-	// We expect 0 (zero) here as diskRateLimiterOpsMaxRate is not set (set to zero).
-	if config.DiskRateLimiterOpsOneTimeBurst != 0 {
-		t.Errorf("Expected value for disk operations one time burst %v, got %v", diskRateLimiterOpsOneTimeBurst, config.DiskRateLimiterOpsOneTimeBurst)
-	}
 }
 
 func TestHypervisorDefaults(t *testing.T) {
@@ -946,12 +931,14 @@ func TestHypervisorDefaults(t *testing.T) {
 func TestHypervisorDefaultsHypervisor(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	testHypervisorPath := filepath.Join(tmpdir, "hypervisor")
 	testHypervisorLinkPath := filepath.Join(tmpdir, "hypervisor-link")
 
-	err := createEmptyFile(testHypervisorPath)
+	err = createEmptyFile(testHypervisorPath)
 	assert.NoError(err)
 
 	err = syscall.Symlink(testHypervisorPath, testHypervisorLinkPath)
@@ -980,12 +967,14 @@ func TestHypervisorDefaultsHypervisor(t *testing.T) {
 func TestHypervisorDefaultsKernel(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	testKernelPath := filepath.Join(tmpdir, "kernel")
 	testKernelLinkPath := filepath.Join(tmpdir, "kernel-link")
 
-	err := createEmptyFile(testKernelPath)
+	err = createEmptyFile(testKernelPath)
 	assert.NoError(err)
 
 	err = syscall.Symlink(testKernelPath, testKernelLinkPath)
@@ -1021,12 +1010,14 @@ func TestHypervisorDefaultsKernel(t *testing.T) {
 func TestHypervisorDefaultsInitrd(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	testInitrdPath := filepath.Join(tmpdir, "initrd")
 	testInitrdLinkPath := filepath.Join(tmpdir, "initrd-link")
 
-	err := createEmptyFile(testInitrdPath)
+	err = createEmptyFile(testInitrdPath)
 	assert.NoError(err)
 
 	err = syscall.Symlink(testInitrdPath, testInitrdLinkPath)
@@ -1056,12 +1047,14 @@ func TestHypervisorDefaultsInitrd(t *testing.T) {
 func TestHypervisorDefaultsImage(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	testImagePath := filepath.Join(tmpdir, "image")
 	testImageLinkPath := filepath.Join(tmpdir, "image-link")
 
-	err := createEmptyFile(testImagePath)
+	err = createEmptyFile(testImagePath)
 	assert.NoError(err)
 
 	err = syscall.Symlink(testImagePath, testImageLinkPath)
@@ -1149,14 +1142,16 @@ func TestGetDefaultConfigFilePaths(t *testing.T) {
 func TestGetDefaultConfigFile(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp(testDir, "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	hypervisor := "qemu"
 	confDir := filepath.Join(tmpdir, "conf")
 	sysConfDir := filepath.Join(tmpdir, "sysconf")
 
 	for _, dir := range []string{confDir, sysConfDir} {
-		err := os.MkdirAll(dir, testDirMode)
+		err = os.MkdirAll(dir, testDirMode)
 		assert.NoError(err)
 	}
 
@@ -1454,7 +1449,11 @@ func TestUpdateRuntimeConfigurationInvalidKernelParams(t *testing.T) {
 func TestCheckHypervisorConfig(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp(testDir, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	// Not created on purpose
 	imageENOENT := filepath.Join(dir, "image-ENOENT.img")
@@ -1464,7 +1463,7 @@ func TestCheckHypervisorConfig(t *testing.T) {
 	initrdEmpty := filepath.Join(dir, "initrd-empty.img")
 
 	for _, file := range []string{imageEmpty, initrdEmpty} {
-		err := createEmptyFile(file)
+		err = createEmptyFile(file)
 		assert.NoError(err)
 	}
 
@@ -1479,7 +1478,7 @@ func TestCheckHypervisorConfig(t *testing.T) {
 	fileData := strings.Repeat("X", int(fileSizeBytes))
 
 	for _, file := range []string{image, initrd} {
-		err := WriteFile(file, fileData, testFileMode)
+		err = WriteFile(file, fileData, testFileMode)
 		assert.NoError(err)
 	}
 
@@ -1613,15 +1612,19 @@ func TestCheckFactoryConfig(t *testing.T) {
 func TestValidateBindMounts(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir1 := t.TempDir()
+	tmpdir1, err := os.MkdirTemp(testDir, "tmp1-")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir1)
 
-	tmpdir2 := t.TempDir()
+	tmpdir2, err := os.MkdirTemp(testDir, "tmp2-")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir2)
 
 	duplicate1 := filepath.Join(tmpdir1, "cat.txt")
 	duplicate2 := filepath.Join(tmpdir2, "cat.txt")
 	unique := filepath.Join(tmpdir1, "foobar.txt")
 
-	err := os.WriteFile(duplicate1, []byte("kibble-monster"), 0644)
+	err = os.WriteFile(duplicate1, []byte("kibble-monster"), 0644)
 	assert.NoError(err)
 
 	err = os.WriteFile(duplicate2, []byte("furbag"), 0644)

src/runtime/pkg/katautils/create_test.go

@@ -124,10 +124,14 @@ func TestSetEphemeralStorageType(t *testing.T) {
 
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp(testDir, "foo")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	ephePath := filepath.Join(dir, vc.K8sEmptyDir, "tmp-volume")
-	err := os.MkdirAll(ephePath, testDirMode)
+	err = os.MkdirAll(ephePath, testDirMode)
 	assert.Nil(err)
 
 	err = syscall.Mount("tmpfs", ephePath, "tmpfs", 0, "")
@@ -301,13 +305,17 @@ func TestCreateSandboxAnnotations(t *testing.T) {
 func TestCheckForFips(t *testing.T) {
 	assert := assert.New(t)
 
+	path, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(path)
+
 	val := procFIPS
-	procFIPS = filepath.Join(t.TempDir(), "fips-enabled")
+	procFIPS = filepath.Join(path, "fips-enabled")
 	defer func() {
 		procFIPS = val
 	}()
 
-	err := os.WriteFile(procFIPS, []byte("1"), 0644)
+	err = os.WriteFile(procFIPS, []byte("1"), 0644)
 	assert.NoError(err)
 
 	hconfig := vc.HypervisorConfig{

src/runtime/pkg/katautils/hook_test.go

@@ -20,7 +20,7 @@ import (
 var testKeyHook = "test-key"
 var testContainerIDHook = "test-container-id"
 var testControllerIDHook = "test-controller-id"
-var testBinHookPath = "mockhook/hook"
+var testBinHookPath = "../../virtcontainers/hook/mock/hook"
 var testBundlePath = "/test/bundle"
 var mockHookLogFile = "/tmp/mock_hook.log"
 

src/runtime/pkg/katautils/mockhook/.gitignore

@@ -1 +0,0 @@
-hook

src/runtime/pkg/katautils/mockhook/Makefile

@@ -1,21 +0,0 @@
-# Copyright Red Hat.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-BIN = hook
-SRC = hook.go
-
-V              = @
-Q              = $(V:1=)
-QUIET_BUILD    = $(Q:@=@echo    '     BUILD    '$@;)
-
-BUILDFLAGS     =
-
-all: $(BIN)
-
-$(BIN): $(SRC)
-	$(QUIET_BUILD)go build $(BUILDFLAGS) -o $@ $^
-
-clean:
-	rm -f $(BIN)

src/runtime/pkg/katautils/network_test.go

@@ -23,13 +23,15 @@ import (
 func TestGetNetNsFromBindMount(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	mountFile := filepath.Join(tmpdir, "mountInfo")
 	nsPath := filepath.Join(tmpdir, "ns123")
 
 	// Non-existent namespace path
-	_, err := getNetNsFromBindMount(nsPath, mountFile)
+	_, err = getNetNsFromBindMount(nsPath, mountFile)
 	assert.NotNil(err)
 
 	tmpNSPath := filepath.Join(tmpdir, "testNetNs")
@@ -83,7 +85,9 @@ func TestHostNetworkingRequested(t *testing.T) {
 	assert.Error(err)
 
 	// Bind-mounted Netns
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	// Create a bind mount to the current network namespace.
 	tmpFile := filepath.Join(tmpdir, "testNetNs")

src/runtime/pkg/katautils/utils_test.go

@@ -26,6 +26,10 @@ const (
 	testContainerID = "1"
 )
 
+var (
+	testDir = ""
+)
+
 func createFile(file, contents string) error {
 	return os.WriteFile(file, []byte(contents), testFileMode)
 }
@@ -40,13 +44,17 @@ func TestUtilsResolvePathEmptyPath(t *testing.T) {
 }
 
 func TestUtilsResolvePathValidPath(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	target := path.Join(dir, "target")
 	linkDir := path.Join(dir, "a/b/c")
 	linkFile := path.Join(linkDir, "link")
 
-	err := createEmptyFile(target)
+	err = createEmptyFile(target)
 	assert.NoError(t, err)
 
 	absolute, err := filepath.Abs(target)
@@ -68,13 +76,16 @@ func TestUtilsResolvePathValidPath(t *testing.T) {
 }
 
 func TestUtilsResolvePathENOENT(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	target := path.Join(dir, "target")
 	linkDir := path.Join(dir, "a/b/c")
 	linkFile := path.Join(linkDir, "link")
 
-	err := createEmptyFile(target)
+	err = createEmptyFile(target)
 	assert.NoError(t, err)
 
 	err = os.MkdirAll(linkDir, testDirMode)
@@ -100,12 +111,16 @@ func TestUtilsResolvePathENOENT(t *testing.T) {
 func TestFileSize(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp(testDir, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	file := filepath.Join(dir, "foo")
 
 	// ENOENT
-	_, err := fileSize(file)
+	_, err = fileSize(file)
 	assert.Error(err)
 
 	err = createEmptyFile(file)
@@ -137,10 +152,12 @@ func TestWriteFileErrWriteFail(t *testing.T) {
 func TestWriteFileErrNoPath(t *testing.T) {
 	assert := assert.New(t)
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp(testDir, "")
+	assert.NoError(err)
+	defer os.RemoveAll(dir)
 
 	// attempt to write a file over an existing directory
-	err := WriteFile(dir, "", 0000)
+	err = WriteFile(dir, "", 0000)
 	assert.Error(err)
 }
 
@@ -160,12 +177,16 @@ func TestGetFileContents(t *testing.T) {
 		{"processor   : 0\nvendor_id   : GenuineIntel\n"},
 	}
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp(testDir, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
 
 	file := filepath.Join(dir, "foo")
 
 	// file doesn't exist
-	_, err := GetFileContents(file)
+	_, err = GetFileContents(file)
 	assert.Error(t, err)
 
 	for _, d := range data {

src/runtime/pkg/oci/utils_test.go

@@ -410,10 +410,12 @@ func TestGetShmSizeBindMounted(t *testing.T) {
 		t.Skip("Test disabled as requires root privileges")
 	}
 
-	dir := t.TempDir()
+	dir, err := os.MkdirTemp("", "")
+	assert.Nil(t, err)
+	defer os.RemoveAll(dir)
 
 	shmPath := filepath.Join(dir, "shm")
-	err := os.Mkdir(shmPath, 0700)
+	err = os.Mkdir(shmPath, 0700)
 	assert.Nil(t, err)
 
 	size := 8192
@@ -471,13 +473,15 @@ func TestMain(m *testing.M) {
 func TestAddAssetAnnotations(t *testing.T) {
 	assert := assert.New(t)
 
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	// Create a pretend asset file
 	// (required since the existence of binary asset annotations is verified).
 	fakeAssetFile := filepath.Join(tmpdir, "fake-binary")
 
-	err := os.WriteFile(fakeAssetFile, []byte(""), fileMode)
+	err = os.WriteFile(fakeAssetFile, []byte(""), fileMode)
 	assert.NoError(err)
 
 	expectedAnnotations := map[string]string{

src/runtime/pkg/utils/utils_test.go

@@ -51,8 +51,11 @@ func TestGzipAccepted(t *testing.T) {
 
 func TestEnsureDir(t *testing.T) {
 	const testMode = 0755
+	tmpdir, err := os.MkdirTemp("", "TestEnsureDir")
 	assert := assert.New(t)
-	tmpdir := t.TempDir()
+
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	// nolint: govet
 	testCases := []struct {
@@ -117,7 +120,9 @@ func TestEnsureDir(t *testing.T) {
 
 func TestFirstValidExecutable(t *testing.T) {
 	assert := assert.New(t)
-	tmpdir := t.TempDir()
+	tmpdir, err := os.MkdirTemp("", "TestFirstValidPath")
+	assert.NoError(err)
+	defer os.RemoveAll(tmpdir)
 
 	// nolint: govet
 	testCases := []struct {

src/runtime/virtcontainers/Makefile

@@ -5,6 +5,11 @@
 #
 
 PREFIX := /usr
+BIN_DIR := $(PREFIX)/bin
+VC_BIN_DIR := $(BIN_DIR)/virtcontainers/bin
+TEST_BIN_DIR := $(VC_BIN_DIR)/test
+HOOK_DIR := hook/mock
+HOOK_BIN := hook
 MK_DIR := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
 GOBUILD_FLAGS := -mod=vendor
 
@@ -20,11 +25,16 @@ QUIET_GOBUILD = $(Q:@=@echo    '     GOBUILD  '$@;)
 # Build
 #
 
-all: build
+all: build binaries
 
 build:
 	$(QUIET_GOBUILD)go build $(GOBUILD_FLAGS) $(go list ./... | grep -v /vendor/)
 
+hook:
+	$(QUIET_GOBUILD)go build $(GOBUILD_FLAGS) -o $(HOOK_DIR)/$@ $(HOOK_DIR)/*.go
+
+binaries: hook
+
 #
 # Tests
 #
@@ -35,7 +45,40 @@ check-go-static:
 	bash $(MK_DIR)/../../../ci/static-checks.sh
 
 check-go-test:
-	bash $(MK_DIR)/../../../ci/go-test.sh
+	bash $(MK_DIR)/../../../ci/go-test.sh \
+		$(TEST_BIN_DIR)/$(HOOK_BIN)
+
+#
+# Install
+#
+
+define INSTALL_EXEC
+	install -D $1 $(VC_BIN_DIR)/ || exit 1;
+endef
+
+define INSTALL_TEST_EXEC
+	install -D $1 $(TEST_BIN_DIR)/ || exit 1;
+endef
+
+install:
+	@mkdir -p $(VC_BIN_DIR)
+	@mkdir -p $(TEST_BIN_DIR)
+	$(call INSTALL_TEST_EXEC,$(HOOK_DIR)/$(HOOK_BIN))
+
+#
+# Uninstall
+#
+
+define UNINSTALL_EXEC
+	rm -f $(call FILE_SAFE_TO_REMOVE,$(VC_BIN_DIR)/$1) || exit 1;
+endef
+
+define UNINSTALL_TEST_EXEC
+	rm -f $(call FILE_SAFE_TO_REMOVE,$(TEST_BIN_DIR)/$1) || exit 1;
+endef
+
+uninstall:
+	$(call UNINSTALL_TEST_EXEC,$(HOOK_BIN))
 
 #
 # Clean
@@ -47,7 +90,7 @@ define FILE_SAFE_TO_REMOVE =
 $(shell test -e "$(1)" && test "$(1)" != "/" && echo "$(1)")
 endef
 
-CLEAN_FILES +=
+CLEAN_FILES += $(HOOK_DIR)/$(HOOK_BIN)
 
 clean:
 	rm -f $(foreach f,$(CLEAN_FILES),$(call FILE_SAFE_TO_REMOVE,$(f)))
@@ -55,7 +98,11 @@ clean:
 .PHONY: \
 	all \
 	build \
+	hook \
+	binaries \
 	check \
 	check-go-static \
 	check-go-test \
+	install \
+	uninstall \
 	clean

src/runtime/virtcontainers/clh.go

@@ -235,6 +235,7 @@ func (clh *cloudHypervisor) createVirtiofsDaemon(sharedPath string) (VirtiofsDae
 		sourcePath: sharedPath,
 		socketPath: virtiofsdSocketPath,
 		extraArgs:  clh.config.VirtioFSExtraArgs,
+		debug:      clh.config.Debug,
 		cache:      clh.config.VirtioFSCache,
 	}, nil
 }
@@ -302,6 +303,7 @@ func (clh *cloudHypervisor) loadVirtiofsDaemon(sharedPath string) (VirtiofsDaemo
 	return &virtiofsd{
 		PID:        clh.state.VirtiofsDaemonPid,
 		sourcePath: sharedPath,
+		debug:      clh.config.Debug,
 		socketPath: virtiofsdSocketPath,
 	}, nil
 }
@@ -444,11 +446,6 @@ func (clh *cloudHypervisor) CreateVM(ctx context.Context, id string, network Net
 			disk := chclient.NewDiskConfig(imagePath)
 			disk.SetReadonly(true)
 
-			diskRateLimiterConfig := clh.getDiskRateLimiterConfig()
-			if diskRateLimiterConfig != nil {
-				disk.SetRateLimiterConfig(*diskRateLimiterConfig)
-			}
-
 			if clh.vmconfig.Disks != nil {
 				*clh.vmconfig.Disks = append(*clh.vmconfig.Disks, *disk)
 			} else {
@@ -673,11 +670,6 @@ func (clh *cloudHypervisor) hotplugAddBlockDevice(drive *config.BlockDrive) erro
 	clhDisk.Readonly = &drive.ReadOnly
 	clhDisk.VhostUser = func(b bool) *bool { return &b }(false)
 
-	diskRateLimiterConfig := clh.getDiskRateLimiterConfig()
-	if diskRateLimiterConfig != nil {
-		clhDisk.SetRateLimiterConfig(*diskRateLimiterConfig)
-	}
-
 	pciInfo, _, err := cl.VmAddDiskPut(ctx, clhDisk)
 
 	if err != nil {
@@ -1318,52 +1310,6 @@ func (clh *cloudHypervisor) addVSock(cid int64, path string) {
 	clh.vmconfig.Vsock = chclient.NewVsockConfig(cid, path)
 }
 
-func (clh *cloudHypervisor) getRateLimiterConfig(bwSize, bwOneTimeBurst, opsSize, opsOneTimeBurst int64) *chclient.RateLimiterConfig {
-	if bwSize == 0 && opsSize == 0 {
-		return nil
-	}
-
-	rateLimiterConfig := chclient.NewRateLimiterConfig()
-
-	if bwSize != 0 {
-		bwTokenBucket := chclient.NewTokenBucket(bwSize, int64(utils.DefaultRateLimiterRefillTimeMilliSecs))
-
-		if bwOneTimeBurst != 0 {
-			bwTokenBucket.SetOneTimeBurst(bwOneTimeBurst)
-		}
-
-		rateLimiterConfig.SetBandwidth(*bwTokenBucket)
-	}
-
-	if opsSize != 0 {
-		opsTokenBucket := chclient.NewTokenBucket(opsSize, int64(utils.DefaultRateLimiterRefillTimeMilliSecs))
-
-		if opsOneTimeBurst != 0 {
-			opsTokenBucket.SetOneTimeBurst(opsOneTimeBurst)
-		}
-
-		rateLimiterConfig.SetOps(*opsTokenBucket)
-	}
-
-	return rateLimiterConfig
-}
-
-func (clh *cloudHypervisor) getNetRateLimiterConfig() *chclient.RateLimiterConfig {
-	return clh.getRateLimiterConfig(
-		int64(utils.RevertBytes(uint64(clh.config.NetRateLimiterBwMaxRate/8))),
-		int64(utils.RevertBytes(uint64(clh.config.NetRateLimiterBwOneTimeBurst/8))),
-		clh.config.NetRateLimiterOpsMaxRate,
-		clh.config.NetRateLimiterOpsOneTimeBurst)
-}
-
-func (clh *cloudHypervisor) getDiskRateLimiterConfig() *chclient.RateLimiterConfig {
-	return clh.getRateLimiterConfig(
-		int64(utils.RevertBytes(uint64(clh.config.DiskRateLimiterBwMaxRate/8))),
-		int64(utils.RevertBytes(uint64(clh.config.DiskRateLimiterBwOneTimeBurst/8))),
-		clh.config.DiskRateLimiterOpsMaxRate,
-		clh.config.DiskRateLimiterOpsOneTimeBurst)
-}
-
 func (clh *cloudHypervisor) addNet(e Endpoint) error {
 	clh.Logger().WithField("endpoint-type", e).Debugf("Adding Endpoint of type %v", e)
 
@@ -1383,15 +1329,9 @@ func (clh *cloudHypervisor) addNet(e Endpoint) error {
 		"tap": tapPath,
 	}).Info("Adding Net")
 
-	netRateLimiterConfig := clh.getNetRateLimiterConfig()
-
 	net := chclient.NewNetConfig()
 	net.Mac = &mac
 	net.Tap = &tapPath
-	if netRateLimiterConfig != nil {
-		net.SetRateLimiterConfig(*netRateLimiterConfig)
-	}
-
 	if clh.vmconfig.Net != nil {
 		*clh.vmconfig.Net = append(*clh.vmconfig.Net, *net)
 	} else {
@@ -1501,5 +1441,5 @@ func (clh *cloudHypervisor) vmInfo() (chclient.VmInfo, error) {
 }
 
 func (clh *cloudHypervisor) IsRateLimiterBuiltin() bool {
-	return true
+	return false
 }

src/runtime/virtcontainers/clh_test.go

@@ -52,21 +52,17 @@ func newClhConfig() (HypervisorConfig, error) {
 	}
 
 	return HypervisorConfig{
-		KernelPath:                    testClhKernelPath,
-		ImagePath:                     testClhImagePath,
-		HypervisorPath:                testClhPath,
-		NumVCPUs:                      defaultVCPUs,
-		BlockDeviceDriver:             config.VirtioBlock,
-		MemorySize:                    defaultMemSzMiB,
-		DefaultBridges:                defaultBridges,
-		DefaultMaxVCPUs:               uint32(64),
-		SharedFS:                      config.VirtioFS,
-		VirtioFSCache:                 virtioFsCacheAlways,
-		VirtioFSDaemon:                testVirtiofsdPath,
-		NetRateLimiterBwMaxRate:       int64(0),
-		NetRateLimiterBwOneTimeBurst:  int64(0),
-		NetRateLimiterOpsMaxRate:      int64(0),
-		NetRateLimiterOpsOneTimeBurst: int64(0),
+		KernelPath:        testClhKernelPath,
+		ImagePath:         testClhImagePath,
+		HypervisorPath:    testClhPath,
+		NumVCPUs:          defaultVCPUs,
+		BlockDeviceDriver: config.VirtioBlock,
+		MemorySize:        defaultMemSzMiB,
+		DefaultBridges:    defaultBridges,
+		DefaultMaxVCPUs:   uint32(64),
+		SharedFS:          config.VirtioFS,
+		VirtioFSCache:     virtioFsCacheAlways,
+		VirtioFSDaemon:    testVirtiofsdPath,
 	}, nil
 }
 
@@ -195,181 +191,6 @@ func TestCloudHypervisorAddNetCheckEnpointTypes(t *testing.T) {
 	}
 }
 
-// Check AddNet properly sets up the network rate limiter
-func TestCloudHypervisorNetRateLimiter(t *testing.T) {
-	assert := assert.New(t)
-
-	tapPath := "/path/to/tap"
-
-	validVeth := &VethEndpoint{}
-	validVeth.NetPair.TapInterface.TAPIface.Name = tapPath
-
-	type args struct {
-		bwMaxRate       int64
-		bwOneTimeBurst  int64
-		opsMaxRate      int64
-		opsOneTimeBurst int64
-	}
-
-	//nolint: govet
-	tests := []struct {
-		name                  string
-		args                  args
-		expectsRateLimiter    bool
-		expectsBwBucketToken  bool
-		expectsOpsBucketToken bool
-	}{
-		// Bandwidth
-		{
-			"Bandwidth | max rate with one time burst",
-			args{
-				bwMaxRate:      int64(1000),
-				bwOneTimeBurst: int64(10000),
-			},
-			true,  // expectsRateLimiter
-			true,  // expectsBwBucketToken
-			false, // expectsOpsBucketToken
-		},
-		{
-			"Bandwidth | max rate without one time burst",
-			args{
-				bwMaxRate: int64(1000),
-			},
-			true,  // expectsRateLimiter
-			true,  // expectsBwBucketToken
-			false, // expectsOpsBucketToken
-		},
-		{
-			"Bandwidth | no max rate with one time burst",
-			args{
-				bwOneTimeBurst: int64(10000),
-			},
-			false, // expectsRateLimiter
-			false, // expectsBwBucketToken
-			false, // expectsOpsBucketToken
-		},
-		{
-			"Bandwidth | no max rate and no one time burst",
-			args{},
-			false, // expectsRateLimiter
-			false, // expectsBwBucketToken
-			false, // expectsOpsBucketToken
-		},
-
-		// Operations
-		{
-			"Operations | max rate with one time burst",
-			args{
-				opsMaxRate:      int64(1000),
-				opsOneTimeBurst: int64(10000),
-			},
-			true,  // expectsRateLimiter
-			false, // expectsBwBucketToken
-			true,  // expectsOpsBucketToken
-		},
-		{
-			"Operations | max rate without one time burst",
-			args{
-				opsMaxRate: int64(1000),
-			},
-			true,  // expectsRateLimiter
-			false, // expectsBwBucketToken
-			true,  // expectsOpsBucketToken
-		},
-		{
-			"Operations | no max rate with one time burst",
-			args{
-				opsOneTimeBurst: int64(10000),
-			},
-			false, // expectsRateLimiter
-			false, // expectsBwBucketToken
-			false, // expectsOpsBucketToken
-		},
-		{
-			"Operations | no max rate and no one time burst",
-			args{},
-			false, // expectsRateLimiter
-			false, // expectsBwBucketToken
-			false, // expectsOpsBucketToken
-		},
-
-		// Bandwidth and Operations
-		{
-			"Bandwidth and Operations | max rate with one time burst",
-			args{
-				bwMaxRate:       int64(1000),
-				bwOneTimeBurst:  int64(10000),
-				opsMaxRate:      int64(1000),
-				opsOneTimeBurst: int64(10000),
-			},
-			true, // expectsRateLimiter
-			true, // expectsBwBucketToken
-			true, // expectsOpsBucketToken
-		},
-		{
-			"Bandwidth and Operations | max rate without one time burst",
-			args{
-				bwMaxRate:  int64(1000),
-				opsMaxRate: int64(1000),
-			},
-			true, // expectsRateLimiter
-			true, // expectsBwBucketToken
-			true, // expectsOpsBucketToken
-		},
-		{
-			"Bandwidth and Operations | no max rate with one time burst",
-			args{
-				bwOneTimeBurst:  int64(10000),
-				opsOneTimeBurst: int64(10000),
-			},
-			false, // expectsRateLimiter
-			false, // expectsBwBucketToken
-			false, // expectsOpsBucketToken
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			clhConfig, err := newClhConfig()
-			assert.NoError(err)
-
-			clhConfig.NetRateLimiterBwMaxRate = tt.args.bwMaxRate
-			clhConfig.NetRateLimiterBwOneTimeBurst = tt.args.bwOneTimeBurst
-			clhConfig.NetRateLimiterOpsMaxRate = tt.args.opsMaxRate
-			clhConfig.NetRateLimiterOpsOneTimeBurst = tt.args.opsOneTimeBurst
-
-			clh := &cloudHypervisor{}
-			clh.config = clhConfig
-			clh.APIClient = &clhClientMock{}
-
-			if err := clh.addNet(validVeth); err != nil {
-				t.Errorf("cloudHypervisor.addNet() error = %v", err)
-			} else {
-				netConfig := (*clh.vmconfig.Net)[0]
-
-				assert.Equal(netConfig.HasRateLimiterConfig(), tt.expectsRateLimiter)
-				if tt.expectsRateLimiter {
-					rateLimiterConfig := netConfig.GetRateLimiterConfig()
-					assert.Equal(rateLimiterConfig.HasBandwidth(), tt.expectsBwBucketToken)
-					assert.Equal(rateLimiterConfig.HasOps(), tt.expectsOpsBucketToken)
-
-					if tt.expectsBwBucketToken {
-						bwBucketToken := rateLimiterConfig.GetBandwidth()
-						assert.Equal(bwBucketToken.GetSize(), int64(utils.RevertBytes(uint64(tt.args.bwMaxRate/8))))
-						assert.Equal(bwBucketToken.GetOneTimeBurst(), int64(utils.RevertBytes(uint64(tt.args.bwOneTimeBurst/8))))
-					}
-
-					if tt.expectsOpsBucketToken {
-						opsBucketToken := rateLimiterConfig.GetOps()
-						assert.Equal(opsBucketToken.GetSize(), int64(tt.args.opsMaxRate))
-						assert.Equal(opsBucketToken.GetOneTimeBurst(), int64(tt.args.opsOneTimeBurst))
-					}
-				}
-			}
-		})
-	}
-}
-
 func TestCloudHypervisorBootVM(t *testing.T) {
 	clh := &cloudHypervisor{}
 	clh.APIClient = &clhClientMock{}

src/runtime/virtcontainers/container_test.go

@@ -86,7 +86,7 @@ func TestContainerRemoveDrive(t *testing.T) {
 	sandbox := &Sandbox{
 		ctx:        context.Background(),
 		id:         "sandbox",
-		devManager: manager.NewDeviceManager(config.VirtioSCSI, false, "", nil),
+		devManager: manager.NewDeviceManager(manager.VirtioSCSI, false, "", nil),
 		config:     &SandboxConfig{},
 	}
 
@@ -259,7 +259,8 @@ func testSetupFakeRootfs(t *testing.T) (testRawFile, loopDev, mntDir string, err
 		t.Skip(testDisabledAsNonRoot)
 	}
 
-	tmpDir := t.TempDir()
+	tmpDir, err := os.MkdirTemp("", "")
+	assert.NoError(err)
 
 	testRawFile = filepath.Join(tmpDir, "raw.img")
 	_, err = os.Stat(testRawFile)
@@ -319,7 +320,7 @@ func TestContainerAddDriveDir(t *testing.T) {
 	sandbox := &Sandbox{
 		ctx:        context.Background(),
 		id:         testSandboxID,
-		devManager: manager.NewDeviceManager(config.VirtioSCSI, false, "", nil),
+		devManager: manager.NewDeviceManager(manager.VirtioSCSI, false, "", nil),
 		hypervisor: &mockHypervisor{},
 		agent:      &mockAgent{},
 		config: &SandboxConfig{
@@ -569,9 +570,14 @@ func TestMountSharedDirMounts(t *testing.T) {
 
 	assert := assert.New(t)
 
+	testMountPath, err := os.MkdirTemp("", "sandbox-test")
+	assert.NoError(err)
+	defer os.RemoveAll(testMountPath)
+
 	// create a new shared directory for our test:
 	kataHostSharedDirSaved := kataHostSharedDir
-	testHostDir := t.TempDir()
+	testHostDir, err := os.MkdirTemp("", "kata-Cleanup")
+	assert.NoError(err)
 	kataHostSharedDir = func() string {
 		return testHostDir
 	}
@@ -605,18 +611,12 @@ func TestMountSharedDirMounts(t *testing.T) {
 	//
 	// Create the mounts that we'll test with
 	//
-	testMountPath := t.TempDir()
 	secretpath := filepath.Join(testMountPath, K8sSecret)
 	err = os.MkdirAll(secretpath, 0777)
 	assert.NoError(err)
 	secret := filepath.Join(secretpath, "super-secret-thing")
-	f, err := os.Create(secret)
+	_, err = os.Create(secret)
 	assert.NoError(err)
-	t.Cleanup(func() {
-		if err := f.Close(); err != nil {
-			t.Fatalf("failed to close file: %v", err)
-		}
-	})
 
 	mountDestination := "/fluffhead/token"
 	//
@@ -655,13 +655,6 @@ func TestMountSharedDirMounts(t *testing.T) {
 	assert.Equal(len(updatedMounts), 1)
 	assert.Equal(updatedMounts[mountDestination].Source, expectedStorageDest)
 	assert.Equal(updatedMounts[mountDestination].Destination, mountDestination)
-
-	// Perform cleanups
-	err = container.unmountHostMounts(k.ctx)
-	assert.NoError(err)
-
-	err = fsShare.Cleanup(k.ctx)
-	assert.NoError(err)
 }
 
 func TestGetContainerId(t *testing.T) {

src/runtime/virtcontainers/device/config/config.go

@@ -51,7 +51,7 @@ const (
 	// VirtioBlock means use virtio-blk for hotplugging drives
 	VirtioBlock = "virtio-blk"
 
-	// VirtioBlockCCW means use virtio-blk-ccw for hotplugging drives
+	// VirtioBlockCCW means use virtio-blk for hotplugging drives
 	VirtioBlockCCW = "virtio-blk-ccw"
 
 	// VirtioSCSI means use virtio-scsi for hotplugging drives
@@ -72,12 +72,6 @@ const (
 	VirtioFSNydus = "virtio-fs-nydus"
 )
 
-const (
-	// Define the string key for DriverOptions in DeviceInfo struct
-	FsTypeOpt      = "fstype"
-	BlockDriverOpt = "block-driver"
-)
-
 const (
 	// The OCI spec requires the major-minor number to be provided for a
 	// device. We have chosen the below major numbers to represent
@@ -103,7 +97,7 @@ var getSysDevPath = getSysDevPathImpl
 // DeviceInfo is an embedded type that contains device data common to all types of devices.
 type DeviceInfo struct {
 	// DriverOptions is specific options for each device driver
-	// for example, for BlockDevice, we can set DriverOptions["block-driver"]="virtio-blk"
+	// for example, for BlockDevice, we can set DriverOptions["blockDriver"]="virtio-blk"
 	DriverOptions map[string]string
 
 	// Hostpath is device path on host