relax bind mount regex

the source path can be cached from the first container now Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
allow cached bundle-id from pause container
2026-03-15 09:12:29 +00:00 · 2026-02-13 12:42:49 -06:00 · 2026-02-13 12:42:49 -06:00 · 2026-02-13 12:42:49 -06:00 · 2026-02-13 12:42:49 -06:00 · 2026-02-13 12:42:49 -06:00
245 changed files with 3209 additions and 4960 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,8 +15,6 @@ updates:
      - "/src/tools/trace-forwarder"
    schedule:
      interval: "daily"
-    cooldown:
-      default-days: 7
    ignore:
    # rust-vmm repos might cause incompatibilities on patch versions, so
    # lets handle them manually for now.
@@ -87,12 +85,8 @@ updates:
      - "src/tools/csi-kata-directvolume"
    schedule:
      interval: "daily"
-    cooldown:
-      default-days: 7

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
-    cooldown:
-      default-days: 7
--- a/.github/workflows/build-checks.yaml
+++ b/.github/workflows/build-checks.yaml
@@ -94,19 +94,11 @@ jobs:
          ./ci/install_yq.sh
        env:
          INSTALL_IN_GOPATH: false
-      - name: Read properties from versions.yaml
+      - name: Install golang
        if: contains(matrix.component.needs, 'golang')
        run: |
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        if: contains(matrix.component.needs, 'golang')
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          # Setup-go doesn't work properly with ppc64le: https://github.com/actions/setup-go/issues/648
-          architecture: ${{ contains(inputs.instance, 'ppc64le') && 'ppc64le' || '' }}
+          ./tests/install_go.sh -f -p
+          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
      - name: Setup rust
        if: contains(matrix.component.needs, 'rust')
        run: |
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -297,21 +297,6 @@ jobs:
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}

-  run-k8s-tests-on-free-runner:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: publish-kata-deploy-payload-amd64
-    permissions:
-      contents: read
-    uses: ./.github/workflows/run-k8s-tests-on-free-runner.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
  run-k8s-tests-on-arm64:
    if: ${{ inputs.skip-test != 'yes' }}
    needs: publish-kata-deploy-payload-arm64
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -72,7 +72,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@4bdb89f48054571735e3792627da6195c57459e2 # v3.31.10
+      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
@@ -95,6 +95,6 @@ jobs:
        make -C src/runtime

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@4bdb89f48054571735e3792627da6195c57459e2 # v3.31.10
+      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -16,17 +16,17 @@ jobs:
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/configure-pages@v5
+      - uses: actions/checkout@v5
        with:
          persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@v5
        with:
          python-version: 3.x
      - run: pip install zensical
      - run: zensical build --clean
-      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+      - uses: actions/upload-pages-artifact@v4
        with:
          path: site
-      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+      - uses: actions/deploy-pages@v4
        id: deployment
--- a/.github/workflows/run-cri-containerd-tests.yaml
+++ b/.github/workflows/run-cri-containerd-tests.yaml
@@ -35,6 +35,8 @@ on:
 jobs:
  run-cri-containerd:
    name: run-cri-containerd-${{ inputs.arch }} (${{ inputs.containerd_version }}, ${{ inputs.vmm }})
+    strategy:
+      fail-fast: false
    runs-on: ${{ inputs.runner }}
    env:
      CONTAINERD_VERSION: ${{ inputs.containerd_version }}
--- a/.github/workflows/run-k8s-tests-on-aks.yaml
+++ b/.github/workflows/run-k8s-tests-on-aks.yaml
@@ -42,6 +42,17 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
+        host_os:
+          - ubuntu
+        vmm:
+          - clh
+          - dragonball
+          - qemu
+          - qemu-runtime-rs
+          - cloud-hypervisor
+        instance-type:
+          - small
+          - normal
        include:
          - host_os: cbl-mariner
            vmm: clh
@@ -69,7 +80,6 @@ jobs:
      KUBERNETES: "vanilla"
      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
      GENPOLICY_PULL_METHOD: ${{ matrix.genpolicy-pull-method }}
-      RUNS_ON_AKS: "true"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
--- a/.github/workflows/run-k8s-tests-on-free-runner.yaml
+++ b/.github/workflows/run-k8s-tests-on-free-runner.yaml
@@ -1,127 +0,0 @@
-# Run Kubernetes integration tests on free GitHub runners  with a locally
-# deployed cluster (kubeadm).
-name: CI | Run kubernetes tests on free runner
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-permissions: {}
-
-jobs:
-  run-k8s-tests:
-    name: run-k8s-tests
-    strategy:
-      fail-fast: false
-      matrix:
-        environment: [
-          { vmm: clh, containerd_version: lts },
-          { vmm: clh, containerd_version: active },
-          { vmm: dragonball, containerd_version: lts },
-          { vmm: dragonball, containerd_version: active },
-          { vmm: qemu, containerd_version: lts },
-          { vmm: qemu, containerd_version: active },
-          { vmm: qemu-runtime-rs, containerd_version: lts },
-          { vmm: qemu-runtime-rs, containerd_version: active },
-          { vmm: cloud-hypervisor, containerd_version: lts },
-          { vmm: cloud-hypervisor, containerd_version: active },
-        ]
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ubuntu
-      KATA_HYPERVISOR: ${{ matrix.environment.vmm }}
-      KUBERNETES: vanilla
-      K8S_TEST_HOST_TYPE: baremetal-no-attestation
-      CONTAINER_ENGINE: containerd
-      CONTAINER_ENGINE_VERSION: ${{ matrix.environment.containerd_version }}
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tools-tarball
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
-
-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
-
-      - name: Remove unnecessary directories to free up space
-        run: |
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/lib/jvm
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/share/powershell
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /opt/az
-          sudo rm -rf /usr/local/share/chromium
-          sudo rm -rf /opt/microsoft
-          sudo rm -rf /opt/google
-          sudo rm -rf /usr/lib/firefox
-
-      - name: Deploy k8s (kubeadm)
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Deploy Kata
-        timeout-minutes: 20
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
--- a/.github/workflows/run-kata-coco-tests.yaml
+++ b/.github/workflows/run-kata-coco-tests.yaml
@@ -140,36 +140,42 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        environment: [
-          { vmm: qemu-coco-dev, snapshotter: nydus, pull_type: guest-pull },
-          { vmm: qemu-coco-dev-runtime-rs, snapshotter: nydus, pull_type: guest-pull },
-          { vmm: qemu-coco-dev, snapshotter: "", pull_type: experimental-force-guest-pull },
-        ]
-    runs-on: ubuntu-24.04
+        vmm:
+          - qemu-coco-dev
+          - qemu-coco-dev-runtime-rs
+        snapshotter:
+          - nydus
+        pull-type:
+          - guest-pull
+        include:
+          - pull-type: experimental-force-guest-pull
+            vmm: qemu-coco-dev
+            snapshotter: ""
+    runs-on: ubuntu-22.04
    permissions:
-      contents: read
+      id-token: write # Used for OIDC access to log into Azure
    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
      DOCKER_TAG: ${{ inputs.tag }}
      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.environment.vmm }}
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
      # Some tests rely on that variable to run (or not)
      KBS: "true"
      # Set the KBS ingress handler (empty string disables handling)
-      KBS_INGRESS: "nodeport"
+      KBS_INGRESS: "aks"
      KUBERNETES: "vanilla"
-      PULL_TYPE: ${{ matrix.environment.pull_type }}
+      PULL_TYPE: ${{ matrix.pull-type }}
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      SNAPSHOTTER: ${{ matrix.environment.snapshotter }}
-      EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.environment.pull_type == 'experimental-force-guest-pull' && matrix.environment.vmm || '' }}
-      AUTO_GENERATE_POLICY: "yes"
+      SNAPSHOTTER: ${{ matrix.snapshotter }}
+      EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.pull-type == 'experimental-force-guest-pull' && matrix.vmm || '' }}
+      # Caution: current ingress controller used to expose the KBS service
+      # requires much vCPUs, lefting only a few for the tests. Depending on the
+      # host type chose it will result on the creation of a cluster with
+      # insufficient resources.
      K8S_TEST_HOST_TYPE: "all"
-      CONTAINER_ENGINE: "containerd"
-      CONTAINER_ENGINE_VERSION: "active"
-      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -192,36 +198,39 @@ jobs:
      - name: Install kata-tools
        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts

-      - name: Remove unnecessary directories to free up space
-        run: |
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/lib/jvm
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/share/powershell
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /opt/az
-          sudo rm -rf /usr/local/share/chromium
-          sudo rm -rf /opt/microsoft
-          sudo rm -rf /opt/google
-          sudo rm -rf /usr/lib/firefox
+      - name: Log into the Azure account
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
+        with:
+          client-id: ${{ secrets.AZ_APPID }}
+          tenant-id: ${{ secrets.AZ_TENANT_ID }}
+          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}

-      - name: Deploy kubernetes
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
+      - name: Create AKS cluster
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 15
+          max_attempts: 20
+          retry_on: error
+          retry_wait_seconds: 10
+          command: bash tests/integration/kubernetes/gha-run.sh create-cluster

      - name: Install `bats`
        run: bash tests/integration/kubernetes/gha-run.sh install-bats

+      - name: Install `kubectl`
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
+        with:
+          version: 'latest'
+
+      - name: Download credentials for the Kubernetes CLI to use them
+        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
+
      - name: Deploy Kata
        timeout-minutes: 20
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
+        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
        env:
-          USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ matrix.environment.snapshotter == 'nydus' }}
+          USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ env.SNAPSHOTTER == 'nydus' }}
+          AUTO_GENERATE_POLICY: ${{ env.PULL_TYPE == 'experimental-force-guest-pull' && 'no' || 'yes' }}

      - name: Deploy CoCo KBS
        timeout-minutes: 10
@@ -243,20 +252,18 @@ jobs:
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh report-tests

-      - name: Delete kata-deploy
+      - name: Refresh OIDC token in case access token expired
+        if: always()
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
+        with:
+          client-id: ${{ secrets.AZ_APPID }}
+          tenant-id: ${{ secrets.AZ_TENANT_ID }}
+          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+
+      - name: Delete AKS cluster
        if: always()
        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
-      - name: Delete CoCo KBS
-        if: always()
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
-
-      - name: Delete CSI driver
-        if: always()
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
+        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

  # Generate jobs for testing CoCo on non-TEE environments with erofs-snapshotter
  run-k8s-tests-coco-nontee-with-erofs-snapshotter:
@@ -284,7 +291,7 @@ jobs:
      KBS_INGRESS: ""
      KUBERNETES: "vanilla"
      CONTAINER_ENGINE: "containerd"
-      CONTAINER_ENGINE_VERSION: "active"
+      CONTAINER_ENGINE_VERSION: "v2.2"
      PULL_TYPE: ${{ matrix.pull-type }}
      SNAPSHOTTER: ${{ matrix.snapshotter }}
      USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: "true"
@@ -292,7 +299,6 @@ jobs:
      # We are skipping the auto generated policy tests for now,
      # but those should be enabled as soon as we work on that.
      AUTO_GENERATE_POLICY: "no"
-      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -336,6 +342,8 @@ jobs:
      - name: Deploy kubernetes
        timeout-minutes: 15
        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
+        env:
+          GH_TOKEN: ${{ github.token }}

      - name: Install `bats`
        run: bash tests/integration/kubernetes/gha-run.sh install-bats
@@ -355,13 +363,3 @@ jobs:
      - name: Report tests
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
-      - name: Delete CSI driver
-        if: always()
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -55,6 +55,6 @@ jobs:
      # Upload the results to GitHub's code scanning dashboard (optional).
      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4bdb89f48054571735e3792627da6195c57459e2 # v3.31.10
+        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -44,7 +44,9 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "async-trait",
+ "futures 0.1.31",
 "kata-types",
+ "log",
 "logging",
 "nix 0.26.4",
 "oci-spec 0.8.3",
@@ -139,12 +141,23 @@ version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
 dependencies = [
- "event-listener",
+ "event-listener 5.4.1",
 "event-listener-strategy",
 "futures-core",
 "pin-project-lite",
 ]

+[[package]]
+name = "async-channel"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
+dependencies = [
+ "concurrent-queue",
+ "event-listener 2.5.3",
+ "futures-core",
+]
+
 [[package]]
 name = "async-channel"
 version = "2.5.0"
@@ -171,6 +184,21 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "async-global-executor"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05b1b633a2115cd122d73b955eadd9916c18c8f510ec9cd1686404c60ad1c29c"
+dependencies = [
+ "async-channel 2.5.0",
+ "async-executor",
+ "async-io",
+ "async-lock",
+ "blocking",
+ "futures-lite",
+ "once_cell",
+]
+
 [[package]]
 name = "async-io"
 version = "2.6.0"
@@ -195,7 +223,7 @@ version = "3.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5fd03604047cee9b6ce9de9f70c6cd540a0520c813cbd49bae61f33ab80ed1dc"
 dependencies = [
- "event-listener",
+ "event-listener 5.4.1",
 "event-listener-strategy",
 "pin-project-lite",
 ]
@@ -206,14 +234,14 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
 dependencies = [
- "async-channel",
+ "async-channel 2.5.0",
 "async-io",
 "async-lock",
 "async-signal",
 "async-task",
 "blocking",
 "cfg-if 1.0.0",
- "event-listener",
+ "event-listener 5.4.1",
 "futures-lite",
 "rustix 1.1.2",
 ]
@@ -247,6 +275,32 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "async-std"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c8e079a4ab67ae52b7403632e4618815d6db36d2a010cfe41b02c1b1578f93b"
+dependencies = [
+ "async-channel 1.9.0",
+ "async-global-executor",
+ "async-io",
+ "async-lock",
+ "crossbeam-utils",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-lite",
+ "gloo-timers",
+ "kv-log-macro",
+ "log",
+ "memchr",
+ "once_cell",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+ "wasm-bindgen-futures",
+]
+
 [[package]]
 name = "async-task"
 version = "4.7.1"
@@ -393,7 +447,7 @@ version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
 dependencies = [
- "async-channel",
+ "async-channel 2.5.0",
 "async-task",
 "futures-io",
 "futures-lite",
@@ -590,17 +644,29 @@ dependencies = [
 "containerd-shim-protos",
 "kata-sys-util",
 "kata-types",
+ "lazy_static",
 "nix 0.26.4",
 "oci-spec 0.8.3",
+ "persist",
 "protobuf",
 "protocols",
 "resource",
 "runtime-spec",
+ "serde_json",
+ "slog",
+ "slog-scope",
 "strum 0.24.1",
 "thiserror 1.0.48",
 "tokio",
+ "ttrpc",
 ]

+[[package]]
+name = "common-path"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2382f75942f4b3be3690fe4f86365e9c853c1587d6ee58212cebf6e2a9ccd101"
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -645,7 +711,7 @@ dependencies = [
 "async-trait",
 "cgroups-rs 0.3.4",
 "containerd-shim-protos",
- "futures",
+ "futures 0.3.28",
 "go-flag",
 "lazy_static",
 "libc",
@@ -978,6 +1044,7 @@ dependencies = [
 "dbs-interrupt",
 "dbs-utils",
 "dbs-virtio-devices",
+ "downcast-rs",
 "kvm-bindings",
 "kvm-ioctls",
 "libc",
@@ -990,6 +1057,7 @@ dependencies = [
 "vfio-ioctls",
 "virtio-queue",
 "vm-memory",
+ "vmm-sys-util 0.11.1",
 ]

 [[package]]
@@ -1006,6 +1074,7 @@ dependencies = [
 name = "dbs-upcall"
 version = "0.3.0"
 dependencies = [
+ "anyhow",
 "dbs-utils",
 "dbs-virtio-devices",
 "log",
@@ -1200,6 +1269,12 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"

+[[package]]
+name = "downcast-rs"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"
+
 [[package]]
 name = "dragonball"
 version = "0.1.0"
@@ -1220,6 +1295,7 @@ dependencies = [
 "dbs-utils",
 "dbs-virtio-devices",
 "derivative",
+ "fuse-backend-rs",
 "kvm-bindings",
 "kvm-ioctls",
 "lazy_static",
@@ -1274,18 +1350,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"

-[[package]]
-name = "enum-as-inner"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.104",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -1339,6 +1403,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
 [[package]]
 name = "event-listener"
 version = "5.4.1"
@@ -1356,7 +1426,7 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
 dependencies = [
- "event-listener",
+ "event-listener 5.4.1",
 "pin-project-lite",
 ]

@@ -1484,6 +1554,12 @@ dependencies = [
 "vmm-sys-util 0.11.1",
 ]

+[[package]]
+name = "futures"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"
+
 [[package]]
 name = "futures"
 version = "0.3.28"
@@ -1643,6 +1719,18 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"

+[[package]]
+name = "gloo-timers"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "go-flag"
 version = "0.1.0"
@@ -1878,7 +1966,7 @@ dependencies = [
 "crossbeam-channel",
 "dbs-utils",
 "dragonball",
- "futures",
+ "futures 0.3.28",
 "go-flag",
 "hyper",
 "hyperlocal",
@@ -1889,8 +1977,10 @@ dependencies = [
 "libc",
 "logging",
 "nix 0.26.4",
+ "oci-spec 0.8.3",
 "path-clean",
 "persist",
+ "protobuf",
 "protocols",
 "qapi",
 "qapi-qmp",
@@ -1902,6 +1992,7 @@ dependencies = [
 "serde",
 "serde_json",
 "serial_test 2.0.0",
+ "shim-interface",
 "slog",
 "slog-scope",
 "tempfile",
@@ -2178,6 +2269,8 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "byteorder",
+ "chrono",
+ "common-path",
 "fail",
 "hex",
 "kata-types",
@@ -2186,9 +2279,11 @@ dependencies = [
 "mockall",
 "nix 0.26.4",
 "oci-spec 0.8.3",
+ "once_cell",
 "pci-ids",
 "rand 0.8.5",
 "runtime-spec",
+ "safe-path 0.1.0",
 "serde",
 "serde_json",
 "slog",
@@ -2207,8 +2302,8 @@ dependencies = [
 "byte-unit",
 "flate2",
 "glob",
+ "hex",
 "lazy_static",
- "nix 0.26.4",
 "num_cpus",
 "oci-spec 0.8.3",
 "regex",
@@ -2219,10 +2314,18 @@ dependencies = [
 "sha2 0.10.9",
 "slog",
 "slog-scope",
- "sysctl",
 "sysinfo",
 "thiserror 1.0.48",
- "toml",
+ "toml 0.5.11",
+]
+
+[[package]]
+name = "kv-log-macro"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de8b303297635ad57c9f5059fd9cee7a47f8e8daa09df0fcd07dd39fb22977f"
+dependencies = [
+ "log",
 ]

 [[package]]
@@ -2543,7 +2646,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b65d130ee111430e47eed7896ea43ca693c387f097dd97376bffafbf25812128"
 dependencies = [
 "bytes",
- "futures",
+ "futures 0.3.28",
 "log",
 "netlink-packet-core",
 "netlink-sys",
@@ -2557,7 +2660,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "416060d346fbaf1f23f9512963e3e878f1a78e707cb699ba9215761754244307"
 dependencies = [
 "bytes",
- "futures",
+ "futures 0.3.28",
 "libc",
 "log",
 "tokio",
@@ -2714,7 +2817,7 @@ dependencies = [
 "log",
 "serde",
 "serde_json",
- "toml",
+ "toml 0.5.11",
 ]

 [[package]]
@@ -2941,7 +3044,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e785d273968748578931e4dc3b4f5ec86b26e09d9e0d66b55adda7fce742f7a"
 dependencies = [
 "async-trait",
- "futures",
+ "futures 0.3.28",
 "futures-executor",
 "headers",
 "http",
@@ -3109,9 +3212,11 @@ dependencies = [
 "async-trait",
 "kata-sys-util",
 "kata-types",
+ "libc",
 "safe-path 0.1.0",
 "serde",
 "serde_json",
+ "shim-interface",
 ]

 [[package]]
@@ -3521,7 +3626,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b047adab56acc4948d4b9b58693c1f33fd13efef2d6bb5f0f66a47436ceada8"
 dependencies = [
 "bytes",
- "futures",
+ "futures 0.3.28",
 "log",
 "memchr",
 "qapi-qmp",
@@ -3803,10 +3908,11 @@ dependencies = [
 "agent",
 "anyhow",
 "async-trait",
+ "bitflags 2.10.0",
 "byte-unit",
 "cgroups-rs 0.5.0",
 "flate2",
- "futures",
+ "futures 0.3.28",
 "hex",
 "hypervisor",
 "inotify",
@@ -3816,6 +3922,7 @@ dependencies = [
 "libc",
 "logging",
 "netlink-packet-route",
+ "netlink-sys",
 "netns-rs",
 "nix 0.26.4",
 "oci-spec 0.8.3",
@@ -3838,9 +3945,9 @@ dependencies = [

 [[package]]
 name = "rkyv"
-version = "0.7.46"
+version = "0.7.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2297bf9c81a3f0dc96bc9521370b88f054168c29826a75e89c55ff196e7ed6a1"
+checksum = "9008cd6385b9e161d8229e1f6549dd23c3d022f132a2ea37ac3a10ac4935779b"
 dependencies = [
 "bitvec",
 "bytecheck",
@@ -3856,9 +3963,9 @@ dependencies = [

 [[package]]
 name = "rkyv_derive"
-version = "0.7.46"
+version = "0.7.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84d7b42d4b8d06048d3ac8db0eb31bcb942cbeb709f0b5f2b2ebde398d3038f5"
+checksum = "503d1d27590a2b0a3a4ca4c94755aa2875657196ecbf401a42eff41d7de532c0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -3900,6 +4007,7 @@ dependencies = [
 "common",
 "containerd-shim-protos",
 "go-flag",
+ "logging",
 "nix 0.26.4",
 "runtimes",
 "shim",
@@ -3910,6 +4018,7 @@ dependencies = [
 name = "runtime-spec"
 version = "0.1.0"
 dependencies = [
+ "libc",
 "serde",
 "serde_derive",
 "serde_json",
@@ -3923,6 +4032,7 @@ dependencies = [
 "anyhow",
 "common",
 "hyper",
+ "hyperlocal",
 "hypervisor",
 "kata-sys-util",
 "kata-types",
@@ -4241,7 +4351,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c789ec87f4687d022a2405cf46e0cd6284889f1839de292cadeb6c6019506f2"
 dependencies = [
 "dashmap",
- "futures",
+ "futures 0.3.28",
 "lazy_static",
 "log",
 "parking_lot",
@@ -4255,7 +4365,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e56dd856803e253c8f298af3f4d7eb0ae5e23a737252cd90bb4f3b435033b2d"
 dependencies = [
 "dashmap",
- "futures",
+ "futures 0.3.28",
 "lazy_static",
 "log",
 "parking_lot",
@@ -4295,10 +4405,12 @@ dependencies = [
 "containerd-shim-protos",
 "kata-types",
 "logging",
+ "persist",
 "runtimes",
 "slog",
 "slog-scope",
 "tokio",
+ "tracing",
 "ttrpc",
 ]

@@ -4362,7 +4474,9 @@ dependencies = [
 "nix 0.26.4",
 "oci-spec 0.8.3",
 "protobuf",
+ "rand 0.8.5",
 "runtime-spec",
+ "runtimes",
 "serial_test 0.10.0",
 "service",
 "sha2 0.10.9",
@@ -4371,8 +4485,11 @@ dependencies = [
 "slog-scope",
 "slog-stdlog",
 "tempfile",
+ "tests_utils",
 "thiserror 1.0.48",
 "tokio",
+ "tracing",
+ "tracing-opentelemetry",
 "unix_socket2",
 ]

@@ -4382,6 +4499,7 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "common",
+ "logging",
 "runtimes",
 "tokio",
 ]
@@ -4675,20 +4793,6 @@ dependencies = [
 "syn 2.0.104",
 ]

-[[package]]
-name = "sysctl"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cca424247104946a59dacd27eaad296223b7feec3d168a6dd04585183091eb0b"
-dependencies = [
- "bitflags 2.10.0",
- "byteorder",
- "enum-as-inner",
- "libc",
- "thiserror 2.0.12",
- "walkdir",
-]
-
 [[package]]
 name = "sysinfo"
 version = "0.34.2"
@@ -4979,12 +5083,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52a15c15b1bc91f90902347eff163b5b682643aff0c8e972912cca79bd9208dd"
 dependencies = [
 "bytes",
- "futures",
+ "futures 0.3.28",
 "libc",
 "tokio",
 "vsock",
 ]

+[[package]]
+name = "toml"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "758664fc71a3a69038656bee8b6be6477d2a6c315a6b81f7081f591bffa4111f"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "toml"
 version = "0.5.11"
@@ -5127,7 +5240,7 @@ dependencies = [
 "async-trait",
 "byteorder",
 "crossbeam",
- "futures",
+ "futures 0.3.28",
 "home",
 "libc",
 "log",
@@ -5329,13 +5442,16 @@ version = "0.1.0"
 dependencies = [
 "agent",
 "anyhow",
+ "async-std",
 "async-trait",
 "awaitgroup",
 "common",
 "containerd-shim-protos",
+ "futures 0.3.28",
 "hypervisor",
 "kata-sys-util",
 "kata-types",
+ "lazy_static",
 "libc",
 "logging",
 "nix 0.26.4",
@@ -5351,6 +5467,7 @@ dependencies = [
 "slog-scope",
 "strum 0.24.1",
 "tokio",
+ "toml 0.4.10",
 "tracing",
 "url",
 "uuid 1.18.1",
@@ -5983,7 +6100,7 @@ dependencies = [
 "async-trait",
 "blocking",
 "enumflags2",
- "event-listener",
+ "event-listener 5.4.1",
 "futures-core",
 "futures-lite",
 "hex",
--- a/2
+++ b/2
@@ -1 +1 @@
-3.27.0
+3.26.0
--- a/docs/how-to/how-to-use-k8s-with-containerd-and-kata.md
+++ b/docs/how-to/how-to-use-k8s-with-containerd-and-kata.md
@@ -49,8 +49,6 @@ In order to allow Kubelet to use containerd (using the CRI interface), configure
  EOF
  ```

-  For Kata Containers (and especially CoCo / Confidential Containers tests), use at least `--runtime-request-timeout=600s` (10m) so CRI CreateContainerRequest does not time out.
-
 - Inform systemd about the new configuration

  ```bash
--- a/src/agent/Cargo.lock
+++ b/src/agent/Cargo.lock
@@ -743,6 +743,12 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"

+[[package]]
+name = "common-path"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2382f75942f4b3be3690fe4f86365e9c853c1587d6ee58212cebf6e2a9ccd101"
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -1092,18 +1098,6 @@ dependencies = [
 "serde",
 ]

-[[package]]
-name = "enum-as-inner"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.101",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.11"
@@ -2108,6 +2102,8 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "byteorder",
+ "chrono",
+ "common-path",
 "fail",
 "hex",
 "kata-types",
@@ -2116,9 +2112,11 @@ dependencies = [
 "mockall",
 "nix 0.26.4",
 "oci-spec",
+ "once_cell",
 "pci-ids",
 "rand",
 "runtime-spec",
+ "safe-path",
 "serde",
 "serde_json",
 "slog",
@@ -2137,8 +2135,8 @@ dependencies = [
 "byte-unit",
 "flate2",
 "glob",
+ "hex",
 "lazy_static",
- "nix 0.26.4",
 "num_cpus",
 "oci-spec",
 "regex",
@@ -2149,7 +2147,6 @@ dependencies = [
 "sha2 0.10.9",
 "slog",
 "slog-scope",
- "sysctl",
 "sysinfo",
 "thiserror 1.0.69",
 "toml",
@@ -2309,6 +2306,7 @@ name = "mem-agent"
 version = "0.2.0"
 dependencies = [
 "anyhow",
+ "async-trait",
 "chrono",
 "maplit",
 "nix 0.30.1",
@@ -3490,9 +3488,9 @@ dependencies = [

 [[package]]
 name = "rkyv"
-version = "0.7.46"
+version = "0.7.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2297bf9c81a3f0dc96bc9521370b88f054168c29826a75e89c55ff196e7ed6a1"
+checksum = "9008cd6385b9e161d8229e1f6549dd23c3d022f132a2ea37ac3a10ac4935779b"
 dependencies = [
 "bitvec",
 "bytecheck",
@@ -3508,9 +3506,9 @@ dependencies = [

 [[package]]
 name = "rkyv_derive"
-version = "0.7.46"
+version = "0.7.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84d7b42d4b8d06048d3ac8db0eb31bcb942cbeb709f0b5f2b2ebde398d3038f5"
+checksum = "503d1d27590a2b0a3a4ca4c94755aa2875657196ecbf401a42eff41d7de532c0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -3577,6 +3575,7 @@ dependencies = [
 name = "runtime-spec"
 version = "0.1.0"
 dependencies = [
+ "libc",
 "serde",
 "serde_derive",
 "serde_json",
@@ -4216,20 +4215,6 @@ dependencies = [
 "syn 2.0.101",
 ]

-[[package]]
-name = "sysctl"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cca424247104946a59dacd27eaad296223b7feec3d168a6dd04585183091eb0b"
-dependencies = [
- "bitflags 2.9.0",
- "byteorder",
- "enum-as-inner",
- "libc",
- "thiserror 2.0.12",
- "walkdir",
-]
-
 [[package]]
 name = "sysinfo"
 version = "0.34.2"
--- a/src/agent/rustjail/src/mount.rs
+++ b/src/agent/rustjail/src/mount.rs
@@ -857,7 +857,7 @@ fn mount_from(
        dest.as_str(),
        Some(mount_typ.as_str()),
        flags,
-        Some(d.as_str()).filter(|s| !s.is_empty()),
+        Some(d.as_str()),
    )
    .inspect_err(|e| log_child!(cfd_log, "mount error: {:?}", e))?;

--- a/src/dragonball/Cargo.toml
+++ b/src/dragonball/Cargo.toml
@@ -48,6 +48,7 @@ vmm-sys-util = { workspace = true }
 virtio-queue = { workspace = true, optional = true }
 vm-memory = { workspace = true, features = ["backend-mmap"] }
 crossbeam-channel = "0.5.6"
+fuse-backend-rs = "0.10.5"
 vfio-bindings = { workspace = true, optional = true }
 vfio-ioctls = { workspace = true, optional = true }

@@ -85,6 +86,3 @@ host-device = ["dep:vfio-bindings", "dep:vfio-ioctls", "dep:dbs-pci"]
 unexpected_cfgs = { level = "warn", check-cfg = [
  'cfg(feature, values("test-mock"))',
 ] }
-
-[package.metadata.cargo-machete]
-ignored = ["vfio-bindings"]
--- a/src/dragonball/dbs_pci/Cargo.toml
+++ b/src/dragonball/dbs_pci/Cargo.toml
@@ -23,22 +23,24 @@ dbs-interrupt = { workspace = true, features = [
    "kvm-legacy-irq",
    "kvm-msi-irq",
 ] }
+downcast-rs = "1.2.0"
 byteorder = "1.4.3"
 serde = "1.0.27"

-vm-memory = { workspace = true }
-kvm-ioctls = { workspace = true }
-kvm-bindings = { workspace = true }
-vfio-ioctls = { workspace = true }
-vfio-bindings = { workspace = true }
+vm-memory = {workspace = true}
+kvm-ioctls = {workspace = true}
+kvm-bindings = {workspace = true}
+vfio-ioctls = {workspace = true}
+vfio-bindings = {workspace = true}
 libc = "0.2.39"
-virtio-queue = { workspace = true }
-dbs-utils = { workspace = true }
+vmm-sys-util = {workspace = true}
+virtio-queue = {workspace = true}
+dbs-utils = {workspace = true}


 [dev-dependencies]
 dbs-arch = { workspace = true }
-kvm-ioctls = { workspace = true }
+kvm-ioctls = {workspace = true}
 test-utils = { workspace = true }
 nix = { workspace = true }

--- a/src/dragonball/dbs_upcall/Cargo.toml
+++ b/src/dragonball/dbs_upcall/Cargo.toml
@@ -11,6 +11,7 @@ keywords = ["dragonball", "secure-sandbox", "devices", "upcall", "virtio"]
 readme = "README.md"

 [dependencies]
+anyhow = "1"
 log = "0.4.14"
 thiserror = "1"
 timerfd = "1.2.0"
--- a/src/dragonball/dbs_virtio_devices/Cargo.toml
+++ b/src/dragonball/dbs_virtio_devices/Cargo.toml
@@ -24,8 +24,8 @@ dbs-boot = { workspace = true }
 epoll = ">=4.3.1, <4.3.2"
 io-uring = "0.5.2"
 fuse-backend-rs = { version = "0.10.5", optional = true }
-kvm-bindings = { workspace = true }
-kvm-ioctls = { workspace = true }
+kvm-bindings = { workspace = true}
+kvm-ioctls = {workspace = true}
 libc = "0.2.119"
 log = "0.4.14"
 nix = "0.24.3"
@@ -37,16 +37,19 @@ serde = "1.0.27"
 serde_json = "1.0.9"
 thiserror = "1"
 threadpool = "1"
-virtio-bindings = { workspace = true }
-virtio-queue = { workspace = true }
-vmm-sys-util = { workspace = true }
+virtio-bindings = {workspace = true}
+virtio-queue = {workspace = true}
+vmm-sys-util = {workspace = true}
 vm-memory = { workspace = true, features = ["backend-mmap"] }
 sendfd = "0.4.3"
 vhost-rs = { version = "0.6.1", package = "vhost", optional = true }
 timerfd = "1.0"

 [dev-dependencies]
-vm-memory = { workspace = true, features = ["backend-mmap", "backend-atomic"] }
+vm-memory = { workspace = true, features = [
+    "backend-mmap",
+    "backend-atomic",
+] }
 test-utils = { workspace = true }

 [features]
--- a/src/dragonball/dbs_virtio_devices/src/lib.rs
+++ b/src/dragonball/dbs_virtio_devices/src/lib.rs
@@ -439,19 +439,19 @@ pub mod tests {
            VirtqDesc { desc }
        }

-        pub fn addr(&self) -> VolatileRef<'_, u64> {
+        pub fn addr(&self) -> VolatileRef<u64> {
            self.desc.get_ref(offset_of!(DescriptorTmp, addr)).unwrap()
        }

-        pub fn len(&self) -> VolatileRef<'_, u32> {
+        pub fn len(&self) -> VolatileRef<u32> {
            self.desc.get_ref(offset_of!(DescriptorTmp, len)).unwrap()
        }

-        pub fn flags(&self) -> VolatileRef<'_, u16> {
+        pub fn flags(&self) -> VolatileRef<u16> {
            self.desc.get_ref(offset_of!(DescriptorTmp, flags)).unwrap()
        }

-        pub fn next(&self) -> VolatileRef<'_, u16> {
+        pub fn next(&self) -> VolatileRef<u16> {
            self.desc.get_ref(offset_of!(DescriptorTmp, next)).unwrap()
        }

@@ -513,11 +513,11 @@ pub mod tests {
            self.start.unchecked_add(self.ring.len() as GuestUsize)
        }

-        pub fn flags(&self) -> VolatileRef<'_, u16> {
+        pub fn flags(&self) -> VolatileRef<u16> {
            self.ring.get_ref(0).unwrap()
        }

-        pub fn idx(&self) -> VolatileRef<'_, u16> {
+        pub fn idx(&self) -> VolatileRef<u16> {
            self.ring.get_ref(2).unwrap()
        }

@@ -525,12 +525,12 @@ pub mod tests {
            4 + mem::size_of::<T>() * (i as usize)
        }

-        pub fn ring(&self, i: u16) -> VolatileRef<'_, T> {
+        pub fn ring(&self, i: u16) -> VolatileRef<T> {
            assert!(i < self.qsize);
            self.ring.get_ref(Self::ring_offset(i)).unwrap()
        }

-        pub fn event(&self) -> VolatileRef<'_, u16> {
+        pub fn event(&self) -> VolatileRef<u16> {
            self.ring.get_ref(Self::ring_offset(self.qsize)).unwrap()
        }

@@ -602,7 +602,7 @@ pub mod tests {
            (self.dtable.len() / VirtqDesc::dtable_len(1)) as u16
        }

-        pub fn dtable(&self, i: u16) -> VirtqDesc<'_> {
+        pub fn dtable(&self, i: u16) -> VirtqDesc {
            VirtqDesc::new(&self.dtable, i)
        }

--- a/src/dragonball/dbs_virtio_devices/src/vhost/vhost_user/fs.rs
+++ b/src/dragonball/dbs_virtio_devices/src/vhost/vhost_user/fs.rs
@@ -865,11 +865,11 @@ mod tests {
            0
        );
        let config: [u8; 8] = [0; 8];
-        let _ = VirtioDevice::<Arc<GuestMemoryMmap<()>>, QueueSync, GuestRegionMmap>::write_config(
+        VirtioDevice::<Arc<GuestMemoryMmap<()>>, QueueSync, GuestRegionMmap>::write_config(
            &mut dev, 0, &config,
        );
        let mut data: [u8; 8] = [1; 8];
-        let _ = VirtioDevice::<Arc<GuestMemoryMmap<()>>, QueueSync, GuestRegionMmap>::read_config(
+        VirtioDevice::<Arc<GuestMemoryMmap<()>>, QueueSync, GuestRegionMmap>::read_config(
            &mut dev, 0, &mut data,
        );
        assert_eq!(config, data);
--- a/src/dragonball/dbs_virtio_devices/src/vsock/mod.rs
+++ b/src/dragonball/dbs_virtio_devices/src/vsock/mod.rs
@@ -339,7 +339,7 @@ mod tests {
            }
        }

-        pub fn create_event_handler_context(&self) -> EventHandlerContext<'_> {
+        pub fn create_event_handler_context(&self) -> EventHandlerContext {
            const QSIZE: u16 = 256;

            let guest_rxvq = GuestQ::new(GuestAddress(0x0010_0000), &self.mem, QSIZE);
--- a/src/libs/kata-sys-util/Cargo.toml
+++ b/src/libs/kata-sys-util/Cargo.toml
@@ -13,10 +13,13 @@ edition = "2018"
 [dependencies]
 anyhow = "1.0.31"
 byteorder = "1.4.3"
+chrono = "0.4.0"
+common-path = "=1.0.0"
 fail = "0.5.0"
 lazy_static = "1.4.0"
 libc = "0.2.100"
 nix = "0.26.4"
+once_cell = "1.9.0"
 serde = { version = "1.0.138", features = ["derive"] }
 serde_json = "1.0.73"
 slog = "2.5.2"
@@ -31,7 +34,10 @@ mockall = "0.13.1"
 kata-types = { path = "../kata-types" }
 oci-spec = { version = "0.8.1", features = ["runtime"] }
 runtime-spec = { path = "../runtime-spec" }
+safe-path = { path = "../safe-path" }

 [dev-dependencies]
+num_cpus = "1.13.1"
+serial_test = "0.5.1"
 tempfile = "3.19.1"
 test-utils = { path = "../test-utils" }
--- a/src/libs/kata-types/Cargo.toml
+++ b/src/libs/kata-types/Cargo.toml
@@ -29,14 +29,12 @@ serde-enum-str = "0.4"
 sysinfo = "0.34.2"
 sha2 = "0.10.8"
 flate2 = "1.1"
-nix = "0.26.4"
+hex = "0.4"
+
 oci-spec = { version = "0.8.1", features = ["runtime"] }

 safe-path = { path = "../safe-path", optional = true }

-[target.'cfg(target_os = "macos")'.dependencies]
-sysctl = "0.7.1"
-
 [dev-dependencies]
 tempfile = "3.19.1"
 test-utils = { path = "../test-utils" }
--- a/src/libs/kata-types/src/config/hypervisor/mod.rs
+++ b/src/libs/kata-types/src/config/hypervisor/mod.rs
@@ -26,6 +26,7 @@
 use super::{default, ConfigOps, ConfigPlugin, TomlConfig};
 use crate::annotations::KATA_ANNO_CFG_HYPERVISOR_PREFIX;
 use crate::{resolve_path, sl, validate_path};
+use byte_unit::{Byte, Unit};
 use lazy_static::lazy_static;
 use regex::RegexSet;
 use serde_enum_str::{Deserialize_enum_str, Serialize_enum_str};
@@ -33,6 +34,7 @@ use std::collections::HashMap;
 use std::io::{self, Result};
 use std::path::Path;
 use std::sync::{Arc, Mutex};
+use sysinfo::{MemoryRefreshKind, RefreshKind, System};

 mod dragonball;
 pub use self::dragonball::{DragonballConfig, HYPERVISOR_NAME_DRAGONBALL};
@@ -1005,57 +1007,6 @@ fn default_guest_swap_create_threshold_secs() -> u64 {
    60
 }

-/// Get host memory size in MiB.
-/// Retrieves the total physical memory of the host across different platforms.
-fn host_memory_mib() -> io::Result<u64> {
-    // Select a platform-specific implementation via a function pointer.
-    let get_memory: fn() -> io::Result<u64> = {
-        #[cfg(target_os = "linux")]
-        {
-            || {
-                let info = nix::sys::sysinfo::sysinfo().map_err(io::Error::other)?;
-                Ok(info.ram_total() / (1024 * 1024)) // MiB
-            }
-        }
-
-        #[cfg(target_os = "macos")]
-        {
-            || {
-                use sysctl::{Ctl, CtlValue, Sysctl};
-
-                let v = Ctl::new("hw.memsize")
-                    .map_err(io::Error::other)?
-                    .value()
-                    .map_err(io::Error::other)?;
-
-                let bytes = match v {
-                    CtlValue::S64(x) if x >= 0 => x as u64,
-                    other => {
-                        return Err(io::Error::new(
-                            io::ErrorKind::InvalidData,
-                            format!("unexpected sysctl hw.memsize value type: {:?}", other),
-                        ));
-                    }
-                };
-
-                Ok(bytes / (1024 * 1024)) // MiB
-            }
-        }
-
-        #[cfg(not(any(target_os = "linux", target_os = "macos")))]
-        {
-            || {
-                Err(io::Error::new(
-                    io::ErrorKind::Unsupported,
-                    "host memory query not implemented on this platform",
-                ))
-            }
-        }
-    };
-
-    get_memory()
-}
-
 impl MemoryInfo {
    /// Adjusts the configuration information after loading from a configuration file.
    ///
@@ -1067,15 +1018,13 @@ impl MemoryInfo {
            self.file_mem_backend,
            "Memory backend file {} is invalid: {}"
        )?;
-
-        let host_memory = host_memory_mib()?;
-
-        if u64::from(self.default_memory) > host_memory {
-            self.default_memory = host_memory as u32;
-        }
-
-        if self.default_maxmemory == 0 || u64::from(self.default_maxmemory) > host_memory {
-            self.default_maxmemory = host_memory as u32;
+        if self.default_maxmemory == 0 {
+            let s = System::new_with_specifics(
+                RefreshKind::nothing().with_memory(MemoryRefreshKind::everything()),
+            );
+            self.default_maxmemory = Byte::from_u64(s.total_memory())
+                .get_adjusted_unit(Unit::MiB)
+                .get_value() as u32;
        }
        Ok(())
    }
@@ -1218,29 +1167,6 @@ pub struct SecurityInfo {
    #[serde(default)]
    pub sev_snp_guest: bool,

-    /// SNP 'ID Block' and 'ID Authentication Information Structure'.
-    /// If one of snp_id_block or snp_id_auth is specified, the other must be specified, too.
-    /// Notice that the default SNP policy of QEMU (0x30000) is used by Kata, if not explicitly
-    /// set via 'snp_guest_policy' option. The IDBlock contains the guest policy as field, and
-    /// it must match the value from 'snp_guest_policy' or, if unset, the QEMU default policy.
-    /// 96-byte, base64-encoded blob to provide the 'ID Block' structure for the
-    /// SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (QEMU default: all-zero)
-    #[serde(default)]
-    pub snp_id_block: String,
-
-    /// 4096-byte, base64-encoded blob to provide the 'ID Authentication Information Structure'
-    /// for the SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (QEMU default: all-zero)
-    #[serde(default)]
-    pub snp_id_auth: String,
-
-    /// SNP Guest Policy, the 'POLICY' parameter to the SNP_LAUNCH_START command.
-    /// If unset, the QEMU default policy (0x30000) will be used.
-    /// Notice that the guest policy is enforced at VM launch, and your pod VMs
-    /// won't start at all if the policy denys it. This will be indicated by a
-    /// 'SNP_LAUNCH_START' error.
-    #[serde(default = "default_snp_guest_policy")]
-    pub snp_guest_policy: u32,
-
    /// Path to OCI hook binaries in the *guest rootfs*.
    ///
    /// This setting does not affect host-side hooks, which must instead be
@@ -1302,10 +1228,6 @@ fn default_qgs_port() -> u32 {
    4050
 }

-fn default_snp_guest_policy() -> u32 {
-    0x30000
-}
-
 impl SecurityInfo {
    /// Adjusts the security configuration information after loading from a configuration file.
    ///
--- a/src/libs/mem-agent/Cargo.toml
+++ b/src/libs/mem-agent/Cargo.toml
@@ -10,6 +10,7 @@ anyhow = "1.0"
 page_size = "0.6"
 chrono = "0.4"
 tokio = { version = "1.45.1", features = ["full"] }
+async-trait = "0.1"
 maplit = "1.0"
 nix = { version = "0.30.1", features = ["fs", "sched"] }

--- a/src/libs/runtime-spec/Cargo.toml
+++ b/src/libs/runtime-spec/Cargo.toml
@@ -9,3 +9,4 @@ license = "Apache-2.0"
 serde = "1.0.131"
 serde_derive = "1.0.131"
 serde_json = "1.0.73"
+libc = "0.2.112"
--- a/src/runtime-rs/Cargo.toml
+++ b/src/runtime-rs/Cargo.toml
@@ -28,4 +28,5 @@ nix = { workspace = true }
 tokio = { workspace = true, features = ["rt", "rt-multi-thread"] }
 shim = { path = "crates/shim" }
 common = { workspace = true }
+logging = { workspace = true }
 runtimes = { workspace = true }
--- a/src/runtime-rs/Makefile
+++ b/src/runtime-rs/Makefile
@@ -180,7 +180,7 @@ DEFNETQUEUES := 1
 DEFENABLEANNOTATIONS := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\"]
 DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
 DEFDISABLEGUESTSECCOMP := true
-DEFDISABLEGUESTEMPTYDIR := false
+DEFDISABLEGUESTEMPTYDIR := true
 ##VAR DEFAULTEXPFEATURES=[features] Default experimental features enabled
 DEFAULTEXPFEATURES := []
 DEFDISABLESELINUX := false
@@ -298,7 +298,7 @@ ifneq (,$(CLHCMD))
    KERNELTYPE_CLH = uncompressed
    KERNEL_NAME_CLH = $(call MAKE_KERNEL_NAME,$(KERNELTYPE_CLH))
    KERNELPATH_CLH = $(KERNELDIR)/$(KERNEL_NAME_CLH)
-    VMROOTFSDRIVER_CLH := virtio-blk-pci
+    VMROOTFSDRIVER_CLH := virtio-pmem

    DEFSANDBOXCGROUPONLY_CLH := true
    DEFSTATICRESOURCEMGMT_CLH := false
--- a/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
+++ b/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
@@ -22,8 +22,6 @@ rootfs_type = @DEFROOTFSTYPE@

 # Block storage driver to be used for the VM rootfs is backed
 # by a block device.
-#
-# virtio-pmem is not supported with Cloud Hypervisor.
 vm_rootfs_driver = "@VMROOTFSDRIVER_CLH@"

 # Path to the firmware.
--- a/src/runtime-rs/crates/agent/Cargo.toml
+++ b/src/runtime-rs/crates/agent/Cargo.toml
@@ -5,9 +5,13 @@ authors = { workspace = true }
 edition = { workspace = true }
 license = { workspace = true }

+[dev-dependencies]
+futures = "0.1.27"
+
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }
+log = { workspace = true }
 protobuf = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -27,6 +31,3 @@ protocols = { workspace = true, features = ["async"] }

 [features]
 default = []
-
-[package.metadata.cargo-machete]
-ignored = ["slog-scope"]
--- a/src/runtime-rs/crates/hypervisor/Cargo.toml
+++ b/src/runtime-rs/crates/hypervisor/Cargo.toml
@@ -28,6 +28,8 @@ path-clean = "1.0.1"
 lazy_static = { workspace = true }
 tracing = { workspace = true }
 ttrpc = { workspace = true, features = ["async"] }
+protobuf = { workspace = true }
+oci-spec = { workspace = true }
 futures = "0.3.25"
 safe-path = "0.1.0"
 crossbeam-channel = "0.5.6"
@@ -42,6 +44,7 @@ kata-sys-util = { workspace = true }
 kata-types = { workspace = true }
 logging = { workspace = true }
 protocols = { workspace = true, features = ["async"] }
+shim-interface = { workspace = true }
 persist = { workspace = true }
 ch-config = { workspace = true, optional = true }
 tests_utils = { workspace = true }
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs
@@ -118,11 +118,13 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {

        // Note how CH handles the different image types:
        //
+        // - A standard image is specified in PmemConfig.
        // - An initrd/initramfs is specified in PayloadConfig.
-        // - An image is specified in DiskConfig.
-        //   Note: pmem is not used as it's not properly supported by Cloud Hypervisor.
+        // - A confidential guest image is specified by a DiskConfig.
        //   - If TDX is enabled, the firmware (`td-shim` [1]) must be
        //     specified in PayloadConfig.
+        // - A confidential guest initrd is specified by a PayloadConfig with
+        //   firmware.
        //
        // [1] - https://github.com/confidential-containers/td-shim
        let boot_info = cfg.boot_info;
@@ -138,6 +140,14 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {
            return Err(VmConfigError::NoBootFile);
        }

+        let pmem = if use_initrd || guest_protection_is_tdx(guest_protection_to_use.clone()) {
+            None
+        } else {
+            let pmem = PmemConfig::try_from(&boot_info).map_err(VmConfigError::PmemError)?;
+
+            Some(vec![pmem])
+        };
+
        let payload = Some(
            PayloadConfig::try_from((
                boot_info.clone(),
@@ -149,7 +159,7 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {

        let mut disks: Vec<DiskConfig> = vec![];

-        if use_image {
+        if use_image && guest_protection_is_tdx(guest_protection_to_use.clone()) {
            let disk = DiskConfig::try_from(boot_info).map_err(VmConfigError::DiskError)?;

            disks.push(disk);
@@ -189,6 +199,7 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {
            fs,
            net,
            devices: host_devices,
+            pmem,
            disks,
            vsock: Some(vsock),
            rng,
@@ -1645,6 +1656,7 @@ mod tests {
        let (memory_info_confidential_guest, mem_config_confidential_guest) =
            make_memory_objects(79, usable_max_mem_bytes, true);

+        let (_, pmem_config_with_image) = make_bootinfo_pmemconfig_objects(image);
        let (machine_info, rng_config) = make_machineinfo_rngconfig_objects(entropy_source);

        let payload_firmware = None;
@@ -1652,7 +1664,6 @@ mod tests {
        let (boot_info_with_initrd, payload_config_with_initrd) =
            make_bootinfo_payloadconfig_objects(kernel, initramfs, payload_firmware, None);

-        let (_, disk_config_with_image) = make_bootinfo_diskconfig_objects(image);
        let (_, disk_config_confidential_guest_image) = make_bootinfo_diskconfig_objects(image);

        let boot_info_tdx_image = BootInfo {
@@ -1751,7 +1762,7 @@ mod tests {
            vsock: Some(valid_vsock.clone()),

            // rootfs image specific
-            disks: Some(vec![disk_config_with_image]),
+            pmem: Some(vec![pmem_config_with_image]),

            payload: Some(PayloadConfig {
                kernel: Some(PathBuf::from(kernel)),
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs
@@ -110,16 +110,6 @@ pub struct DeviceConfig {
    pub pci_segment: u16,
 }

-#[derive(Serialize, Deserialize, Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum ImageType {
-    FixedVhd,
-    Qcow2,
-    Raw,
-    Vhdx,
-    #[default]
-    Unknown,
-}
-
 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Default)]
 pub struct DiskConfig {
    pub path: Option<PathBuf>,
@@ -145,8 +135,6 @@ pub struct DiskConfig {
    pub disable_io_uring: bool,
    #[serde(default)]
    pub pci_segment: u16,
-    #[serde(default)]
-    pub image_type: ImageType,
 }

 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Default)]
--- a/src/runtime-rs/crates/hypervisor/src/ch/inner.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner.rs
@@ -123,12 +123,7 @@ impl CloudHypervisorInner {
        }
    }

-    pub fn set_hypervisor_config(&mut self, mut config: HypervisorConfig) {
-        // virtio-pmem is not supported for Cloud Hypervisor.
-        if config.boot_info.vm_rootfs_driver == crate::VM_ROOTFS_DRIVER_PMEM {
-            config.boot_info.vm_rootfs_driver = crate::VM_ROOTFS_DRIVER_BLK.to_string();
-        }
-
+    pub fn set_hypervisor_config(&mut self, config: HypervisorConfig) {
        self.config = config;
    }

--- a/src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs
@@ -27,7 +27,6 @@ use ch_config::ch_api::{
 };
 use ch_config::convert::DEFAULT_NUM_PCI_SEGMENTS;
 use ch_config::DiskConfig;
-use ch_config::ImageType;
 use ch_config::{net_util::MacAddr, DeviceConfig, FsConfig, NetConfig, VsockConfig};
 use kata_sys_util::netns::NetnsGuard;
 use kata_types::config::hypervisor::RateLimiterConfig;
@@ -551,7 +550,6 @@ impl TryFrom<BlockConfig> for DiskConfig {
            readonly: blkcfg.is_readonly,
            num_queues: blkcfg.num_queues,
            queue_size: blkcfg.queue_size as u16,
-            image_type: ImageType::Raw,
            ..Default::default()
        };

--- a/src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs
@@ -15,6 +15,7 @@ use crate::utils::vm_cleanup;
 use crate::utils::{bytes_to_megs, get_jailer_root, get_sandbox_path, megs_to_bytes};
 use crate::MemoryConfig;
 use crate::VM_ROOTFS_DRIVER_BLK;
+use crate::VM_ROOTFS_DRIVER_PMEM;
 use crate::{VcpuThreadIds, VmmState};
 use anyhow::{anyhow, Context, Result};
 use ch_config::ch_api::cloud_hypervisor_vm_netdev_add_with_fds;
@@ -129,8 +130,12 @@ impl CloudHypervisorInner {
        let confidential_guest = cfg.security_info.confidential_guest;

        // Note that the configuration option hypervisor.block_device_driver is not used.
-        // NVDIMM is not supported for Cloud Hypervisor.
-        let rootfs_driver = VM_ROOTFS_DRIVER_BLK;
+        let rootfs_driver = if confidential_guest {
+            // PMEM is not available with TDX.
+            VM_ROOTFS_DRIVER_BLK
+        } else {
+            VM_ROOTFS_DRIVER_PMEM
+        };

        let rootfs_type = match cfg.boot_info.rootfs_type.is_empty() {
            true => DEFAULT_CH_ROOTFS_TYPE,
@@ -150,7 +155,6 @@ impl CloudHypervisorInner {
            &cfg.boot_info.kernel_verity_params,
            rootfs_driver,
            rootfs_type,
-            true,
        )?;

        let mut console_params = if enable_debug {
@@ -1100,7 +1104,7 @@ fn get_guest_protection() -> Result<GuestProtection> {
    Ok(guest_protection)
 }

-// Return a VCPU/TID map from a specified /proc/{pid} path.
+// Return a TID/VCPU map from a specified /proc/{pid} path.
 fn get_ch_vcpu_tids(proc_path: &str) -> Result<HashMap<u32, u32>> {
    const VCPU_STR: &str = "vcpu";

@@ -1143,7 +1147,7 @@ fn get_ch_vcpu_tids(proc_path: &str) -> Result<HashMap<u32, u32>> {
            .parse::<u32>()
            .map_err(|e| anyhow!(e).context("Invalid vcpu id."))?;

-        vcpus.insert(vcpu_id, tid);
+        vcpus.insert(tid, vcpu_id);
    }

    if vcpus.is_empty() {
@@ -1609,65 +1613,4 @@ mod tests {
            assert!(actual_error == expected_error, "{}", msg);
        }
    }
-
-    #[actix_rt::test]
-    async fn test_get_ch_vcpu_tids_mapping() {
-        let tmp_dir = Builder::new().prefix("fake-proc-pid").tempdir().unwrap();
-        let task_dir = tmp_dir.path().join("task");
-        fs::create_dir_all(&task_dir).unwrap();
-
-        #[derive(Debug)]
-        struct ThreadInfo<'a> {
-            tid: &'a str,
-            comm: &'a str,
-        }
-
-        let threads = &[
-            // Non-vcpu thread, should be skipped.
-            ThreadInfo {
-                tid: "1000",
-                comm: "main_thread\n",
-            },
-            ThreadInfo {
-                tid: "2001",
-                comm: "vcpu0\n",
-            },
-            ThreadInfo {
-                tid: "2002",
-                comm: "vcpu1\n",
-            },
-            ThreadInfo {
-                tid: "2003",
-                comm: "vcpu2\n",
-            },
-        ];
-
-        for t in threads {
-            let tid_dir = task_dir.join(t.tid);
-            fs::create_dir_all(&tid_dir).unwrap();
-            fs::write(tid_dir.join("comm"), t.comm).unwrap();
-        }
-
-        let proc_path = tmp_dir.path().to_str().unwrap();
-        let result = get_ch_vcpu_tids(proc_path);
-
-        let msg = format!("result: {result:?}");
-
-        if std::env::var("DEBUG").is_ok() {
-            println!("DEBUG: {msg}");
-        }
-
-        let vcpus = result.unwrap();
-
-        // The mapping must be vcpu_id -> tid.
-        assert_eq!(vcpus.len(), 3, "non-vcpu threads should be excluded");
-        assert_eq!(vcpus[&0], 2001, "vcpu 0 should map to tid 2001");
-        assert_eq!(vcpus[&1], 2002, "vcpu 1 should map to tid 2002");
-        assert_eq!(vcpus[&2], 2003, "vcpu 2 should map to tid 2003");
-
-        assert!(
-            !vcpus.contains_key(&1000),
-            "non-vcpu thread should not be in the map"
-        );
-    }
 }
--- a/src/runtime-rs/crates/hypervisor/src/device/driver/virtio_blk.rs
+++ b/src/runtime-rs/crates/hypervisor/src/device/driver/virtio_blk.rs
@@ -13,17 +13,17 @@ use crate::device::DeviceType;
 use crate::Hypervisor as hypervisor;
 use anyhow::{Context, Result};
 use async_trait::async_trait;
-pub use kata_types::device::{
-    DRIVER_BLK_CCW_TYPE as KATA_CCW_DEV_TYPE, DRIVER_BLK_MMIO_TYPE as KATA_MMIO_BLK_DEV_TYPE,
-    DRIVER_BLK_PCI_TYPE as KATA_BLK_DEV_TYPE, DRIVER_NVDIMM_TYPE as KATA_NVDIMM_DEV_TYPE,
-    DRIVER_SCSI_TYPE as KATA_SCSI_DEV_TYPE,
-};

 /// VIRTIO_BLOCK_PCI indicates block driver is virtio-pci based
 pub const VIRTIO_BLOCK_PCI: &str = "virtio-blk-pci";
 pub const VIRTIO_BLOCK_MMIO: &str = "virtio-blk-mmio";
 pub const VIRTIO_BLOCK_CCW: &str = "virtio-blk-ccw";
 pub const VIRTIO_PMEM: &str = "virtio-pmem";
+pub const KATA_MMIO_BLK_DEV_TYPE: &str = "mmioblk";
+pub const KATA_BLK_DEV_TYPE: &str = "blk";
+pub const KATA_CCW_DEV_TYPE: &str = "ccw";
+pub const KATA_NVDIMM_DEV_TYPE: &str = "nvdimm";
+pub const KATA_SCSI_DEV_TYPE: &str = "scsi";

 #[derive(Clone, Copy, Debug, Default)]
 pub enum BlockDeviceAio {
@@ -95,9 +95,6 @@ pub struct BlockConfig {
    /// scsi_addr is of the format SCSI-Id:LUN
    pub scsi_addr: Option<String>,

-    /// CCW device address for virtio-blk-ccw on s390x (e.g., "0.0.0005")
-    pub ccw_addr: Option<String>,
-
    /// device attach count
    pub attach_count: u64,

--- a/src/runtime-rs/crates/hypervisor/src/dragonball/inner.rs
+++ b/src/runtime-rs/crates/hypervisor/src/dragonball/inner.rs
@@ -150,7 +150,6 @@ impl DragonballInner {
                &self.config.boot_info.kernel_verity_params,
                &rootfs_driver,
                &self.config.boot_info.rootfs_type,
-                true,
            )?;
            kernel_params.append(&mut rootfs_params);
        }
--- a/src/runtime-rs/crates/hypervisor/src/firecracker/fc_api.rs
+++ b/src/runtime-rs/crates/hypervisor/src/firecracker/fc_api.rs
@@ -90,7 +90,6 @@ impl FcInner {
            &self.config.boot_info.kernel_verity_params,
            &self.config.blockdev_info.block_device_driver,
            &self.config.boot_info.rootfs_type,
-            true,
        )?;
        kernel_params.append(&mut rootfs_params);
        kernel_params.append(&mut KernelParams::from_string(
--- a/src/runtime-rs/crates/hypervisor/src/kernel_param.rs
+++ b/src/runtime-rs/crates/hypervisor/src/kernel_param.rs
@@ -10,8 +10,8 @@ use crate::{
    VM_ROOTFS_DRIVER_BLK, VM_ROOTFS_DRIVER_BLK_CCW, VM_ROOTFS_DRIVER_MMIO, VM_ROOTFS_DRIVER_PMEM,
    VM_ROOTFS_ROOT_BLK, VM_ROOTFS_ROOT_PMEM,
 };
-use kata_types::config::hypervisor::{parse_kernel_verity_params, VERITY_BLOCK_SIZE_BYTES};
 use kata_types::config::LOG_VPORT_OPTION;
+use kata_types::config::hypervisor::{parse_kernel_verity_params, VERITY_BLOCK_SIZE_BYTES};
 use kata_types::fs::{
    VM_ROOTFS_FILESYSTEM_EROFS, VM_ROOTFS_FILESYSTEM_EXT4, VM_ROOTFS_FILESYSTEM_XFS,
 };
@@ -66,7 +66,8 @@ struct KernelVerityConfig {
 }

 fn new_kernel_verity_params(params_string: &str) -> Result<Option<KernelVerityConfig>> {
-    let cfg = parse_kernel_verity_params(params_string).map_err(|err| anyhow!(err.to_string()))?;
+    let cfg = parse_kernel_verity_params(params_string)
+        .map_err(|err| anyhow!(err.to_string()))?;

    Ok(cfg.map(|params| KernelVerityConfig {
        root_hash: params.root_hash,
@@ -144,7 +145,6 @@ impl KernelParams {
        kernel_verity_params: &str,
        rootfs_driver: &str,
        rootfs_type: &str,
-        use_dax: bool,
    ) -> Result<Self> {
        let mut params = vec![];

@@ -153,29 +153,16 @@ impl KernelParams {
                params.push(Param::new("root", VM_ROOTFS_ROOT_PMEM));
                match rootfs_type {
                    VM_ROOTFS_FILESYSTEM_EXT4 => {
-                        if use_dax {
-                            params.push(Param::new(
-                                "rootflags",
-                                "dax,data=ordered,errors=remount-ro ro",
-                            ));
-                        } else {
-                            params
-                                .push(Param::new("rootflags", "data=ordered,errors=remount-ro ro"));
-                        }
+                        params.push(Param::new(
+                            "rootflags",
+                            "dax,data=ordered,errors=remount-ro ro",
+                        ));
                    }
                    VM_ROOTFS_FILESYSTEM_XFS => {
-                        if use_dax {
-                            params.push(Param::new("rootflags", "dax ro"));
-                        } else {
-                            params.push(Param::new("rootflags", "ro"));
-                        }
+                        params.push(Param::new("rootflags", "dax ro"));
                    }
                    VM_ROOTFS_FILESYSTEM_EROFS => {
-                        if use_dax {
-                            params.push(Param::new("rootflags", "dax ro"));
-                        } else {
-                            params.push(Param::new("rootflags", "ro"));
-                        }
+                        params.push(Param::new("rootflags", "dax ro"));
                    }
                    _ => {
                        return Err(anyhow!("Unsupported rootfs type {}", rootfs_type));
@@ -359,7 +346,6 @@ mod tests {
    struct TestData<'a> {
        rootfs_driver: &'a str,
        rootfs_type: &'a str,
-        use_dax: bool,
        expect_params: KernelParams,
        result: Result<()>,
    }
@@ -367,11 +353,10 @@ mod tests {
    #[test]
    fn test_rootfs_kernel_params() {
        let tests = &[
-            // EXT4 with DAX
+            // EXT4
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_PMEM,
                rootfs_type: VM_ROOTFS_FILESYSTEM_EXT4,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_PMEM),
@@ -385,7 +370,6 @@ mod tests {
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_BLK,
                rootfs_type: VM_ROOTFS_FILESYSTEM_EXT4,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -396,15 +380,14 @@ mod tests {
                },
                result: Ok(()),
            },
-            // XFS without DAX
+            // XFS
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_PMEM,
                rootfs_type: VM_ROOTFS_FILESYSTEM_XFS,
-                use_dax: false,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_PMEM),
-                        Param::new("rootflags", "ro"),
+                        Param::new("rootflags", "dax ro"),
                        Param::new("rootfstype", VM_ROOTFS_FILESYSTEM_XFS),
                    ]
                    .to_vec(),
@@ -414,7 +397,6 @@ mod tests {
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_BLK,
                rootfs_type: VM_ROOTFS_FILESYSTEM_XFS,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -425,11 +407,10 @@ mod tests {
                },
                result: Ok(()),
            },
-            // EROFS with DAX
+            // EROFS
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_PMEM,
                rootfs_type: VM_ROOTFS_FILESYSTEM_EROFS,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_PMEM),
@@ -443,7 +424,6 @@ mod tests {
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_BLK,
                rootfs_type: VM_ROOTFS_FILESYSTEM_EROFS,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -458,7 +438,6 @@ mod tests {
            TestData {
                rootfs_driver: "foo",
                rootfs_type: VM_ROOTFS_FILESYSTEM_EXT4,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -473,7 +452,6 @@ mod tests {
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_BLK,
                rootfs_type: "foo",
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -488,12 +466,8 @@ mod tests {

        for (i, t) in tests.iter().enumerate() {
            let msg = format!("test[{i}]: {t:?}");
-            let result = KernelParams::new_rootfs_kernel_params(
-                "",
-                t.rootfs_driver,
-                t.rootfs_type,
-                t.use_dax,
-            );
+            let result =
+                KernelParams::new_rootfs_kernel_params("", t.rootfs_driver, t.rootfs_type);
            let msg = format!("{msg}, result: {result:?}");
            if t.result.is_ok() {
                assert!(result.is_ok(), "{}", msg);
@@ -512,7 +486,6 @@ mod tests {
            "root_hash=abc,salt=def,data_blocks=1,data_block_size=4096,hash_block_size=4096",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )?;
        let params_string = params.to_string()?;
        assert!(params_string.contains("dm-mod.create="));
@@ -523,7 +496,6 @@ mod tests {
            "root_hash=abc,data_blocks=1,data_block_size=4096,hash_block_size=4096",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )
        .err()
        .expect("expected missing salt error");
@@ -533,7 +505,6 @@ mod tests {
            "root_hash=abc,salt=def,data_block_size=4096,hash_block_size=4096",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )
        .err()
        .expect("expected missing data_blocks error");
@@ -543,7 +514,6 @@ mod tests {
            "root_hash=abc,salt=def,data_blocks=foo,data_block_size=4096,hash_block_size=4096",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )
        .err()
        .expect("expected invalid data_blocks error");
@@ -553,7 +523,6 @@ mod tests {
            "root_hash=abc,salt=def,data_blocks=1,data_block_size=4096,hash_block_size=4096,badfield",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )
        .err()
        .expect("expected invalid entry error");
--- a/src/runtime-rs/crates/hypervisor/src/qemu/cmdline_generator.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/cmdline_generator.rs
@@ -179,17 +179,10 @@ impl Kernel {
        let mut kernel_params = KernelParams::new(config.debug_info.enable_debug);

        if config.boot_info.initrd.is_empty() {
-            // DAX is disabled on ARM due to a kernel panic in caches_clean_inval_pou.
-            #[cfg(target_arch = "aarch64")]
-            let use_dax = false;
-            #[cfg(not(target_arch = "aarch64"))]
-            let use_dax = true;
-
            let mut rootfs_params = KernelParams::new_rootfs_kernel_params(
                &config.boot_info.kernel_verity_params,
                &config.boot_info.vm_rootfs_driver,
                &config.boot_info.rootfs_type,
-                use_dax,
            )
            .context("adding rootfs/verity params failed")?;
            kernel_params.append(&mut rootfs_params);
@@ -256,8 +249,29 @@ struct Memory {

 impl Memory {
    fn new(config: &HypervisorConfig) -> Memory {
-        let mem_size = config.memory_info.default_memory as u64;
-        let max_mem_size = config.memory_info.default_maxmemory as u64;
+        // Move this to QemuConfig::adjust_config()?
+
+        let mut mem_size = config.memory_info.default_memory as u64;
+        let mut max_mem_size = config.memory_info.default_maxmemory as u64;
+
+        if let Ok(sysinfo) = nix::sys::sysinfo::sysinfo() {
+            let host_memory = sysinfo.ram_total() >> 20;
+
+            if mem_size > host_memory {
+                info!(sl!(), "'default_memory' given in configuration.toml is greater than host memory, adjusting to host memory");
+                mem_size = host_memory
+            }
+
+            if max_mem_size == 0 || max_mem_size > host_memory {
+                max_mem_size = host_memory
+            }
+        } else {
+            warn!(sl!(), "Failed to get host memory size, cannot verify or adjust configuration.toml's 'default_maxmemory'");
+
+            if max_mem_size == 0 {
+                max_mem_size = mem_size;
+            };
+        }

        // Memory sizes are given in megabytes in configuration.toml so we
        // need to convert them to bytes for storage.
@@ -279,18 +293,6 @@ impl Memory {
        self.memory_backend_file = Some(mem_file.clone());
        self
    }
-
-    #[allow(dead_code)]
-    fn set_maxmem_size(&mut self, max_size: u64) -> &mut Self {
-        self.max_size = max_size;
-        self
-    }
-
-    #[allow(dead_code)]
-    fn set_num_slots(&mut self, num_slots: u32) -> &mut Self {
-        self.num_slots = num_slots;
-        self
-    }
 }

 #[async_trait]
@@ -383,7 +385,7 @@ impl ToQemuParams for Cpu {
 /// Error type for CCW Subchannel operations
 #[derive(Debug)]
 #[allow(dead_code)]
-pub enum CcwError {
+enum CcwError {
    DeviceAlreadyExists(String), // Error when trying to add an existing device
    #[allow(dead_code)]
    DeviceNotFound(String), // Error when trying to remove a nonexistent device
@@ -414,7 +416,7 @@ impl CcwSubChannel {
    /// # Returns
    /// - `Result<u32, CcwError>`: slot index of the added device
    ///   or an error if the device already exists
-    pub fn add_device(&mut self, dev_id: &str) -> Result<u32, CcwError> {
+    fn add_device(&mut self, dev_id: &str) -> Result<u32, CcwError> {
        if self.devices.contains_key(dev_id) {
            Err(CcwError::DeviceAlreadyExists(dev_id.to_owned()))
        } else {
@@ -433,7 +435,8 @@ impl CcwSubChannel {
    /// # Returns
    /// - `Result<(), CcwError>`: Ok(()) if the device was removed
    ///   or an error if the device was not found
-    pub fn remove_device(&mut self, dev_id: &str) -> Result<(), CcwError> {
+    #[allow(dead_code)]
+    fn remove_device(&mut self, dev_id: &str) -> Result<(), CcwError> {
        if self.devices.remove(dev_id).is_some() {
            Ok(())
        } else {
@@ -441,30 +444,17 @@ impl CcwSubChannel {
        }
    }

-    /// Formats the CCW address for a given slot.
-    /// Uses the 0xfe channel subsystem ID used by QEMU.
+    /// Formats the CCW address for a given slot
    ///
    /// # Arguments
    /// - `slot`: slot index
    ///
    /// # Returns
    /// - `String`: formatted CCW address (e.g. `fe.0.0000`)
-    pub fn address_format_ccw(&self, slot: u32) -> String {
+    fn address_format_ccw(&self, slot: u32) -> String {
        format!("fe.{:x}.{:04x}", self.addr, slot)
    }

-    /// Formats the guest-visible CCW address for a given slot.
-    /// Uses channel subsystem ID 0 (guest perspective).
-    ///
-    /// # Arguments
-    /// - `slot`: slot index
-    ///
-    /// # Returns
-    /// - `String`: formatted guest-visible CCW address (e.g. `0.0.0000`)
-    pub fn address_format_ccw_for_virt_server(&self, slot: u32) -> String {
-        format!("0.{:x}.{:04x}", self.addr, slot)
-    }
-
    /// Sets the address of the subchannel.
    /// # Arguments
    /// - `addr`: subchannel address to set
@@ -1879,7 +1869,6 @@ struct ObjectSevSnpGuest {
    reduced_phys_bits: u32,
    kernel_hashes: bool,
    host_data: Option<String>,
-    policy: u32,
    is_snp: bool,
 }

@@ -1891,15 +1880,9 @@ impl ObjectSevSnpGuest {
            reduced_phys_bits,
            kernel_hashes: true,
            host_data,
-            policy: 0x30000,
            is_snp,
        }
    }
-
-    fn set_policy(&mut self, policy: u32) -> &mut Self {
-        self.policy = policy;
-        self
-    }
 }

 #[async_trait]
@@ -1922,7 +1905,6 @@ impl ToQemuParams for ObjectSevSnpGuest {
                "kernel-hashes={}",
                if self.kernel_hashes { "on" } else { "off" }
            ));
-            params.push(format!("policy=0x{:x}", self.policy));
            if let Some(host_data) = &self.host_data {
                params.push(format!("host-data={host_data}"))
            }
@@ -2285,12 +2267,6 @@ impl<'a> QemuCmdLine<'a> {
        Ok(qemu_cmd_line)
    }

-    /// Takes ownership of the CCW subchannel, leaving `None` in its place.
-    /// Used to transfer boot-time CCW state to Qmp for hotplug allocation.
-    pub fn take_ccw_subchannel(&mut self) -> Option<CcwSubChannel> {
-        self.ccw_subchannel.take()
-    }
-
    fn add_monitor(&mut self, proto: &str) -> Result<()> {
        let monitor = QmpSocket::new(self.id.as_str(), MonitorProtocol::new(proto))?;
        self.devices.push(Box::new(monitor));
@@ -2578,19 +2554,13 @@ impl<'a> QemuCmdLine<'a> {
        firmware: &str,
        host_data: &Option<String>,
    ) {
-        // For SEV-SNP, memory overcommit is not supported. we only set the memory size.
-        self.memory.set_maxmem_size(0).set_num_slots(0);
-
-        let mut sev_snp_object =
+        let sev_snp_object =
            ObjectSevSnpGuest::new(true, cbitpos, phys_addr_reduction, host_data.clone());
-        sev_snp_object.set_policy(self.config.security_info.snp_guest_policy);
-
        self.devices.push(Box::new(sev_snp_object));

        self.devices.push(Box::new(Bios::new(firmware.to_owned())));

        self.machine
-            .set_kernel_irqchip("split")
            .set_confidential_guest_support("snp")
            .set_nvdimm(false);

--- a/src/runtime-rs/crates/hypervisor/src/qemu/inner.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/inner.rs
@@ -10,7 +10,6 @@ use crate::qemu::qmp::get_qmp_socket_path;
 use crate::{
    device::driver::ProtectionDeviceConfig, hypervisor_persist::HypervisorState, selinux,
    HypervisorConfig, MemoryConfig, VcpuThreadIds, VsockDevice, HYPERVISOR_QEMU,
-    KATA_BLK_DEV_TYPE, KATA_CCW_DEV_TYPE, KATA_NVDIMM_DEV_TYPE, KATA_SCSI_DEV_TYPE,
 };

 use crate::utils::{
@@ -22,7 +21,7 @@ use anyhow::{anyhow, Context, Result};
 use async_trait::async_trait;
 use kata_sys_util::netns::NetnsGuard;
 use kata_types::build_path;
-use kata_types::config::hypervisor::{RootlessUser, VIRTIO_BLK_CCW};
+use kata_types::config::hypervisor::RootlessUser;
 use kata_types::rootless::is_rootless;
 use kata_types::{
    capabilities::{Capabilities, CapabilityBits},
@@ -134,18 +133,18 @@ impl QemuInner {
                        continue;
                    }
                    match block_dev.config.driver_option.as_str() {
-                        KATA_NVDIMM_DEV_TYPE => cmdline.add_nvdimm(
+                        "nvdimm" => cmdline.add_nvdimm(
                            &block_dev.config.path_on_host,
                            block_dev.config.is_readonly,
                        )?,
-                        KATA_CCW_DEV_TYPE | KATA_BLK_DEV_TYPE | KATA_SCSI_DEV_TYPE => cmdline.add_block_device(
+                        "ccw" | "blk" | "scsi" => cmdline.add_block_device(
                            block_dev.device_id.as_str(),
                            &block_dev.config.path_on_host,
                            block_dev
                                .config
                                .is_direct
                                .unwrap_or(self.config.blockdev_info.block_device_cache_direct),
-                            block_dev.config.driver_option.as_str() == KATA_SCSI_DEV_TYPE,
+                            block_dev.config.driver_option.as_str() == "scsi",
                        )?,
                        unsupported => {
                            info!(sl!(), "unsupported block device driver: {}", unsupported)
@@ -286,12 +285,7 @@ impl QemuInner {
        let qmp_socket_path = get_qmp_socket_path(self.id.as_str());

        match Qmp::new(&qmp_socket_path) {
-            Ok(mut qmp) => {
-                if let Some(subchannel) = cmdline.take_ccw_subchannel() {
-                    qmp.set_ccw_subchannel(subchannel);
-                }
-                self.qmp = Some(qmp);
-            }
+            Ok(qmp) => self.qmp = Some(qmp),
            Err(e) => {
                error!(sl!(), "couldn't initialise QMP: {:?}", e);
                return Err(e);
@@ -848,10 +842,9 @@ impl QemuInner {
                qmp.hotplug_network_device(&netdev, &virtio_net_device)?
            }
            DeviceType::Block(mut block_device) => {
-                let block_driver = &self.config.blockdev_info.block_device_driver;
-                let (pci_path, addr_str) = qmp
+                let (pci_path, scsi_addr) = qmp
                    .hotplug_block_device(
-                        block_driver,
+                        &self.config.blockdev_info.block_device_driver,
                        block_device.config.index,
                        &block_device.config.path_on_host,
                        &block_device.config.blkdev_aio.to_string(),
@@ -864,12 +857,8 @@ impl QemuInner {
                if pci_path.is_some() {
                    block_device.config.pci_path = pci_path;
                }
-                if let Some(addr) = addr_str {
-                    if block_driver == VIRTIO_BLK_CCW {
-                        block_device.config.ccw_addr = Some(addr);
-                    } else {
-                        block_device.config.scsi_addr = Some(addr);
-                    }
+                if scsi_addr.is_some() {
+                    block_device.config.scsi_addr = scsi_addr;
                }

                return Ok(DeviceType::Block(block_device));
--- a/src/runtime-rs/crates/hypervisor/src/qemu/qmp.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/qmp.rs
@@ -4,12 +4,12 @@
 //

 use crate::device::pci_path::PciPath;
-use crate::qemu::cmdline_generator::{CcwSubChannel, DeviceVirtioNet, Netdev, QMP_SOCKET_FILE};
+use crate::qemu::cmdline_generator::{DeviceVirtioNet, Netdev, QMP_SOCKET_FILE};
 use crate::utils::get_jailer_root;
 use crate::VcpuThreadIds;

 use anyhow::{anyhow, Context, Result};
-use kata_types::config::hypervisor::{VIRTIO_BLK_CCW, VIRTIO_SCSI};
+use kata_types::config::hypervisor::VIRTIO_SCSI;
 use kata_types::rootless::is_rootless;
 use nix::sys::socket::{sendmsg, ControlMessage, MsgFlags};
 use qapi_qmp::{
@@ -50,11 +50,6 @@ pub struct Qmp {
    // blocks seem ever to be onlined in the guest by kata-agent.
    // Store as u64 to keep up the convention of bytes being represented as u64.
    guest_memory_block_size: u64,
-
-    // CCW subchannel for s390x device address management.
-    // Transferred from QemuCmdLine after boot so that hotplug allocations
-    // continue from where boot-time allocations left off.
-    ccw_subchannel: Option<CcwSubChannel>,
 }

 // We have to implement Debug since the Hypervisor trait requires it and Qmp
@@ -81,7 +76,6 @@ impl Qmp {
                    stream,
                )),
                guest_memory_block_size: 0,
-                ccw_subchannel: None,
            };

            let info = qmp.qmp.handshake().context("qmp handshake failed")?;
@@ -108,10 +102,6 @@ impl Qmp {
            .with_context(|| format!("timed out waiting for QMP ready: {}", qmp_sock_path))
    }

-    pub fn set_ccw_subchannel(&mut self, subchannel: CcwSubChannel) {
-        self.ccw_subchannel = Some(subchannel);
-    }
-
    pub fn set_ignore_shared_memory_capability(&mut self) -> Result<()> {
        self.qmp
            .execute(&migrate_set_capabilities {
@@ -615,13 +605,6 @@ impl Qmp {
    /// {"execute":"device_add","arguments":{"driver":"scsi-hd","drive":"virtio-scsi0","id":"scsi_device_0","bus":"virtio-scsi1.0"}}
    /// {"return": {}}
    ///
-    /// Hotplug virtio-blk-ccw block device on s390x
-    /// # virtio-blk-ccw0
-    /// {"execute":"blockdev_add", "arguments": {"file":"/path/to/block.image","format":"qcow2","id":"virtio-blk-ccw0"}}
-    /// {"return": {}}
-    /// {"execute":"device_add","arguments":{"driver":"virtio-blk-ccw","id":"virtio-blk-ccw0","drive":"virtio-blk-ccw0","devno":"fe.0.0005","share-rw":true}}
-    /// {"return": {}}
-    ///
    #[allow(clippy::too_many_arguments)]
    pub fn hotplug_block_device(
        &mut self,
@@ -728,14 +711,6 @@ impl Qmp {
            blkdev_add_args.insert("lun".to_string(), lun.into());
            blkdev_add_args.insert("share-rw".to_string(), true.into());

-            info!(
-                sl!(),
-                "hotplug_block_device(): device_add arguments: bus: {}, id: {}, driver: {}, blkdev_add_args: {:#?}",
-                "scsi0.0",
-                node_name,
-                "scsi-hd",
-                blkdev_add_args
-            );
            self.qmp
                .execute(&qmp::device_add {
                    bus: Some("scsi0.0".to_string()),
@@ -752,60 +727,11 @@ impl Qmp {
            );

            Ok((None, Some(scsi_addr)))
-        } else if block_driver == VIRTIO_BLK_CCW {
-            let subchannel = self
-                .ccw_subchannel
-                .as_mut()
-                .ok_or_else(|| anyhow!("CCW subchannel not available for virtio-blk-ccw hotplug"))?;
-
-            let slot = subchannel
-                .add_device(&node_name)
-                .map_err(|e| anyhow!("CCW subchannel add_device failed: {:?}", e))?;
-            let devno = subchannel.address_format_ccw(slot);
-            let ccw_addr = subchannel.address_format_ccw_for_virt_server(slot);
-
-            blkdev_add_args.insert("devno".to_owned(), devno.clone().into());
-            blkdev_add_args.insert("share-rw".to_string(), true.into());
-
-            info!(
-                sl!(),
-                "hotplug_block_device(): CCW device_add: id: {}, driver: {}, blkdev_add_args: {:#?}, ccw_addr: {}",
-                node_name,
-                block_driver,
-                blkdev_add_args,
-                ccw_addr
-            );
-            let device_add_result = self.qmp.execute(&qmp::device_add {
-                bus: None,
-                id: Some(node_name.clone()),
-                driver: block_driver.to_string(),
-                arguments: blkdev_add_args,
-            });
-            if let Err(e) = device_add_result {
-                // Roll back CCW subchannel state if QMP device_add fails
-                let _ = subchannel.remove_device(&node_name);
-                return Err(anyhow!("device_add {:?}", e));
-            }
-
-            info!(
-                sl!(),
-                "hotplug CCW block device return ccw address: {:?}", &ccw_addr
-            );
-
-            Ok((None, Some(ccw_addr)))
        } else {
            let (bus, slot) = self.find_free_slot()?;
            blkdev_add_args.insert("addr".to_owned(), format!("{slot:02}").into());
            blkdev_add_args.insert("share-rw".to_string(), true.into());

-            info!(
-                sl!(),
-                "hotplug_block_device(): device_add arguments: bus: {}, id: {}, driver: {}, blkdev_add_args: {:#?}",
-                bus,
-                node_name,
-                block_driver,
-                blkdev_add_args
-            );
            self.qmp
                .execute(&qmp::device_add {
                    bus: Some(bus),
--- a/src/runtime-rs/crates/persist/Cargo.toml
+++ b/src/runtime-rs/crates/persist/Cargo.toml
@@ -8,10 +8,12 @@ license = { workspace = true }
 [dependencies]
 async-trait = { workspace = true }
 anyhow = { workspace = true }
+libc = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

 # Local dependencies
 kata-sys-util = { workspace = true }
 kata-types = { workspace = true }
+shim-interface = { workspace = true }
 safe-path = { workspace = true }
--- a/src/runtime-rs/crates/resource/Cargo.toml
+++ b/src/runtime-rs/crates/resource/Cargo.toml
@@ -15,6 +15,7 @@ test-utils = { workspace = true }
 actix-rt = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
+bitflags = "2.9.0"
 byte-unit = "5.1.6"
 cgroups-rs = { version = "0.5.0", features = ["oci"] }
 futures = "0.3.11"
@@ -40,6 +41,7 @@ hex = "0.4"

 ## Dependencies from `rust-netlink`
 netlink-packet-route = "0.26"
+netlink-sys = "0.8"
 rtnetlink = "0.19"

 # Local dependencies
@@ -52,7 +54,3 @@ persist = { workspace = true }
 tests_utils = { workspace = true }

 [features]
-
-
-[package.metadata.cargo-machete]
-ignored = ["slog-scope"]
--- a/src/runtime-rs/crates/resource/src/manager_inner.rs
+++ b/src/runtime-rs/crates/resource/src/manager_inner.rs
@@ -429,16 +429,14 @@ impl ResourceManagerInner {
                        .await
                        .context("do handle device")?;

-                    // create block device for kata agent.
-                    // The device ID is derived from the available address: PCI, SCSI,
-                    // CCW, or virtual path, depending on the driver and configuration.
+                    // create block device for kata agent,
+                    // if driver is virtio-blk-pci, the id will be pci address.
                    if let DeviceType::Block(device) = device_info {
+                        // The following would work for drivers virtio-blk-pci and virtio-mmio and virtio-scsi.
                        let id = if let Some(pci_path) = device.config.pci_path {
                            pci_path.to_string()
                        } else if let Some(scsi_address) = device.config.scsi_addr {
                            scsi_address
-                        } else if let Some(ccw_addr) = device.config.ccw_addr {
-                            ccw_addr
                        } else {
                            device.config.virt_path.clone()
                        };
--- a/src/runtime-rs/crates/resource/src/rootfs/block_rootfs.rs
+++ b/src/runtime-rs/crates/resource/src/rootfs/block_rootfs.rs
@@ -100,13 +100,7 @@ impl BlockRootfs {
                VIRTIO_BLK_MMIO => {
                    storage.source = device.config.virt_path;
                }
-                VIRTIO_BLK_CCW => {
-                    storage.source = device
-                        .config
-                        .ccw_addr
-                        .ok_or_else(|| anyhow!("CCW address missing for ccw block device"))?;
-                }
-                VIRTIO_SCSI | VIRTIO_PMEM => {
+                VIRTIO_SCSI | VIRTIO_BLK_CCW | VIRTIO_PMEM => {
                    return Err(anyhow!(
                        "Complete support for block driver {} has not been implemented yet",
                        block_driver
--- a/src/runtime-rs/crates/resource/src/volume/utils.rs
+++ b/src/runtime-rs/crates/resource/src/volume/utils.rs
@@ -15,10 +15,6 @@ use crate::{
 };
 use anyhow::{anyhow, Context, Result};
 use kata_sys_util::mount::{get_mount_options, get_mount_path};
-use kata_types::device::{
-    DRIVER_BLK_CCW_TYPE as KATA_CCW_DEV_TYPE, DRIVER_BLK_PCI_TYPE as KATA_BLK_DEV_TYPE,
-    DRIVER_SCSI_TYPE as KATA_SCSI_DEV_TYPE,
-};
 use oci_spec::runtime as oci;

 use hypervisor::device::DeviceType;
@@ -26,6 +22,9 @@ use hypervisor::device::DeviceType;
 pub const DEFAULT_VOLUME_FS_TYPE: &str = "ext4";
 pub const KATA_MOUNT_BIND_TYPE: &str = "bind";

+pub const KATA_BLK_DEV_TYPE: &str = "blk";
+pub const KATA_SCSI_DEV_TYPE: &str = "scsi";
+
 pub fn get_file_name<P: AsRef<Path>>(src: P) -> Result<String> {
    let file_name = src
        .as_ref()
@@ -105,13 +104,6 @@ pub async fn handle_block_volume(
                    return Err(anyhow!("block driver is scsi but no scsi address exists"));
                }
            }
-            KATA_CCW_DEV_TYPE => {
-                if let Some(ccw_addr) = device.config.ccw_addr {
-                    ccw_addr.to_string()
-                } else {
-                    return Err(anyhow!("block driver is ccw but no ccw address exists"));
-                }
-            }
            _ => device.config.virt_path,
        };
        device_id = device.device_id;
--- a/src/runtime-rs/crates/runtimes/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/Cargo.toml
@@ -26,6 +26,7 @@ opentelemetry-jaeger = { version = "0.17.0", features = [
 ] }
 tracing-subscriber = { version = "0.3", features = ["registry", "std"] }
 hyper = { workspace = true, features = ["stream", "server", "http1"] }
+hyperlocal = { workspace = true }
 serde_json = { workspace = true }
 nix = "0.25.0"
 url = { workspace = true }
--- a/src/runtime-rs/crates/runtimes/common/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/common/Cargo.toml
@@ -11,14 +11,20 @@ license = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 containerd-shim-protos = { workspace = true, features = ["sandbox"] }
+lazy_static = { workspace = true }
 nix = { workspace = true }
 protobuf = { workspace = true }
+serde_json = { workspace = true }
+slog = { workspace = true }
+slog-scope = { workspace = true }
 strum = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "process", "fs"] }
+ttrpc = { workspace = true }
 oci-spec = { workspace = true }

 # Local dependencies
+persist = { workspace = true }
 agent = { workspace = true }
 kata-sys-util = { workspace = true }
 kata-types = { workspace = true }
--- a/src/runtime-rs/crates/runtimes/virt_container/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/virt_container/Cargo.toml
@@ -10,6 +10,8 @@ anyhow = { workspace = true }
 async-trait = { workspace = true }
 awaitgroup = "0.6.0"
 containerd-shim-protos = { workspace = true }
+futures = "0.3.19"
+lazy_static = { workspace = true }
 libc = { workspace = true }
 nix = { workspace = true }
 protobuf = { workspace = true }
@@ -19,7 +21,9 @@ serde_json = { workspace = true }
 slog = { workspace = true }
 slog-scope = { workspace = true }
 tokio = { workspace = true }
+toml = "0.4.2"
 url = { workspace = true }
+async-std = "1.12.0"
 tracing = { workspace = true }
 oci-spec = { workspace = true }
 strum = { workspace = true }
@@ -44,7 +48,3 @@ cloud-hypervisor = ["hypervisor/cloud-hypervisor"]

 # Enable the build-in VMM Dragtonball
 dragonball = ["hypervisor/dragonball"]
-
-
-[package.metadata.cargo-machete]
-ignored = ["slog-scope"]
--- a/src/runtime-rs/crates/service/Cargo.toml
+++ b/src/runtime-rs/crates/service/Cargo.toml
@@ -11,6 +11,7 @@ async-trait = { workspace = true }
 slog = { workspace = true }
 slog-scope = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread"] }
+tracing = { workspace = true }
 ttrpc = { workspace = true }
 containerd-shim-protos = { workspace = true, features = ["async", "sandbox"] }
 containerd-shim = { workspace = true }
@@ -20,7 +21,4 @@ common = { workspace = true }
 logging = { workspace = true }
 kata-types = { workspace = true }
 runtimes = { workspace = true }
-
-
-[package.metadata.cargo-machete]
-ignored = ["slog-scope"]
+persist = { workspace = true }
--- a/src/runtime-rs/crates/shim-ctl/Cargo.toml
+++ b/src/runtime-rs/crates/shim-ctl/Cargo.toml
@@ -9,8 +9,9 @@ license = { workspace = true }

 [dependencies]
 anyhow = { workspace = true }
-tokio = { workspace = true, features = ["rt", "rt-multi-thread"] }
+tokio = { workspace = true, features = [ "rt", "rt-multi-thread" ] }

 # Local dependencies
 common = { workspace = true }
+logging = { workspace = true }
 runtimes = { workspace = true }
--- a/src/runtime-rs/crates/shim/Cargo.toml
+++ b/src/runtime-rs/crates/shim/Cargo.toml
@@ -36,6 +36,8 @@ slog-stdlog = "4.1.0"
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["rt", "rt-multi-thread"] }
 unix_socket2 = "0.5.4"
+tracing = { workspace = true }
+tracing-opentelemetry = { workspace = true }
 oci-spec = { workspace = true }

 # Local dependencies
@@ -44,7 +46,12 @@ kata-sys-util = { workspace = true }
 logging = { workspace = true }
 runtime-spec = { workspace = true }
 service = { workspace = true }
+runtimes = { workspace = true }

 [dev-dependencies]
 tempfile = { workspace = true }
+rand = { workspace = true }
 serial_test = "0.10.0"
+
+# Local dev-dependencies
+tests_utils = { workspace = true }
--- a/src/runtime/Makefile
+++ b/src/runtime/Makefile
@@ -220,7 +220,7 @@ DEFBRIDGES := 1
 DEFENABLEANNOTATIONS := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\"]
 DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
 DEFDISABLEGUESTSECCOMP := true
-DEFDISABLEGUESTEMPTYDIR := false
+DEFDISABLEGUESTEMPTYDIR := true
 #Default experimental features enabled
 DEFAULTEXPFEATURES := []

@@ -272,7 +272,6 @@ DEFVIRTIOFSEXTRAARGS ?= [\"--thread-pool-size=1\", \"--announce-submounts\"]
 DEFENABLEIOTHREADS := false
 DEFINDEPIOTHREADS := 0
 DEFENABLEVHOSTUSERSTORE := false
-DEFENABLEVIRTIOMEM ?= false
 DEFVHOSTUSERSTOREPATH := $(PKGRUNDIR)/vhost-user
 DEFVALIDVHOSTUSERSTOREPATHS := [\"$(DEFVHOSTUSERSTOREPATH)\"]
 DEFFILEMEMBACKEND := ""
@@ -289,7 +288,6 @@ DEFSTATICRESOURCEMGMT_NV = true

 DEFDISABLEIMAGENVDIMM ?= false
 DEFDISABLEIMAGENVDIMM_NV = true
-DEFDISABLEIMAGENVDIMM_CLH ?= true

 DEFBINDMOUNTS := []

@@ -765,7 +763,6 @@ USER_VARS += DEFENABLEANNOTATIONS
 USER_VARS += DEFENABLEANNOTATIONS_COCO
 USER_VARS += DEFENABLEIOTHREADS
 USER_VARS += DEFINDEPIOTHREADS
-USER_VARS += DEFENABLEVIRTIOMEM
 USER_VARS += DEFSECCOMPSANDBOXPARAM
 USER_VARS += DEFENABLEVHOSTUSERSTORE
 USER_VARS += DEFVHOSTUSERSTOREPATH
@@ -791,7 +788,6 @@ USER_VARS += DEFVFIOMODE_SE
 USER_VARS += BUILDFLAGS
 USER_VARS += DEFDISABLEIMAGENVDIMM
 USER_VARS += DEFDISABLEIMAGENVDIMM_NV
-USER_VARS += DEFDISABLEIMAGENVDIMM_CLH
 USER_VARS += DEFCCAMEASUREMENTALGO
 USER_VARS += DEFSHAREDFS_QEMU_CCA_VIRTIOFS
 USER_VARS += DEFPODRESOURCEAPISOCK
--- a/src/runtime/arch/s390x-options.mk
+++ b/src/runtime/arch/s390x-options.mk
@@ -18,6 +18,3 @@ ifneq (,$(NEEDS_CC_SETTING))
 	CC := gcc
 	export CC
 endif
-
-# Enable virtio-mem for s390x
-DEFENABLEVIRTIOMEM = true
--- a/src/runtime/cmd/kata-monitor/main.go
+++ b/src/runtime/cmd/kata-monitor/main.go
@@ -196,7 +196,7 @@ func indexPageText(w http.ResponseWriter, r *http.Request) {
 	formatter := fmt.Sprintf("%%-%ds: %%s\n", spacing)

 	for _, endpoint := range endpoints {
-		fmt.Fprintf(w, formatter, endpoint.path, endpoint.desc)
+		w.Write([]byte(fmt.Sprintf(formatter, endpoint.path, endpoint.desc)))
 	}
 }

--- a/src/runtime/cmd/kata-runtime/kata-check_amd64.go
+++ b/src/runtime/cmd/kata-runtime/kata-check_amd64.go
@@ -63,7 +63,7 @@ func setCPUtype(hypervisorType vc.HypervisorType) error {
 	cpuType = getCPUtype()

 	if cpuType == cpuTypeUnknown {
-		return fmt.Errorf("Unknown CPU Type")
+		return fmt.Errorf("Unknow CPU Type")
 	} else if cpuType == cpuTypeIntel {
 		var kvmIntelParams map[string]string
 		onVMM, err := vc.RunningOnVMM(procCPUInfo)
--- a/src/runtime/cmd/kata-runtime/kata-check_amd64_test.go
+++ b/src/runtime/cmd/kata-runtime/kata-check_amd64_test.go
@@ -55,17 +55,18 @@ func TestCCCheckCLIFunction(t *testing.T) {
 	var moduleData []testModuleData

 	cpuType = getCPUtype()
-	moduleData = []testModuleData{}
-
-	switch cpuType {
-	case cpuTypeIntel:
+	if cpuType == cpuTypeIntel {
 		cpuData = []testCPUData{
 			{archGenuineIntel, "lm vmx sse4_1", false},
 		}
-	case cpuTypeAMD:
+
+		moduleData = []testModuleData{}
+	} else if cpuType == cpuTypeAMD {
 		cpuData = []testCPUData{
 			{archAuthenticAMD, "lm svm sse4_1", false},
 		}
+
+		moduleData = []testModuleData{}
 	}

 	genericCheckCLIFunction(t, cpuData, moduleData)
@@ -275,8 +276,7 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 	var moduleData []testModuleData
 	cpuType = getCPUtype()

-	switch cpuType {
-	case cpuTypeIntel:
+	if cpuType == cpuTypeIntel {
 		cpuData = []testCPUData{
 			{"", "", true},
 			{"Intel", "", true},
@@ -292,7 +292,7 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 			{filepath.Join(sysModuleDir, "kvm_intel/parameters/nested"), "Y", false},
 			{filepath.Join(sysModuleDir, "kvm_intel/parameters/unrestricted_guest"), "Y", false},
 		}
-	case cpuTypeAMD:
+	} else if cpuType == cpuTypeAMD {
 		cpuData = []testCPUData{
 			{"", "", true},
 			{"AMD", "", true},
@@ -340,7 +340,7 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 		// Write the following into the denylist file
 		// blacklist <mod>
 		// install <mod> /bin/false
-		_, err = fmt.Fprintf(denylistFile, "blacklist %s\ninstall %s /bin/false\n", mod, mod)
+		_, err = denylistFile.WriteString(fmt.Sprintf("blacklist %s\ninstall %s /bin/false\n", mod, mod))
 		assert.Nil(err)
 	}
 	denylistFile.Close()
@@ -348,15 +348,6 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {

 	defer func() {
 		os.Remove(denylistModuleConf)
-		// reload removed modules
-		for mod := range archRequiredKernelModules {
-			cmd := exec.Command(modProbeCmd, mod)
-			if output, err := cmd.CombinedOutput(); err == nil {
-				kataLog.WithField("output", string(output)).Info("module loaded")
-			} else {
-				kataLog.WithField("output", string(output)).Warn("failed to load module")
-			}
-		}
 	}()

 	// remove the modules to force a failure
@@ -505,10 +496,9 @@ func TestSetCPUtype(t *testing.T) {
 	assert.NotEmpty(archRequiredKernelModules)

 	cpuType = getCPUtype()
-	switch cpuType {
-	case cpuTypeIntel:
+	if cpuType == cpuTypeIntel {
 		assert.Equal(archRequiredCPUFlags["vmx"], "Virtualization support")
-	case cpuTypeAMD:
+	} else if cpuType == cpuTypeAMD {
 		assert.Equal(archRequiredCPUFlags["svm"], "Virtualization support")
 	}

--- a/src/runtime/cmd/kata-runtime/kata-check_test.go
+++ b/src/runtime/cmd/kata-runtime/kata-check_test.go
@@ -17,6 +17,7 @@ import (
 	"testing"

 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katatestutils"
+	ktu "github.com/kata-containers/kata-containers/src/runtime/pkg/katatestutils"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils"
 	vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	"github.com/sirupsen/logrus"
@@ -508,7 +509,7 @@ func TestCheckCheckCPUAttribs(t *testing.T) {
 }

 func TestCheckHaveKernelModule(t *testing.T) {
-	if tc.NotValid(katatestutils.NeedRoot()) {
+	if tc.NotValid(ktu.NeedRoot()) {
 		t.Skip(testDisabledAsNonRoot)
 	}

@@ -637,8 +638,8 @@ func TestCheckCheckKernelModules(t *testing.T) {
 func TestCheckCheckKernelModulesUnreadableFile(t *testing.T) {
 	assert := assert.New(t)

-	if tc.NotValid(katatestutils.NeedNonRoot()) {
-		t.Skip(katatestutils.TestDisabledNeedNonRoot)
+	if tc.NotValid(ktu.NeedNonRoot()) {
+		t.Skip(ktu.TestDisabledNeedNonRoot)
 	}

 	dir := t.TempDir()
--- a/src/runtime/cmd/kata-runtime/kata-env_amd64_test.go
+++ b/src/runtime/cmd/kata-runtime/kata-env_amd64_test.go
@@ -56,10 +56,9 @@ func TestEnvGetEnvInfoSetsCPUType(t *testing.T) {
 	assert.NotEmpty(archRequiredKernelModules)

 	cpuType = getCPUtype()
-	switch cpuType {
-	case cpuTypeIntel:
+	if cpuType == cpuTypeIntel {
 		assert.Equal(archRequiredCPUFlags["vmx"], "Virtualization support")
-	case cpuTypeAMD:
+	} else if cpuType == cpuTypeAMD {
 		assert.Equal(archRequiredCPUFlags["svm"], "Virtualization support")
 	}

--- a/src/runtime/cmd/kata-runtime/kata-env_test.go
+++ b/src/runtime/cmd/kata-runtime/kata-env_test.go
@@ -14,6 +14,7 @@ import (
 	"path"
 	"path/filepath"
 	"runtime"
+	goruntime "runtime"
 	"strings"
 	"testing"

@@ -183,7 +184,7 @@ func genericGetExpectedHostDetails(tmpdir string, expectedVendor string, expecte
 	}

 	const expectedKernelVersion = "99.1"
-	const expectedArch = runtime.GOARCH
+	const expectedArch = goruntime.GOARCH

 	expectedDistro := DistroInfo{
 		Name:    "Foo",
@@ -253,7 +254,7 @@ VERSION_ID="%s"
 		}
 	}

-	if runtime.GOARCH == "arm64" {
+	if goruntime.GOARCH == "arm64" {
 		expectedHostDetails.CPU.Vendor = "ARM Limited"
 		expectedHostDetails.CPU.Model = "v8"
 	}
--- a/src/runtime/cmd/kata-runtime/kata-iptables.go
+++ b/src/runtime/cmd/kata-runtime/kata-iptables.go
@@ -55,9 +55,9 @@ var getIPTablesCommand = cli.Command{
 			return err
 		}

-		url := containerdshim.IPTablesURL
+		url := containerdshim.IPTablesUrl
 		if isIPv6 {
-			url = containerdshim.IP6TablesURL
+			url = containerdshim.IP6TablesUrl
 		}
 		body, err := shimclient.DoGet(sandboxID, defaultTimeout, url)
 		if err != nil {
@@ -108,9 +108,9 @@ var setIPTablesCommand = cli.Command{
 			return err
 		}

-		url := containerdshim.IPTablesURL
+		url := containerdshim.IPTablesUrl
 		if isIPv6 {
-			url = containerdshim.IP6TablesURL
+			url = containerdshim.IP6TablesUrl
 		}

 		if err = shimclient.DoPut(sandboxID, defaultTimeout, url, "application/octet-stream", buf); err != nil {
--- a/src/runtime/cmd/kata-runtime/kata-policy.go
+++ b/src/runtime/cmd/kata-runtime/kata-policy.go
@@ -62,7 +62,7 @@ var setPolicyCommand = cli.Command{
 			return err
 		}

-		url := containerdshim.PolicyURL
+		url := containerdshim.PolicyUrl

 		if err = shimclient.DoPut(sandboxID, defaultTimeout, url, "application/octet-stream", buf); err != nil {
 			return fmt.Errorf("Error observed when making policy-set request(%s): %s", policyFile, err)
--- a/src/runtime/cmd/kata-runtime/kata-volume.go
+++ b/src/runtime/cmd/kata-runtime/kata-volume.go
@@ -126,7 +126,7 @@ var resizeCommand = cli.Command{

 // Stats retrieves the filesystem stats of the direct volume inside the guest.
 func Stats(volumePath string) ([]byte, error) {
-	sandboxID, err := volume.GetSandboxIDForVolume(volumePath)
+	sandboxId, err := volume.GetSandboxIdForVolume(volumePath)
 	if err != nil {
 		return nil, err
 	}
@@ -136,8 +136,8 @@ func Stats(volumePath string) ([]byte, error) {
 	}

 	urlSafeDevicePath := url.PathEscape(volumeMountInfo.Device)
-	body, err := shimclient.DoGet(sandboxID, defaultTimeout,
-		fmt.Sprintf("%s?%s=%s", containerdshim.DirectVolumeStatURL, containerdshim.DirectVolumePathKey, urlSafeDevicePath))
+	body, err := shimclient.DoGet(sandboxId, defaultTimeout,
+		fmt.Sprintf("%s?%s=%s", containerdshim.DirectVolumeStatUrl, containerdshim.DirectVolumePathKey, urlSafeDevicePath))
 	if err != nil {
 		return nil, err
 	}
@@ -146,7 +146,7 @@ func Stats(volumePath string) ([]byte, error) {

 // Resize resizes a direct volume inside the guest.
 func Resize(volumePath string, size uint64) error {
-	sandboxID, err := volume.GetSandboxIDForVolume(volumePath)
+	sandboxId, err := volume.GetSandboxIdForVolume(volumePath)
 	if err != nil {
 		return err
 	}
@@ -163,5 +163,5 @@ func Resize(volumePath string, size uint64) error {
 	if err != nil {
 		return err
 	}
-	return shimclient.DoPost(sandboxID, defaultTimeout, containerdshim.DirectVolumeResizeURL, "application/json", encoded)
+	return shimclient.DoPost(sandboxId, defaultTimeout, containerdshim.DirectVolumeResizeUrl, "application/json", encoded)
 }
--- a/src/runtime/cmd/kata-runtime/release.go
+++ b/src/runtime/cmd/kata-runtime/release.go
@@ -94,12 +94,11 @@ func releaseURLIsValid(url string) error {
 func getReleaseURL(currentVersion semver.Version) (url string, err error) {
 	major := currentVersion.Major

-	switch major {
-	case 0:
+	if major == 0 {
 		return "", fmt.Errorf("invalid current version: %v", currentVersion)
-	case 1:
+	} else if major == 1 {
 		url = kataLegacyReleaseURL
-	default:
+	} else {
 		url = kataReleaseURL
 	}

--- a/src/runtime/config/configuration-clh.toml.in
+++ b/src/runtime/config/configuration-clh.toml.in
@@ -222,8 +222,8 @@ hypervisor_loglevel = 1
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
 #
-# nvdimm is not supported with Cloud Hypervisor or when `confidential_guest = true`.
-disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM_CLH@
+# nvdimm is not supported when `confidential_guest = true`.
+disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@

 # Enable hot-plugging of VFIO devices to a root-port.
 # The default setting is  "no-port"
--- a/src/runtime/config/configuration-qemu.toml.in
+++ b/src/runtime/config/configuration-qemu.toml.in
@@ -142,7 +142,7 @@ memory_offset = 0
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = @DEFENABLEVIRTIOMEM@
+enable_virtio_mem = false

 # Disable hotplugging host block devices to guest VMs for container rootfs.
 # In case of a storage driver like devicemapper where a container's
--- a/src/runtime/go.mod
+++ b/src/runtime/go.mod
@@ -8,7 +8,7 @@ go 1.24.13

 require (
 	code.cloudfoundry.org/bytefmt v0.0.0-20211005130812-5bb3c17173e5
-	github.com/BurntSushi/toml v1.6.0
+	github.com/BurntSushi/toml v1.5.0
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/blang/semver/v4 v4.0.0
 	github.com/container-orchestrated-devices/container-device-interface v0.6.0
@@ -26,7 +26,7 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-ini/ini v1.67.0
-	github.com/go-openapi/errors v0.22.6
+	github.com/go-openapi/errors v0.22.1
 	github.com/go-openapi/runtime v0.28.0
 	github.com/go-openapi/strfmt v0.23.0
 	github.com/go-openapi/swag v0.23.1
--- a/src/runtime/go.sum
+++ b/src/runtime/go.sum
@@ -8,9 +8,8 @@ github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 h1:59MxjQVfjXsBpLy+dbd2/ELV5ofnUkUZBvWSC85sheA=
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0/go.mod h1:OahwfttHWG6eJ0clwcfBAHoDI6X/LV/15hx/wlMZSrU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
-github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -107,8 +106,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
-github.com/go-openapi/errors v0.22.6 h1:eDxcf89O8odEnohIXwEjY1IB4ph5vmbUsBMsFNwXWPo=
-github.com/go-openapi/errors v0.22.6/go.mod h1:z9S8ASTUqx7+CP1Q8dD8ewGH/1JWFFLX/2PmAYNQLgk=
+github.com/go-openapi/errors v0.22.1 h1:kslMRRnK7NCb/CvR1q1VWuEQCEIsBGn5GgKD9e+HYhU=
+github.com/go-openapi/errors v0.22.1/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
@@ -123,8 +122,6 @@ github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMg
 github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
 github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
-github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
-github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
 github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
 github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
--- a/src/runtime/pkg/containerd-shim-v2/create.go
+++ b/src/runtime/pkg/containerd-shim-v2/create.go
@@ -40,6 +40,7 @@ import (
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils/katatrace"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/oci"
+	vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/compatoci"
 	"tags.cncf.io/container-device-interface/pkg/cdi"
 )
@@ -51,7 +52,7 @@ var defaultStartManagementServerFunc startManagementServerFunc = func(s *service
 	shimLog.Info("management server started")
 }

-func copyLayersToMounts(rootFs *virtcontainers.RootFs, spec *specs.Spec) error {
+func copyLayersToMounts(rootFs *vc.RootFs, spec *specs.Spec) error {
 	for _, o := range rootFs.Options {
 		if !strings.HasPrefix(o, annotations.FileSystemLayer) {
 			continue
@@ -74,7 +75,7 @@ func copyLayersToMounts(rootFs *virtcontainers.RootFs, spec *specs.Spec) error {
 }

 func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*container, error) {
-	rootFs := virtcontainers.RootFs{}
+	rootFs := vc.RootFs{}
 	if len(r.Rootfs) == 1 {
 		m := r.Rootfs[0]
 		rootFs.Source = m.Source
@@ -107,7 +108,7 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con
 	}

 	switch containerType {
-	case virtcontainers.PodSandbox, virtcontainers.SingleContainer:
+	case vc.PodSandbox, vc.SingleContainer:
 		if s.sandbox != nil {
 			return nil, fmt.Errorf("cannot create another sandbox in sandbox: %s", s.sandbox.ID())
 		}
@@ -150,7 +151,7 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con
 		//   2. If this is not a sandbox infrastructure container, but instead a standalone single container (analogous to "docker run..."),
 		//	then the container spec itself will contain appropriate sizing information for the entire sandbox (since it is
 		//	a single container.
-		if containerType == virtcontainers.PodSandbox {
+		if containerType == vc.PodSandbox {
 			s.config.SandboxCPUs, s.config.SandboxMemMB = oci.CalculateSandboxSizing(ociSpec)
 		} else {
 			s.config.SandboxCPUs, s.config.SandboxMemMB = oci.CalculateContainerSizing(ociSpec)
@@ -202,7 +203,7 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con
 			defaultStartManagementServerFunc(s, ctx, ociSpec)
 		}

-	case virtcontainers.PodContainer:
+	case vc.PodContainer:
 		span, ctx := katatrace.Trace(s.ctx, shimLog, "create", shimTracingTags)
 		defer span.End()

@@ -324,7 +325,7 @@ func checkAndMount(s *service, r *taskAPI.CreateTaskRequest) (bool, error) {
 			return false, nil
 		}

-		if virtcontainers.IsNydusRootFSType(m.Type) {
+		if vc.IsNydusRootFSType(m.Type) {
 			// if kata + nydus, do not mount
 			return false, nil
 		}
@@ -360,7 +361,7 @@ func doMount(mounts []*containerd_types.Mount, rootfs string) error {
 	return nil
 }

-func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxID string) error {
+func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxId string) error {
 	userName, err := utils.CreateVmmUser()
 	if err != nil {
 		return err
@@ -369,7 +370,7 @@ func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxID stri
 		if err != nil {
 			shimLog.WithFields(logrus.Fields{
 				"user_name":  userName,
-				"sandbox_id": sandboxID,
+				"sandbox_id": sandboxId,
 			}).WithError(err).Warn("configure non root hypervisor failed, delete the user")
 			if err2 := utils.RemoveVmmUser(userName); err2 != nil {
 				shimLog.WithField("userName", userName).WithError(err).Warn("failed to remove user")
@@ -397,7 +398,7 @@ func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxID stri
 		"user_name":  userName,
 		"uid":        uid,
 		"gid":        gid,
-		"sandbox_id": sandboxID,
+		"sandbox_id": sandboxId,
 	}).Debug("successfully created a non root user for the hypervisor")

 	userTmpDir := path.Join("/run/user/", fmt.Sprint(uid))
@@ -409,7 +410,7 @@ func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxID stri
 		}
 	}

-	if err = os.Mkdir(userTmpDir, virtcontainers.DirMode); err != nil {
+	if err = os.Mkdir(userTmpDir, vc.DirMode); err != nil {
 		return err
 	}
 	defer func() {
--- a/src/runtime/pkg/containerd-shim-v2/shim_management.go
+++ b/src/runtime/pkg/containerd-shim-v2/shim_management.go
@@ -34,13 +34,13 @@ import (

 const (
 	DirectVolumePathKey   = "path"
-	AgentURL              = "/agent-url"
-	DirectVolumeStatURL   = "/direct-volume/stats"
-	DirectVolumeResizeURL = "/direct-volume/resize"
-	IPTablesURL           = "/iptables"
-	PolicyURL             = "/policy"
-	IP6TablesURL          = "/ip6tables"
-	MetricsURL            = "/metrics"
+	AgentUrl              = "/agent-url"
+	DirectVolumeStatUrl   = "/direct-volume/stats"
+	DirectVolumeResizeUrl = "/direct-volume/resize"
+	IPTablesUrl           = "/iptables"
+	PolicyUrl             = "/policy"
+	IP6TablesUrl          = "/ip6tables"
+	MetricsUrl            = "/metrics"
 )

 var (
@@ -288,13 +288,13 @@ func (s *service) startManagementServer(ctx context.Context, ociSpec *specs.Spec

 	// bind handler
 	m := http.NewServeMux()
-	m.Handle(MetricsURL, http.HandlerFunc(s.serveMetrics))
-	m.Handle(AgentURL, http.HandlerFunc(s.agentURL))
-	m.Handle(DirectVolumeStatURL, http.HandlerFunc(s.serveVolumeStats))
-	m.Handle(DirectVolumeResizeURL, http.HandlerFunc(s.serveVolumeResize))
-	m.Handle(IPTablesURL, http.HandlerFunc(s.ipTablesHandler))
-	m.Handle(PolicyURL, http.HandlerFunc(s.policyHandler))
-	m.Handle(IP6TablesURL, http.HandlerFunc(s.ip6TablesHandler))
+	m.Handle(MetricsUrl, http.HandlerFunc(s.serveMetrics))
+	m.Handle(AgentUrl, http.HandlerFunc(s.agentURL))
+	m.Handle(DirectVolumeStatUrl, http.HandlerFunc(s.serveVolumeStats))
+	m.Handle(DirectVolumeResizeUrl, http.HandlerFunc(s.serveVolumeResize))
+	m.Handle(IPTablesUrl, http.HandlerFunc(s.ipTablesHandler))
+	m.Handle(PolicyUrl, http.HandlerFunc(s.policyHandler))
+	m.Handle(IP6TablesUrl, http.HandlerFunc(s.ip6TablesHandler))
 	s.mountPprofHandle(m, ociSpec)

 	// register shim metrics
@@ -373,7 +373,7 @@ func ClientSocketAddress(id string) (string, error) {
 	if _, err := os.Stat(socketPath); err != nil {
 		socketPath = SocketPathRust(id)
 		if _, err := os.Stat(socketPath); err != nil {
-			return "", fmt.Errorf("it fails to stat both %s and %s with error %v", SocketPathGo(id), SocketPathRust(id), err)
+			return "", fmt.Errorf("It fails to stat both %s and %s with error %v.", SocketPathGo(id), SocketPathRust(id), err)
 		}
 	}

--- a/src/runtime/pkg/device/drivers/vfio.go
+++ b/src/runtime/pkg/device/drivers/vfio.go
@@ -139,7 +139,7 @@ func (device *VFIODevice) Detach(ctx context.Context, devReceiver api.DeviceRece
 		}
 	}()

-	if device.DeviceInfo.ColdPlug {
+	if device.GenericDevice.DeviceInfo.ColdPlug {
 		// nothing to detach, device was cold plugged
 		deviceLogger().WithFields(logrus.Fields{
 			"device-group": device.DeviceInfo.HostPath,
@@ -264,7 +264,7 @@ func GetVFIODetails(deviceFileName, iommuDevicesPath string) (deviceBDF, deviceS
 // getMediatedBDF returns the BDF of a VF
 // Expected input string format is /sys/devices/pci0000:d7/BDF0/BDF1/.../MDEVBDF/UUID
 func getMediatedBDF(deviceSysfsDev string) string {
-	tokens := strings.Split(deviceSysfsDev, "/")
+	tokens := strings.SplitN(deviceSysfsDev, "/", -1)
 	if len(tokens) < 4 {
 		return ""
 	}
--- a/src/runtime/pkg/device/manager/manager.go
+++ b/src/runtime/pkg/device/manager/manager.go
@@ -59,11 +59,15 @@ func NewDeviceManager(blockDriver string, vhostUserStoreEnabled bool, vhostUserS
 		vhostUserReconnectTimeout: vhostUserReconnect,
 		devices:                   make(map[string]api.Device),
 	}
-
-	switch blockDriver {
-	case config.VirtioMmio, config.VirtioBlock, config.Nvdimm, config.VirtioBlockCCW:
-		dm.blockDriver = blockDriver
-	default:
+	if blockDriver == config.VirtioMmio {
+		dm.blockDriver = config.VirtioMmio
+	} else if blockDriver == config.VirtioBlock {
+		dm.blockDriver = config.VirtioBlock
+	} else if blockDriver == config.Nvdimm {
+		dm.blockDriver = config.Nvdimm
+	} else if blockDriver == config.VirtioBlockCCW {
+		dm.blockDriver = config.VirtioBlockCCW
+	} else {
 		dm.blockDriver = config.VirtioSCSI
 	}

--- a/src/runtime/pkg/direct-volume/utils.go
+++ b/src/runtime/pkg/direct-volume/utils.go
@@ -99,18 +99,18 @@ func VolumeMountInfo(volumePath string) (*MountInfo, error) {
 	return &mountInfo, nil
 }

-// RecordSandboxID associates a sandbox id with a direct volume.
-func RecordSandboxID(sandboxID string, volumePath string) error {
+// RecordSandboxId associates a sandbox id with a direct volume.
+func RecordSandboxId(sandboxId string, volumePath string) error {
 	encodedPath := b64.URLEncoding.EncodeToString([]byte(volumePath))
 	mountInfoFilePath := filepath.Join(kataDirectVolumeRootPath, encodedPath, mountInfoFileName)
 	if _, err := os.Stat(mountInfoFilePath); err != nil {
 		return err
 	}

-	return os.WriteFile(filepath.Join(kataDirectVolumeRootPath, encodedPath, sandboxID), []byte(""), 0600)
+	return os.WriteFile(filepath.Join(kataDirectVolumeRootPath, encodedPath, sandboxId), []byte(""), 0600)
 }

-func GetSandboxIDForVolume(volumePath string) (string, error) {
+func GetSandboxIdForVolume(volumePath string) (string, error) {
 	files, err := os.ReadDir(filepath.Join(kataDirectVolumeRootPath, b64.URLEncoding.EncodeToString([]byte(volumePath))))
 	if err != nil {
 		return "", err
--- a/src/runtime/pkg/direct-volume/utils_test.go
+++ b/src/runtime/pkg/direct-volume/utils_test.go
@@ -56,7 +56,7 @@ func TestAdd(t *testing.T) {
 	assert.Nil(t, err)
 }

-func TestRecordSandboxID(t *testing.T) {
+func TestRecordSandboxId(t *testing.T) {
 	var err error
 	kataDirectVolumeRootPath = t.TempDir()

@@ -73,22 +73,22 @@ func TestRecordSandboxID(t *testing.T) {
 	// Add the mount info
 	assert.Nil(t, Add(volumePath, string(buf)))

-	sandboxID := uuid.Generate().String()
-	err = RecordSandboxID(sandboxID, volumePath)
+	sandboxId := uuid.Generate().String()
+	err = RecordSandboxId(sandboxId, volumePath)
 	assert.Nil(t, err)

-	id, err := GetSandboxIDForVolume(volumePath)
+	id, err := GetSandboxIdForVolume(volumePath)
 	assert.Nil(t, err)
-	assert.Equal(t, sandboxID, id)
+	assert.Equal(t, sandboxId, id)
 }

-func TestRecordSandboxIDNoMountInfoFile(t *testing.T) {
+func TestRecordSandboxIdNoMountInfoFile(t *testing.T) {
 	var err error
 	kataDirectVolumeRootPath = t.TempDir()

 	var volumePath = "/a/b/c"
-	sandboxID := uuid.Generate().String()
-	err = RecordSandboxID(sandboxID, volumePath)
+	sandboxId := uuid.Generate().String()
+	err = RecordSandboxId(sandboxId, volumePath)
 	assert.Error(t, err)
 	assert.True(t, errors.Is(err, os.ErrNotExist))
 }
--- a/src/runtime/pkg/govmm/.github/workflows/main.yml
+++ b/src/runtime/pkg/govmm/.github/workflows/main.yml
@@ -14,11 +14,11 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Install Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: golangci-lint
--- a/src/runtime/pkg/govmm/qemu/qemu.go
+++ b/src/runtime/pkg/govmm/qemu/qemu.go
@@ -496,8 +496,8 @@ type TdxQomObject struct {
 	Debug                 *bool         `json:"debug,omitempty"`
 }

-func (s *SocketAddress) String() string {
-	b, err := json.Marshal(*s)
+func (this *SocketAddress) String() string {
+	b, err := json.Marshal(*this)

 	if err != nil {
 		log.Fatalf("Unable to marshal SocketAddress object: %s", err.Error())
@@ -507,8 +507,8 @@ func (s *SocketAddress) String() string {
 	return string(b)
 }

-func (t *TdxQomObject) String() string {
-	b, err := json.Marshal(*t)
+func (this *TdxQomObject) String() string {
+	b, err := json.Marshal(*this)

 	if err != nil {
 		log.Fatalf("Unable to marshal TDX QOM object: %s", err.Error())
--- a/src/runtime/pkg/govmm/qemu/qmp.go
+++ b/src/runtime/pkg/govmm/qemu/qmp.go
@@ -1446,18 +1446,11 @@ func (q *QMP) ExecMemdevAdd(ctx context.Context, qomtype, id, mempath string, si
 		"memdev": id,
 	}

-	var transport VirtioTransport
-	if transport.isVirtioCCW(nil) {
-		if addr != "" {
-			args["devno"] = addr
-		}
-	} else {
-		if bus != "" {
-			args["bus"] = bus
-		}
-		if addr != "" {
-			args["addr"] = addr
-		}
+	if bus != "" {
+		args["bus"] = bus
+	}
+	if addr != "" {
+		args["addr"] = addr
 	}

 	err = q.executeCommand(ctx, "device_add", args, nil)
--- a/src/runtime/pkg/kata-monitor/metrics.go
+++ b/src/runtime/pkg/kata-monitor/metrics.go
@@ -259,7 +259,7 @@ func (km *KataMonitor) aggregateSandboxMetrics(encoder expfmt.Encoder, filterFam
 }

 func getParsedMetrics(sandboxID string, sandboxMetadata sandboxCRIMetadata) ([]*dto.MetricFamily, error) {
-	body, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.MetricsURL)
+	body, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.MetricsUrl)
 	if err != nil {
 		return nil, err
 	}
@@ -269,7 +269,7 @@ func getParsedMetrics(sandboxID string, sandboxMetadata sandboxCRIMetadata) ([]*

 // GetSandboxMetrics will get sandbox's metrics from shim
 func GetSandboxMetrics(sandboxID string) (string, error) {
-	body, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.MetricsURL)
+	body, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.MetricsUrl)
 	if err != nil {
 		return "", err
 	}
--- a/src/runtime/pkg/kata-monitor/metrics_test.go
+++ b/src/runtime/pkg/kata-monitor/metrics_test.go
@@ -138,11 +138,9 @@ func TestEncodeMetricFamily(t *testing.T) {
 			continue
 		}
 		// only check kata_monitor_running_shim_count and kata_monitor_scrape_count
-		switch fields[0] {
-		case "kata_monitor_running_shim_count":
+		if fields[0] == "kata_monitor_running_shim_count" {
 			assert.Equal("11", fields[1], "kata_monitor_running_shim_count should be 11")
-
-		case "kata_monitor_scrape_count":
+		} else if fields[0] == "kata_monitor_scrape_count" {
 			assert.Equal("2", fields[1], "kata_monitor_scrape_count should be 2")
 		}
 	}
--- a/src/runtime/pkg/kata-monitor/monitor.go
+++ b/src/runtime/pkg/kata-monitor/monitor.go
@@ -184,7 +184,7 @@ func (km *KataMonitor) GetAgentURL(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	data, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.AgentURL)
+	data, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.AgentUrl)
 	if err != nil {
 		commonServeError(w, http.StatusBadRequest, err)
 		return
@@ -206,14 +206,14 @@ func (km *KataMonitor) ListSandboxes(w http.ResponseWriter, r *http.Request) {

 func listSandboxesText(sandboxes []string, w http.ResponseWriter) {
 	for _, s := range sandboxes {
-		fmt.Fprintf(w, "%s\n", s)
+		w.Write([]byte(fmt.Sprintf("%s\n", s)))
 	}
 }
 func listSandboxesHtml(sandboxes []string, w http.ResponseWriter) {
 	w.Write([]byte("<h1>Sandbox list</h1>\n"))
 	w.Write([]byte("<ul>\n"))
 	for _, s := range sandboxes {
-		fmt.Fprintf(w, "<li>%s: <a href='/debug/pprof/?sandbox=%s'>pprof</a>, <a href='/metrics?sandbox=%s'>metrics</a>, <a href='/agent-url?sandbox=%s'>agent-url</a></li>\n", s, s, s, s)
+		w.Write([]byte(fmt.Sprintf("<li>%s: <a href='/debug/pprof/?sandbox=%s'>pprof</a>, <a href='/metrics?sandbox=%s'>metrics</a>, <a href='/agent-url?sandbox=%s'>agent-url</a></li>\n", s, s, s, s)))
 	}
 	w.Write([]byte("</ul>\n"))
 }
--- a/src/runtime/pkg/kata-monitor/pprof.go
+++ b/src/runtime/pkg/kata-monitor/pprof.go
@@ -98,7 +98,7 @@ func (km *KataMonitor) ExpvarHandler(w http.ResponseWriter, r *http.Request) {
 // PprofIndex handles other `/debug/pprof/` requests
 func (km *KataMonitor) PprofIndex(w http.ResponseWriter, r *http.Request) {
 	if len(strings.TrimPrefix(r.URL.Path, "/debug/pprof/")) == 0 {
-		km.proxyRequest(w, r, copyResponseAddingSandboxIDToHref)
+		km.proxyRequest(w, r, copyResponseAddingSandboxIdToHref)
 	} else {
 		km.proxyRequest(w, r, nil)
 	}
@@ -132,7 +132,7 @@ func copyResponse(req *http.Request, w io.Writer, r io.Reader) error {
 	return err
 }

-func copyResponseAddingSandboxIDToHref(req *http.Request, w io.Writer, r io.Reader) error {
+func copyResponseAddingSandboxIdToHref(req *http.Request, w io.Writer, r io.Reader) error {
 	sb, err := getSandboxIDFromReq(req)
 	if err != nil {
 		monitorLog.WithError(err).Warning("missing sandbox query in pprof url")
--- a/src/runtime/pkg/kata-monitor/pprof_test.go
+++ b/src/runtime/pkg/kata-monitor/pprof_test.go
@@ -15,7 +15,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )

-func TestCopyResponseAddingSandboxIDToHref(t *testing.T) {
+func TestCopyResponseAddingSandboxIdToHref(t *testing.T) {
 	assert := assert.New(t)

 	htmlIn := strings.NewReader(`
@@ -112,6 +112,6 @@ Profile Descriptions:

 	req := &http.Request{URL: &url.URL{RawQuery: "sandbox=1234567890"}}
 	buf := bytes.NewBuffer(nil)
-	copyResponseAddingSandboxIDToHref(req, buf, htmlIn)
+	copyResponseAddingSandboxIdToHref(req, buf, htmlIn)
 	assert.Equal(htmlExpected, buf)
 }
--- a/src/runtime/pkg/katatestutils/constraints.go
+++ b/src/runtime/pkg/katatestutils/constraints.go
@@ -98,8 +98,8 @@ func getKernelVersion() (string, error) {
 // These kernel version can't be parsed by the current lib and lead to panic
 // therefore the '+' should be removed.
 func fixKernelVersion(version string) string {
-	version = strings.ReplaceAll(version, "_", "-")
-	return strings.ReplaceAll(version, "+", "")
+	version = strings.Replace(version, "_", "-", -1)
+	return strings.Replace(version, "+", "", -1)
 }

 // handleKernelVersion checks that the current kernel version is compatible with
--- a/src/runtime/pkg/katatestutils/utils.go
+++ b/src/runtime/pkg/katatestutils/utils.go
@@ -23,7 +23,7 @@ const (
 	testDirMode  = os.FileMode(0750)
 	testFileMode = os.FileMode(0640)

-	busyboxConfigJSON = `
+	busyboxConfigJson = `
 {
 	"ociVersion": "1.0.1-dev",
 	"process": {
@@ -359,7 +359,7 @@ func SetupOCIConfigFile(t *testing.T) (rootPath string, bundlePath, ociConfigFil
 	assert.NoError(err)

 	ociConfigFile = filepath.Join(bundlePath, "config.json")
-	err = os.WriteFile(ociConfigFile, []byte(busyboxConfigJSON), testFileMode)
+	err = os.WriteFile(ociConfigFile, []byte(busyboxConfigJson), testFileMode)
 	assert.NoError(err)

 	return tmpdir, bundlePath, ociConfigFile
--- a/src/runtime/pkg/katautils/config.go
+++ b/src/runtime/pkg/katautils/config.go
@@ -22,6 +22,7 @@ import (
 	govmmQemu "github.com/kata-containers/kata-containers/src/runtime/pkg/govmm/qemu"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils/katatrace"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/oci"
+	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	exp "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/experimental"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/types"
@@ -1899,8 +1900,8 @@ func checkConfig(config oci.RuntimeConfig) error {
 // checkPCIeConfig ensures the PCIe configuration is valid.
 // Only allow one of the following settings for cold-plug:
 // no-port, root-port, switch-port
-func checkPCIeConfig(coldPlug config.PCIePort, hotPlug config.PCIePort, machineType string, hypervisorType vc.HypervisorType) error {
-	if hypervisorType != vc.QemuHypervisor && hypervisorType != vc.ClhHypervisor {
+func checkPCIeConfig(coldPlug config.PCIePort, hotPlug config.PCIePort, machineType string, hypervisorType virtcontainers.HypervisorType) error {
+	if hypervisorType != virtcontainers.QemuHypervisor && hypervisorType != virtcontainers.ClhHypervisor {
 		kataUtilsLogger.Warn("Advanced PCIe Topology only available for QEMU/CLH hypervisor, ignoring hot(cold)_vfio_port setting")
 		return nil
 	}
@@ -1916,7 +1917,7 @@ func checkPCIeConfig(coldPlug config.PCIePort, hotPlug config.PCIePort, machineT
 	if machineType != "q35" && machineType != "virt" {
 		return nil
 	}
-	if hypervisorType == vc.ClhHypervisor {
+	if hypervisorType == virtcontainers.ClhHypervisor {
 		if coldPlug != config.NoPort {
 			return fmt.Errorf("cold-plug not supported on CLH")
 		}
--- a/src/runtime/pkg/katautils/create_test.go
+++ b/src/runtime/pkg/katautils/create_test.go
@@ -21,6 +21,7 @@ import (
 	config "github.com/kata-containers/kata-containers/src/runtime/pkg/device/config"
 	ktu "github.com/kata-containers/kata-containers/src/runtime/pkg/katatestutils"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/oci"
+	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/compatoci"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/vcmock"
@@ -426,7 +427,7 @@ func TestVfioChecksClh(t *testing.T) {

 	// Check valid CLH vfio configs
 	f := func(coldPlug, hotPlug config.PCIePort) error {
-		return checkPCIeConfig(coldPlug, hotPlug, defaultMachineType, vc.ClhHypervisor)
+		return checkPCIeConfig(coldPlug, hotPlug, defaultMachineType, virtcontainers.ClhHypervisor)
 	}
 	assert.NoError(f(config.NoPort, config.NoPort))
 	assert.NoError(f(config.NoPort, config.RootPort))
@@ -440,7 +441,7 @@ func TestVfioCheckQemu(t *testing.T) {

 	// Check valid Qemu vfio configs
 	f := func(coldPlug, hotPlug config.PCIePort) error {
-		return checkPCIeConfig(coldPlug, hotPlug, defaultMachineType, vc.QemuHypervisor)
+		return checkPCIeConfig(coldPlug, hotPlug, defaultMachineType, virtcontainers.QemuHypervisor)
 	}

 	assert.NoError(f(config.NoPort, config.NoPort))
--- a/src/runtime/pkg/katautils/logger_test.go
+++ b/src/runtime/pkg/katautils/logger_test.go
@@ -90,7 +90,7 @@ func TestNewSystemLogHook(t *testing.T) {

 	output := string(bytes)
 	output = strings.TrimSpace(output)
-	output = strings.ReplaceAll(output, `"`, "")
+	output = strings.Replace(output, `"`, "", -1)

 	fields := strings.Fields(output)

--- a/src/runtime/pkg/oci/utils_test.go
+++ b/src/runtime/pkg/oci/utils_test.go
@@ -1143,7 +1143,7 @@ func TestParseAnnotationBoolConfiguration(t *testing.T) {
 			ocispec := specs.Spec{
 				Annotations: map[string]string{tc.annotationKey: annotaionValue},
 			}
-			val := false
+			var val bool = false

 			err := newAnnotationConfiguration(ocispec, tc.annotationKey).setBool(func(v bool) {
 				val = v
--- a/src/runtime/pkg/resourcecontrol/cgroups.go
+++ b/src/runtime/pkg/resourcecontrol/cgroups.go
@@ -8,7 +8,6 @@
 package resourcecontrol

 import (
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -51,7 +50,7 @@ type LinuxCgroup struct {
 	sync.Mutex
 }

-func sandboxDevices() ([]specs.LinuxDeviceCgroup, error) {
+func sandboxDevices() []specs.LinuxDeviceCgroup {
 	devices := []specs.LinuxDeviceCgroup{}

 	defaultDevices := []string{
@@ -69,33 +68,14 @@ func sandboxDevices() ([]specs.LinuxDeviceCgroup, error) {
 	// In order to run Virtual Machines and create virtqueues, hypervisors
 	// need access to certain character devices in the host, like kvm and vhost-net.
 	hypervisorDevices := []string{
-		"/dev/kvm",  // To run virtual machines with KVM
-		"/dev/mshv", // To run virtual machines with Hyper-V
-	}
-	virtualDevices := []string{
+		"/dev/kvm",         // To run virtual machines with KVM
+		"/dev/mshv",        // To run virtual machines with Hyper-V
 		"/dev/vhost-net",   // To create virtqueues
 		"/dev/vfio/vfio",   // To access VFIO devices
 		"/dev/vhost-vsock", // To interact with vsock if
 	}

-	hypervisorDeviceAdded := false
-	for _, hypervisor := range hypervisorDevices {
-		hypervisorDevice, err := DeviceToLinuxDevice(hypervisor)
-		if err != nil {
-			if !os.IsNotExist(err) {
-				controllerLogger.WithField("source", "cgroups").Warnf("Failed to add %s to the devices cgroup: %v", hypervisor, err)
-			}
-			continue
-		}
-		devices = append(devices, hypervisorDevice)
-		hypervisorDeviceAdded = true
-		controllerLogger.WithField("source", "cgroups").Infof("Adding %s to the devices cgroup", hypervisor)
-		break
-	}
-	if !hypervisorDeviceAdded {
-		return []specs.LinuxDeviceCgroup{}, errors.New("failed to add any hypervisor device to devices cgroup")
-	}
-	defaultDevices = append(defaultDevices, virtualDevices...)
+	defaultDevices = append(defaultDevices, hypervisorDevices...)

 	for _, device := range defaultDevices {
 		ldevice, err := DeviceToLinuxDevice(device)
@@ -148,7 +128,7 @@ func sandboxDevices() ([]specs.LinuxDeviceCgroup, error) {

 	devices = append(devices, wildcardDevices...)

-	return devices, nil
+	return devices
 }

 func NewResourceController(path string, resources *specs.LinuxResources) (ResourceController, error) {
@@ -188,11 +168,7 @@ func NewResourceController(path string, resources *specs.LinuxResources) (Resour

 func NewSandboxResourceController(path string, resources *specs.LinuxResources, sandboxCgroupOnly bool) (ResourceController, error) {
 	sandboxResources := *resources
-	sandboxDevices, err := sandboxDevices()
-	if err != nil {
-		return nil, err
-	}
-	sandboxResources.Devices = append(sandboxResources.Devices, sandboxDevices...)
+	sandboxResources.Devices = append(sandboxResources.Devices, sandboxDevices()...)

 	// Currently we know to handle systemd cgroup path only when it's the only cgroup (no overhead group), hence,
 	// if sandboxCgroupOnly is not true we treat it as cgroupfs path as it used to be, although it may be incorrect.
--- a/src/runtime/pkg/utils/shimclient/shim_management_client.go
+++ b/src/runtime/pkg/utils/shimclient/shim_management_client.go
@@ -47,8 +47,8 @@ func buildUnixSocketClient(socketAddr string, timeout time.Duration) (*http.Clie
 	return client, nil
 }

-func DoGet(sandboxID string, timeout time.Duration, urlPath string) ([]byte, error) {
-	client, err := BuildShimClient(sandboxID, timeout)
+func DoGet(sandboxID string, timeoutInSeconds time.Duration, urlPath string) ([]byte, error) {
+	client, err := BuildShimClient(sandboxID, timeoutInSeconds)
 	if err != nil {
 		return nil, err
 	}
@@ -71,8 +71,8 @@ func DoGet(sandboxID string, timeout time.Duration, urlPath string) ([]byte, err
 }

 // DoPut will make a PUT request to the shim endpoint that handles the given sandbox ID
-func DoPut(sandboxID string, timeout time.Duration, urlPath, contentType string, payload []byte) error {
-	client, err := BuildShimClient(sandboxID, timeout)
+func DoPut(sandboxID string, timeoutInSeconds time.Duration, urlPath, contentType string, payload []byte) error {
+	client, err := BuildShimClient(sandboxID, timeoutInSeconds)
 	if err != nil {
 		return err
 	}
@@ -103,8 +103,8 @@ func DoPut(sandboxID string, timeout time.Duration, urlPath, contentType string,
 }

 // DoPost will make a POST request to the shim endpoint that handles the given sandbox ID
-func DoPost(sandboxID string, timeout time.Duration, urlPath, contentType string, payload []byte) error {
-	client, err := BuildShimClient(sandboxID, timeout)
+func DoPost(sandboxID string, timeoutInSeconds time.Duration, urlPath, contentType string, payload []byte) error {
+	client, err := BuildShimClient(sandboxID, timeoutInSeconds)
 	if err != nil {
 		return err
 	}
--- a/src/runtime/vendor/github.com/BurntSushi/toml/README.md
+++ b/src/runtime/vendor/github.com/BurntSushi/toml/README.md
@@ -1,7 +1,7 @@
 TOML stands for Tom's Obvious, Minimal Language. This Go package provides a
 reflection interface similar to Go's standard library `json` and `xml` packages.

-Compatible with TOML version [v1.1.0](https://toml.io/en/v1.1.0).
+Compatible with TOML version [v1.0.0](https://toml.io/en/v1.0.0).

 Documentation: https://pkg.go.dev/github.com/BurntSushi/toml

--- a/src/runtime/vendor/github.com/BurntSushi/toml/decode.go
+++ b/src/runtime/vendor/github.com/BurntSushi/toml/decode.go
@@ -206,13 +206,6 @@ func markDecodedRecursive(md *MetaData, tmap map[string]any) {
 			markDecodedRecursive(md, tmap)
 			md.context = md.context[0 : len(md.context)-1]
 		}
-		if tarr, ok := tmap[key].([]map[string]any); ok {
-			for _, elm := range tarr {
-				md.context = append(md.context, key)
-				markDecodedRecursive(md, elm)
-				md.context = md.context[0 : len(md.context)-1]
-			}
-		}
 	}
 }

@@ -430,7 +423,7 @@ func (md *MetaData) unifyString(data any, rv reflect.Value) error {
 		if i, ok := data.(int64); ok {
 			rv.SetString(strconv.FormatInt(i, 10))
 		} else if f, ok := data.(float64); ok {
-			rv.SetString(strconv.FormatFloat(f, 'g', -1, 64))
+			rv.SetString(strconv.FormatFloat(f, 'f', -1, 64))
 		} else {
 			return md.badtype("string", data)
 		}
--- a/src/runtime/vendor/github.com/BurntSushi/toml/encode.go
+++ b/src/runtime/vendor/github.com/BurntSushi/toml/encode.go
@@ -228,9 +228,9 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 		}
 		switch v.Location() {
 		default:
-			enc.write(v.Format(format))
+			enc.wf(v.Format(format))
 		case internal.LocalDatetime, internal.LocalDate, internal.LocalTime:
-			enc.write(v.In(time.UTC).Format(format))
+			enc.wf(v.In(time.UTC).Format(format))
 		}
 		return
 	case Marshaler:
@@ -279,40 +279,40 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 	case reflect.String:
 		enc.writeQuoted(rv.String())
 	case reflect.Bool:
-		enc.write(strconv.FormatBool(rv.Bool()))
+		enc.wf(strconv.FormatBool(rv.Bool()))
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		enc.write(strconv.FormatInt(rv.Int(), 10))
+		enc.wf(strconv.FormatInt(rv.Int(), 10))
 	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		enc.write(strconv.FormatUint(rv.Uint(), 10))
+		enc.wf(strconv.FormatUint(rv.Uint(), 10))
 	case reflect.Float32:
 		f := rv.Float()
 		if math.IsNaN(f) {
 			if math.Signbit(f) {
-				enc.write("-")
+				enc.wf("-")
 			}
-			enc.write("nan")
+			enc.wf("nan")
 		} else if math.IsInf(f, 0) {
 			if math.Signbit(f) {
-				enc.write("-")
+				enc.wf("-")
 			}
-			enc.write("inf")
+			enc.wf("inf")
 		} else {
-			enc.write(floatAddDecimal(strconv.FormatFloat(f, 'g', -1, 32)))
+			enc.wf(floatAddDecimal(strconv.FormatFloat(f, 'f', -1, 32)))
 		}
 	case reflect.Float64:
 		f := rv.Float()
 		if math.IsNaN(f) {
 			if math.Signbit(f) {
-				enc.write("-")
+				enc.wf("-")
 			}
-			enc.write("nan")
+			enc.wf("nan")
 		} else if math.IsInf(f, 0) {
 			if math.Signbit(f) {
-				enc.write("-")
+				enc.wf("-")
 			}
-			enc.write("inf")
+			enc.wf("inf")
 		} else {
-			enc.write(floatAddDecimal(strconv.FormatFloat(f, 'g', -1, 64)))
+			enc.wf(floatAddDecimal(strconv.FormatFloat(f, 'f', -1, 64)))
 		}
 	case reflect.Array, reflect.Slice:
 		enc.eArrayOrSliceElement(rv)
@@ -330,32 +330,27 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 // By the TOML spec, all floats must have a decimal with at least one number on
 // either side.
 func floatAddDecimal(fstr string) string {
-	for _, c := range fstr {
-		if c == 'e' { // Exponent syntax
-			return fstr
-		}
-		if c == '.' {
-			return fstr
-		}
+	if !strings.Contains(fstr, ".") {
+		return fstr + ".0"
 	}
-	return fstr + ".0"
+	return fstr
 }

 func (enc *Encoder) writeQuoted(s string) {
-	enc.write(`"` + dblQuotedReplacer.Replace(s) + `"`)
+	enc.wf("\"%s\"", dblQuotedReplacer.Replace(s))
 }

 func (enc *Encoder) eArrayOrSliceElement(rv reflect.Value) {
 	length := rv.Len()
-	enc.write("[")
+	enc.wf("[")
 	for i := 0; i < length; i++ {
 		elem := eindirect(rv.Index(i))
 		enc.eElement(elem)
 		if i != length-1 {
-			enc.write(", ")
+			enc.wf(", ")
 		}
 	}
-	enc.write("]")
+	enc.wf("]")
 }

 func (enc *Encoder) eArrayOfTables(key Key, rv reflect.Value) {
@@ -368,7 +363,7 @@ func (enc *Encoder) eArrayOfTables(key Key, rv reflect.Value) {
 			continue
 		}
 		enc.newline()
-		enc.writef("%s[[%s]]", enc.indentStr(key), key)
+		enc.wf("%s[[%s]]", enc.indentStr(key), key)
 		enc.newline()
 		enc.eMapOrStruct(key, trv, false)
 	}
@@ -381,7 +376,7 @@ func (enc *Encoder) eTable(key Key, rv reflect.Value) {
 		enc.newline()
 	}
 	if len(key) > 0 {
-		enc.writef("%s[%s]", enc.indentStr(key), key)
+		enc.wf("%s[%s]", enc.indentStr(key), key)
 		enc.newline()
 	}
 	enc.eMapOrStruct(key, rv, false)
@@ -427,7 +422,7 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 			if inline {
 				enc.writeKeyValue(Key{mapKey.String()}, val, true)
 				if trailC || i != len(mapKeys)-1 {
-					enc.write(", ")
+					enc.wf(", ")
 				}
 			} else {
 				enc.encode(key.add(mapKey.String()), val)
@@ -436,12 +431,12 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 	}

 	if inline {
-		enc.write("{")
+		enc.wf("{")
 	}
 	writeMapKeys(mapKeysDirect, len(mapKeysSub) > 0)
 	writeMapKeys(mapKeysSub, false)
 	if inline {
-		enc.write("}")
+		enc.wf("}")
 	}
 }

@@ -539,7 +534,7 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 			if inline {
 				enc.writeKeyValue(Key{keyName}, fieldVal, true)
 				if fieldIndex[0] != totalFields-1 {
-					enc.write(", ")
+					enc.wf(", ")
 				}
 			} else {
 				enc.encode(key.add(keyName), fieldVal)
@@ -548,14 +543,14 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	}

 	if inline {
-		enc.write("{")
+		enc.wf("{")
 	}

 	l := len(fieldsDirect) + len(fieldsSub)
 	writeFields(fieldsDirect, l)
 	writeFields(fieldsSub, l)
 	if inline {
-		enc.write("}")
+		enc.wf("}")
 	}
 }

@@ -705,7 +700,7 @@ func isEmpty(rv reflect.Value) bool {

 func (enc *Encoder) newline() {
 	if enc.hasWritten {
-		enc.write("\n")
+		enc.wf("\n")
 	}
 }

@@ -727,22 +722,14 @@ func (enc *Encoder) writeKeyValue(key Key, val reflect.Value, inline bool) {
 		enc.eElement(val)
 		return
 	}
-	enc.writef("%s%s = ", enc.indentStr(key), key.maybeQuoted(len(key)-1))
+	enc.wf("%s%s = ", enc.indentStr(key), key.maybeQuoted(len(key)-1))
 	enc.eElement(val)
 	if !inline {
 		enc.newline()
 	}
 }

-func (enc *Encoder) write(s string) {
-	_, err := enc.w.WriteString(s)
-	if err != nil {
-		encPanic(err)
-	}
-	enc.hasWritten = true
-}
-
-func (enc *Encoder) writef(format string, v ...any) {
+func (enc *Encoder) wf(format string, v ...any) {
 	_, err := fmt.Fprintf(enc.w, format, v...)
 	if err != nil {
 		encPanic(err)
--- a/src/runtime/vendor/github.com/BurntSushi/toml/lex.go
+++ b/src/runtime/vendor/github.com/BurntSushi/toml/lex.go
@@ -13,6 +13,7 @@ type itemType int

 const (
 	itemError itemType = iota
+	itemNIL            // used in the parser to indicate no type
 	itemEOF
 	itemText
 	itemString
@@ -46,13 +47,14 @@ func (p Position) String() string {
 }

 type lexer struct {
-	input string
-	start int
-	pos   int
-	line  int
-	state stateFn
-	items chan item
-	esc   bool
+	input    string
+	start    int
+	pos      int
+	line     int
+	state    stateFn
+	items    chan item
+	tomlNext bool
+	esc      bool

 	// Allow for backing up up to 4 runes. This is necessary because TOML
 	// contains 3-rune tokens (""" and ''').
@@ -88,13 +90,14 @@ func (lx *lexer) nextItem() item {
 	}
 }

-func lex(input string) *lexer {
+func lex(input string, tomlNext bool) *lexer {
 	lx := &lexer{
-		input: input,
-		state: lexTop,
-		items: make(chan item, 10),
-		stack: make([]stateFn, 0, 10),
-		line:  1,
+		input:    input,
+		state:    lexTop,
+		items:    make(chan item, 10),
+		stack:    make([]stateFn, 0, 10),
+		line:     1,
+		tomlNext: tomlNext,
 	}
 	return lx
 }
@@ -105,7 +108,7 @@ func (lx *lexer) push(state stateFn) {

 func (lx *lexer) pop() stateFn {
 	if len(lx.stack) == 0 {
-		panic("BUG in lexer: no states to pop")
+		return lx.errorf("BUG in lexer: no states to pop")
 	}
 	last := lx.stack[len(lx.stack)-1]
 	lx.stack = lx.stack[0 : len(lx.stack)-1]
@@ -302,8 +305,6 @@ func lexTop(lx *lexer) stateFn {
 		return lexTableStart
 	case eof:
 		if lx.pos > lx.start {
-			// TODO: never reached? I think this can only occur on a bug in the
-			// lexer(?)
 			return lx.errorf("unexpected EOF")
 		}
 		lx.emit(itemEOF)
@@ -391,6 +392,8 @@ func lexTableNameStart(lx *lexer) stateFn {
 func lexTableNameEnd(lx *lexer) stateFn {
 	lx.skip(isWhitespace)
 	switch r := lx.next(); {
+	case isWhitespace(r):
+		return lexTableNameEnd
 	case r == '.':
 		lx.ignore()
 		return lexTableNameStart
@@ -409,7 +412,7 @@ func lexTableNameEnd(lx *lexer) stateFn {
 // Lexes only one part, e.g. only 'a' inside 'a.b'.
 func lexBareName(lx *lexer) stateFn {
 	r := lx.next()
-	if isBareKeyChar(r) {
+	if isBareKeyChar(r, lx.tomlNext) {
 		return lexBareName
 	}
 	lx.backup()
@@ -417,23 +420,23 @@ func lexBareName(lx *lexer) stateFn {
 	return lx.pop()
 }

-// lexQuotedName lexes one part of a quoted key or table name. It assumes that
-// it starts lexing at the quote itself (" or ').
+// lexBareName lexes one part of a key or table.
+//
+// It assumes that at least one valid character for the table has already been
+// read.
 //
 // Lexes only one part, e.g. only '"a"' inside '"a".b'.
 func lexQuotedName(lx *lexer) stateFn {
 	r := lx.next()
 	switch {
+	case isWhitespace(r):
+		return lexSkip(lx, lexValue)
 	case r == '"':
 		lx.ignore() // ignore the '"'
 		return lexString
 	case r == '\'':
 		lx.ignore() // ignore the "'"
 		return lexRawString
-
-	// TODO: I don't think any of the below conditions can ever be reached?
-	case isWhitespace(r):
-		return lexSkip(lx, lexValue)
 	case r == eof:
 		return lx.errorf("unexpected EOF; expected value")
 	default:
@@ -461,19 +464,17 @@ func lexKeyStart(lx *lexer) stateFn {
 func lexKeyNameStart(lx *lexer) stateFn {
 	lx.skip(isWhitespace)
 	switch r := lx.peek(); {
-	default:
-		lx.push(lexKeyEnd)
-		return lexBareName
-	case r == '"' || r == '\'':
-		lx.ignore()
-		lx.push(lexKeyEnd)
-		return lexQuotedName
-
-	// TODO: I think these can never be reached?
 	case r == '=' || r == eof:
 		return lx.errorf("unexpected '='")
 	case r == '.':
 		return lx.errorf("unexpected '.'")
+	case r == '"' || r == '\'':
+		lx.ignore()
+		lx.push(lexKeyEnd)
+		return lexQuotedName
+	default:
+		lx.push(lexKeyEnd)
+		return lexBareName
 	}
 }

@@ -484,7 +485,7 @@ func lexKeyEnd(lx *lexer) stateFn {
 	switch r := lx.next(); {
 	case isWhitespace(r):
 		return lexSkip(lx, lexKeyEnd)
-	case r == eof: // TODO: never reached
+	case r == eof:
 		return lx.errorf("unexpected EOF; expected key separator '='")
 	case r == '.':
 		lx.ignore()
@@ -627,7 +628,10 @@ func lexInlineTableValue(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexInlineTableValue)
 	case isNL(r):
-		return lexSkip(lx, lexInlineTableValue)
+		if lx.tomlNext {
+			return lexSkip(lx, lexInlineTableValue)
+		}
+		return lx.errorPrevLine(errLexInlineTableNL{})
 	case r == '#':
 		lx.push(lexInlineTableValue)
 		return lexCommentStart
@@ -649,7 +653,10 @@ func lexInlineTableValueEnd(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexInlineTableValueEnd)
 	case isNL(r):
-		return lexSkip(lx, lexInlineTableValueEnd)
+		if lx.tomlNext {
+			return lexSkip(lx, lexInlineTableValueEnd)
+		}
+		return lx.errorPrevLine(errLexInlineTableNL{})
 	case r == '#':
 		lx.push(lexInlineTableValueEnd)
 		return lexCommentStart
@@ -657,7 +664,10 @@ func lexInlineTableValueEnd(lx *lexer) stateFn {
 		lx.ignore()
 		lx.skip(isWhitespace)
 		if lx.peek() == '}' {
-			return lexInlineTableValueEnd
+			if lx.tomlNext {
+				return lexInlineTableValueEnd
+			}
+			return lx.errorf("trailing comma not allowed in inline tables")
 		}
 		return lexInlineTableValue
 	case r == '}':
@@ -845,6 +855,9 @@ func lexStringEscape(lx *lexer) stateFn {
 	r := lx.next()
 	switch r {
 	case 'e':
+		if !lx.tomlNext {
+			return lx.error(errLexEscape{r})
+		}
 		fallthrough
 	case 'b':
 		fallthrough
@@ -865,6 +878,9 @@ func lexStringEscape(lx *lexer) stateFn {
 	case '\\':
 		return lx.pop()
 	case 'x':
+		if !lx.tomlNext {
+			return lx.error(errLexEscape{r})
+		}
 		return lexHexEscape
 	case 'u':
 		return lexShortUnicodeEscape
@@ -912,9 +928,19 @@ func lexLongUnicodeEscape(lx *lexer) stateFn {
 // lexBaseNumberOrDate can differentiate base prefixed integers from other
 // types.
 func lexNumberOrDateStart(lx *lexer) stateFn {
-	if lx.next() == '0' {
+	r := lx.next()
+	switch r {
+	case '0':
 		return lexBaseNumberOrDate
 	}
+
+	if !isDigit(r) {
+		// The only way to reach this state is if the value starts
+		// with a digit, so specifically treat anything else as an
+		// error.
+		return lx.errorf("expected a digit but got %q", r)
+	}
+
 	return lexNumberOrDate
 }

@@ -1170,13 +1196,13 @@ func lexSkip(lx *lexer, nextState stateFn) stateFn {
 }

 func (s stateFn) String() string {
-	if s == nil {
-		return "<nil>"
-	}
 	name := runtime.FuncForPC(reflect.ValueOf(s).Pointer()).Name()
 	if i := strings.LastIndexByte(name, '.'); i > -1 {
 		name = name[i+1:]
 	}
+	if s == nil {
+		name = "<nil>"
+	}
 	return name + "()"
 }

@@ -1184,6 +1210,8 @@ func (itype itemType) String() string {
 	switch itype {
 	case itemError:
 		return "Error"
+	case itemNIL:
+		return "NIL"
 	case itemEOF:
 		return "EOF"
 	case itemText:
@@ -1198,22 +1226,18 @@ func (itype itemType) String() string {
 		return "Float"
 	case itemDatetime:
 		return "DateTime"
-	case itemArray:
-		return "Array"
-	case itemArrayEnd:
-		return "ArrayEnd"
 	case itemTableStart:
 		return "TableStart"
 	case itemTableEnd:
 		return "TableEnd"
-	case itemArrayTableStart:
-		return "ArrayTableStart"
-	case itemArrayTableEnd:
-		return "ArrayTableEnd"
 	case itemKeyStart:
 		return "KeyStart"
 	case itemKeyEnd:
 		return "KeyEnd"
+	case itemArray:
+		return "Array"
+	case itemArrayEnd:
+		return "ArrayEnd"
 	case itemCommentStart:
 		return "CommentStart"
 	case itemInlineTableStart:
@@ -1242,7 +1266,7 @@ func isDigit(r rune) bool  { return r >= '0' && r <= '9' }
 func isBinary(r rune) bool { return r == '0' || r == '1' }
 func isOctal(r rune) bool  { return r >= '0' && r <= '7' }
 func isHex(r rune) bool    { return (r >= '0' && r <= '9') || (r|0x20 >= 'a' && r|0x20 <= 'f') }
-func isBareKeyChar(r rune) bool {
+func isBareKeyChar(r rune, tomlNext bool) bool {
 	return (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') ||
 		(r >= '0' && r <= '9') || r == '_' || r == '-'
 }
--- a/src/runtime/vendor/github.com/BurntSushi/toml/parse.go
+++ b/src/runtime/vendor/github.com/BurntSushi/toml/parse.go
@@ -3,6 +3,7 @@ package toml
 import (
 	"fmt"
 	"math"
+	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -16,6 +17,7 @@ type parser struct {
 	context    Key      // Full key for the current hash in scope.
 	currentKey string   // Base key name for everything except hashes.
 	pos        Position // Current position in the TOML file.
+	tomlNext   bool

 	ordered []Key // List of keys in the order that they appear in the TOML data.

@@ -30,6 +32,8 @@ type keyInfo struct {
 }

 func parse(data string) (p *parser, err error) {
+	_, tomlNext := os.LookupEnv("BURNTSUSHI_TOML_110")
+
 	defer func() {
 		if r := recover(); r != nil {
 			if pErr, ok := r.(ParseError); ok {
@@ -69,9 +73,10 @@ func parse(data string) (p *parser, err error) {
 	p = &parser{
 		keyInfo:   make(map[string]keyInfo),
 		mapping:   make(map[string]any),
-		lx:        lex(data),
+		lx:        lex(data, tomlNext),
 		ordered:   make([]Key, 0),
 		implicits: make(map[string]struct{}),
+		tomlNext:  tomlNext,
 	}
 	for {
 		item := p.next()
@@ -345,14 +350,17 @@ func (p *parser) valueFloat(it item) (any, tomlType) {
 var dtTypes = []struct {
 	fmt  string
 	zone *time.Location
+	next bool
 }{
-	{time.RFC3339Nano, time.Local},
-	{"2006-01-02T15:04:05.999999999", internal.LocalDatetime},
-	{"2006-01-02", internal.LocalDate},
-	{"15:04:05.999999999", internal.LocalTime},
-	{"2006-01-02T15:04Z07:00", time.Local},
-	{"2006-01-02T15:04", internal.LocalDatetime},
-	{"15:04", internal.LocalTime},
+	{time.RFC3339Nano, time.Local, false},
+	{"2006-01-02T15:04:05.999999999", internal.LocalDatetime, false},
+	{"2006-01-02", internal.LocalDate, false},
+	{"15:04:05.999999999", internal.LocalTime, false},
+
+	// tomlNext
+	{"2006-01-02T15:04Z07:00", time.Local, true},
+	{"2006-01-02T15:04", internal.LocalDatetime, true},
+	{"15:04", internal.LocalTime, true},
 }

 func (p *parser) valueDatetime(it item) (any, tomlType) {
@@ -363,6 +371,9 @@ func (p *parser) valueDatetime(it item) (any, tomlType) {
 		err error
 	)
 	for _, dt := range dtTypes {
+		if dt.next && !p.tomlNext {
+			continue
+		}
 		t, err = time.ParseInLocation(dt.fmt, it.val, dt.zone)
 		if err == nil {
 			if missingLeadingZero(it.val, dt.fmt) {
@@ -633,11 +644,6 @@ func (p *parser) setValue(key string, value any) {
 		// Note that since it has already been defined (as a hash), we don't
 		// want to overwrite it. So our business is done.
 		if p.isArray(keyContext) {
-			if !p.isImplicit(keyContext) {
-				if _, ok := hash[key]; ok {
-					p.panicf("Key '%s' has already been defined.", keyContext)
-				}
-			}
 			p.removeImplicit(keyContext)
 			hash[key] = value
 			return
@@ -796,8 +802,10 @@ func (p *parser) replaceEscapes(it item, str string) string {
 			b.WriteByte(0x0d)
 			skip = 1
 		case 'e':
-			b.WriteByte(0x1b)
-			skip = 1
+			if p.tomlNext {
+				b.WriteByte(0x1b)
+				skip = 1
+			}
 		case '"':
 			b.WriteByte(0x22)
 			skip = 1
@@ -807,9 +815,11 @@ func (p *parser) replaceEscapes(it item, str string) string {
 		// The lexer guarantees the correct number of characters are present;
 		// don't need to check here.
 		case 'x':
-			escaped := p.asciiEscapeToUnicode(it, str[i+2:i+4])
-			b.WriteRune(escaped)
-			skip = 3
+			if p.tomlNext {
+				escaped := p.asciiEscapeToUnicode(it, str[i+2:i+4])
+				b.WriteRune(escaped)
+				skip = 3
+			}
 		case 'u':
 			escaped := p.asciiEscapeToUnicode(it, str[i+2:i+6])
 			b.WriteRune(escaped)
--- a/src/runtime/vendor/github.com/go-openapi/errors/.cliff.toml
+++ b/src/runtime/vendor/github.com/go-openapi/errors/.cliff.toml
@@ -1,181 +0,0 @@
-# git-cliff ~ configuration file
-# https://git-cliff.org/docs/configuration
-
-[changelog]
-header = """
-"""
-
-footer = """
-
-----
-
-**[{{ remote.github.repo }}]({{ self::remote_url() }}) license terms**
-
-[![License][license-badge]][license-url]
-
-[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
-[license-url]: {{ self::remote_url() }}/?tab=Apache-2.0-1-ov-file#readme
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-
-body = """
-{%- if version %}
-## [{{ version | trim_start_matches(pat="v") }}]({{ self::remote_url() }}/tree/{{ version }}) - {{ timestamp | date(format="%Y-%m-%d") }}
-{%- else %}
-## [unreleased]
-{%- endif %}
-{%- if message %}
-  {%- raw %}\n{% endraw %}
-{{ message }}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-{%- if version %}
-  {%- if previous.version %}
-
-**Full Changelog**: <{{ self::remote_url() }}/compare/{{ previous.version }}...{{ version }}>
-  {%- endif %}
-{%- else %}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-
-{%- if statistics %}{% if statistics.commit_count %}
-  {%- raw %}\n{% endraw %}
-{{ statistics.commit_count }} commits in this release.
-  {%- raw %}\n{% endraw %}
-{%- endif %}{% endif %}
-----
-
-{%- for group, commits in commits | group_by(attribute="group") %}
-  {%- raw %}\n{% endraw %}
-### {{ group | upper_first }}
-    {%- raw %}\n{% endraw %}
-    {%- for commit in commits %}
-      {%- if commit.remote.pr_title %}
-        {%- set commit_message = commit.remote.pr_title %}
-      {%- else %}
-        {%- set commit_message = commit.message %}
-      {%- endif %}
-* {{ commit_message | split(pat="\n") | first | trim }}
-      {%- if commit.remote.username %}
-{%- raw %} {% endraw %}by [@{{ commit.remote.username }}](https://github.com/{{ commit.remote.username }})
-      {%- endif %}
-      {%- if commit.remote.pr_number %}
-{%- raw %} {% endraw %}in [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }})
-      {%- endif %}
-{%- raw %} {% endraw %}[...]({{ self::remote_url() }}/commit/{{ commit.id }})
-  {%- endfor %}
-{%- endfor %}
-
-{%- if github %}
-{%- raw %}\n{% endraw -%}
-  {%- set all_contributors = github.contributors | length %}
-  {%- if github.contributors | filter(attribute="username", value="dependabot[bot]") | length < all_contributors %}
-----
-
-### People who contributed to this release
-  {% endif %}
-  {%- for contributor in github.contributors | filter(attribute="username") | sort(attribute="username") %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* [@{{ contributor.username }}](https://github.com/{{ contributor.username }})
-    {%- endif %}
-  {%- endfor %}
-
-  {% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
-----
-    {%- raw %}\n{% endraw %}
-
-### New Contributors
-  {%- endif %}
-
-  {%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* @{{ contributor.username }} made their first contribution
-      {%- if contributor.pr_number %}
-  in [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
-      {%- endif %}
-    {%- endif %}
-  {%- endfor %}
-{%- endif %}
-
-{%- raw %}\n{% endraw %}
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-# Remove leading and trailing whitespaces from the changelog's body.
-trim = true
-# Render body even when there are no releases to process.
-render_always = true
-# An array of regex based postprocessors to modify the changelog.
-postprocessors = [
-    # Replace the placeholder <REPO> with a URL.
-    #{ pattern = '<REPO>', replace = "https://github.com/orhun/git-cliff" },
-]
-# output file path
-# output = "test.md"
-
-[git]
-# Parse commits according to the conventional commits specification.
-# See https://www.conventionalcommits.org
-conventional_commits = false
-# Exclude commits that do not match the conventional commits specification.
-filter_unconventional = false
-# Require all commits to be conventional.
-# Takes precedence over filter_unconventional.
-require_conventional = false
-# Split commits on newlines, treating each line as an individual commit.
-split_commits = false
-# An array of regex based parsers to modify commit messages prior to further processing.
-commit_preprocessors = [
-    # Replace issue numbers with link templates to be updated in `changelog.postprocessors`.
-    #{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/issues/${2}))"},
-    # Check spelling of the commit message using https://github.com/crate-ci/typos.
-    # If the spelling is incorrect, it will be fixed automatically.
-    #{ pattern = '.*', replace_command = 'typos --write-changes -' }
-]
-# Prevent commits that are breaking from being excluded by commit parsers.
-protect_breaking_commits = false
-# An array of regex based parsers for extracting data from the commit message.
-# Assigns commits to groups.
-# Optionally sets the commit's scope and can decide to exclude commits from further processing.
-commit_parsers = [
-    { message = "^[Cc]hore\\([Rr]elease\\): prepare for", skip = true },
-    { message = "(^[Mm]erge)|([Mm]erge conflict)", skip = true },
-    { field = "author.name", pattern = "dependabot*", group = "<!-- 0A -->Updates" },
-    { message = "([Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { body = "(.*[Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { message = "([Cc]hore\\(lint\\))|(style)|(lint)|(codeql)|(golangci)", group = "<!-- 05 -->Code quality" },
-    { message = "(^[Dd]oc)|((?i)readme)|(badge)|(typo)|(documentation)", group = "<!-- 03 -->Documentation" },
-    { message = "(^[Ff]eat)|(^[Ee]nhancement)", group = "<!-- 00 -->Implemented enhancements" },
-    { message = "(^ci)|(\\(ci\\))|(fixup\\s+ci)|(fix\\s+ci)|(license)|(example)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^test", group = "<!-- 06 -->Testing" },
-    { message = "(^fix)|(panic)", group = "<!-- 01 -->Fixed bugs" },
-    { message = "(^refact)|(rework)", group = "<!-- 02 -->Refactor" },
-    { message = "(^[Pp]erf)|(performance)", group = "<!-- 04 -->Performance" },
-    { message = "(^[Cc]hore)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^[Rr]evert", group = "<!-- 09 -->Reverted changes" },
-    { message = "(upgrade.*?go)|(go\\s+version)", group = "<!-- 0A -->Updates" },
-    { message = ".*", group = "<!-- 0B -->Other" },
-]
-# Exclude commits that are not matched by any commit parser.
-filter_commits = false
-# An array of link parsers for extracting external references, and turning them into URLs, using regex.
-link_parsers = []
-# Include only the tags that belong to the current branch.
-use_branch_tags = false
-# Order releases topologically instead of chronologically.
-topo_order = false
-# Order releases topologically instead of chronologically.
-topo_order_commits = true
-# Order of commits in each group/release within the changelog.
-# Allowed values: newest, oldest
-sort_commits = "newest"
-# Process submodules commits
-recurse_submodules = false
-
-#[remote.github]
-#owner = "go-openapi"
--- a/src/runtime/vendor/github.com/go-openapi/errors/.editorconfig
+++ b/src/runtime/vendor/github.com/go-openapi/errors/.editorconfig
@@ -1,26 +0,0 @@
-# top-most EditorConfig file
-root = true
-
-# Unix-style newlines with a newline ending every file
-[*]
-end_of_line = lf
-insert_final_newline = true
-indent_style = space
-indent_size = 2
-trim_trailing_whitespace = true
-
-# Set default charset
-[*.{js,py,go,scala,rb,java,html,css,less,sass,md}]
-charset = utf-8
-
-# Tab indentation (no size specified)
-[*.go]
-indent_style = tab
-
-[*.md]
-trim_trailing_whitespace = false
-
-# Matches the exact files either package.json or .travis.yml
-[{package.json,.travis.yml}]
-indent_style = space
-indent_size = 2
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Aurélien Bombo	b87b4dc3be	relax bind mount regex the source path can be cached from the first container now Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	11dfe0ffac	allow cached bundle-id from pause container Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	701e67cfd6	move cache handling to shared_fs=none branch this should only be needed in that branch since virtio-fs should already handle dupes Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	d50f103a13	Revert "debug: fix cache key" This reverts commit `2c3ee1eda5`.	2026-02-13 12:42:49 -06:00
Aurélien Bombo	bd2428e19f	Revert "debug: different approach" This reverts commit `c0d3c31ec8`.	2026-02-13 12:42:49 -06:00
Aurélien Bombo	13b8dda322	debug: different approach Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	36ca7990aa	tests: Introduce new env variables to ease development It can be useful to set these variables during local testing: * AZ_REGION: Region for the cluster. * AZ_NODEPOOL_TAGS: Node pool tags for the cluster. * GENPOLICY_BINARY: Path to the genpolicy binary. * GENPOLICY_SETTINGS_DIR: Directory holding the genpolicy settings. I've also made it so that tests_common.sh modifies the duplicated genpolicy-settings.json (used for testing) instead of the original git-tracked one. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	9894e14e99	debug: fix cache key Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	7357373dff	debug: properly invalidate cache Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	56254ecdff	debug: smaller mutex critical sections Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	be8a112316	debug: enable disable_guest_empty_dir=true and shared_fs=none Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	ed415fa91a	runtime-rs: Set disable_guest_empty_dir = true by default This should be furthermore not be configurable in 4.0. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	4a37f4c673	genpolicy: Assume `disable_guest_empty_dir = true` This option should be removed for 4.0, so we don't handle `false`. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
Aurélien Bombo	0db136cfa9	runtime: Set `disable_guest_empty_dir = true` by default This makes the runtime share the host Kubelet emptyDir folder with the guest instead of the agent creating an empty folder in the container rootfs. Doing so enables the Kubelet to track emptyDir usage and evict greedy pods. In other words, with virtio-fs the container rootfs uses host storage whether this is true or false, however with true, Kata uses the k8s emptyDir folder so the sizeLimit is properly enforced by k8s. Addresses part of #12203. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>	2026-02-13 12:42:49 -06:00
@@ -1 +1 @@
 .27.0
 .26.0