Add 'foo' to README.md

2026-03-14 16:52:18 +00:00 · 2025-10-17 14:23:59 -05:00
394 changed files with 3766 additions and 14863 deletions
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -8,27 +8,25 @@ self-hosted-runner:
  # Labels of self-hosted runner that linter should ignore
  labels:
    - amd64-nvidia-a100
-    - amd64-nvidia-h100-snp
    - arm64-k8s
-    - containerd-v1.7-overlayfs
-    - containerd-v2.0-overlayfs
-    - containerd-v2.1-overlayfs
+    - containerd-v1.7
+    - containerd-v2.0
+    - containerd-v2.1
    - containerd-v2.2
-    - containerd-v2.2-overlayfs
    - garm-ubuntu-2004
    - garm-ubuntu-2004-smaller
    - garm-ubuntu-2204
    - garm-ubuntu-2304
    - garm-ubuntu-2304-smaller
    - garm-ubuntu-2204-smaller
-    - ppc64le
-    - ppc64le-k8s
-    - ppc64le-small
+    - k8s-ppc64le
    - ubuntu-24.04-ppc64le
    - metrics
+    - ppc64le
    - riscv-builder
    - sev-snp
    - s390x
    - s390x-large
    - tdx
-    - ubuntu-24.04-arm
+    - ubuntu-22.04-arm
+    - ubuntu-24.04-s390x
--- a/.github/workflows/basic-ci-amd64.yaml
+++ b/.github/workflows/basic-ci-amd64.yaml
@@ -71,7 +71,7 @@ jobs:
      fail-fast: false
      matrix:
        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu']
+        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu', 'stratovirt']
    runs-on: ubuntu-22.04
    env:
      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
@@ -117,7 +117,7 @@ jobs:
      fail-fast: false
      matrix:
        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'qemu', 'dragonball']
+        vmm: ['clh', 'qemu', 'dragonball', 'stratovirt']
    runs-on: ubuntu-22.04
    env:
      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
@@ -279,6 +279,50 @@ jobs:
        timeout-minutes: 15
        run: bash tests/functional/vfio/gha-run.sh run

+  run-docker-tests:
+    name: run-docker-tests
+    strategy:
+      # We can set this to true whenever we're 100% sure that
+      # all the tests are not flaky, otherwise we'll fail them
+      # all due to a single flaky instance.
+      fail-fast: false
+      matrix:
+        vmm:
+          - qemu
+    runs-on: ubuntu-22.04
+    env:
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/docker/gha-run.sh install-dependencies
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
+
+      - name: Run docker smoke test
+        timeout-minutes: 5
+        run: bash tests/integration/docker/gha-run.sh run
+
  run-nerdctl-tests:
    name: run-nerdctl-tests
    strategy:
--- a/.github/workflows/basic-ci-s390x.yaml
+++ b/.github/workflows/basic-ci-s390x.yaml
@@ -106,3 +106,44 @@ jobs:
      - name: Run containerd-stability tests
        timeout-minutes: 15
        run: bash tests/stability/gha-run.sh run
+
+  run-docker-tests:
+    name: run-docker-tests
+    strategy:
+      # We can set this to true whenever we're 100% sure that
+      # all the tests are not flaky, otherwise we'll fail them
+      # all due to a single flaky instance.
+      fail-fast: false
+      matrix:
+        vmm: ['qemu']
+    runs-on: s390x-large
+    env:
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/docker/gha-run.sh install-dependencies
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
+
+      - name: Run docker smoke test
+        timeout-minutes: 5
+        run: bash tests/integration/docker/gha-run.sh run
--- a/.github/workflows/build-checks.yaml
+++ b/.github/workflows/build-checks.yaml
@@ -12,7 +12,7 @@ name: Build checks
 jobs:
  check:
    name: check
-    runs-on: ${{ matrix.runner || inputs.instance }}
+    runs-on: ${{ inputs.instance }}
    strategy:
      fail-fast: false
      matrix:
@@ -68,38 +68,6 @@ jobs:
            needs:
              - rust
              - protobuf-compiler
-        instance:
-          - ${{ inputs.instance }} 
-        include:
-          - component:
-              name: runtime
-              path: src/runtime
-              needs:
-                - golang
-                - XDG_RUNTIME_DIR
-            instance: ubuntu-24.04-s390x
-            runner: s390x
-          - component:
-              name: runtime
-              path: src/runtime
-              needs:
-                - golang
-                - XDG_RUNTIME_DIR
-            instance: ubuntu-24.04-ppc64le
-            runner: ppc64le
-          - component:
-              name: agent
-              path: src/agent
-              needs:
-                - rust
-                - libdevmapper
-                - libseccomp
-                - protobuf-compiler
-                - clang
-            instance: ubuntu-24.04-ppc64le
-            runner: ppc64le
-
-             

    steps:
      - name: Adjust a permission for repo
--- a/.github/workflows/build-kata-static-tarball-amd64.yaml
+++ b/.github/workflows/build-kata-static-tarball-amd64.yaml
@@ -63,6 +63,7 @@ jobs:
          - qemu
          - qemu-snp-experimental
          - qemu-tdx-experimental
+          - stratovirt
          - trace-forwarder
          - virtiofsd
        stage:
--- a/.github/workflows/build-kata-static-tarball-arm64.yaml
+++ b/.github/workflows/build-kata-static-tarball-arm64.yaml
@@ -23,15 +23,13 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: false
-      KBUILD_SIGN_PIN:
-        required: true

 permissions: {}

 jobs:
  build-asset:
    name: build-asset
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    permissions:
      contents: read
      packages: write
@@ -51,6 +49,7 @@ jobs:
          - nydus
          - ovmf
          - qemu
+          - stratovirt
          - virtiofsd
    env:
      PERFORM_ATTESTATION: ${{ matrix.asset == 'agent' && inputs.push-to-registry == 'yes' && 'yes' || 'no' }}
@@ -90,7 +89,6 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: Parse OCI image name and digest
        id: parse-oci-segments
@@ -141,7 +139,7 @@ jobs:

  build-asset-rootfs:
    name: build-asset-rootfs
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: build-asset
    permissions:
      contents: read
@@ -196,7 +194,6 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: store-artifact ${{ matrix.asset }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -209,7 +206,7 @@ jobs:
  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts:
    name: remove-rootfs-binary-artifacts
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: build-asset-rootfs
    strategy:
      matrix:
@@ -224,7 +221,7 @@ jobs:
  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts-for-release:
    name: remove-rootfs-binary-artifacts-for-release
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: build-asset-rootfs
    strategy:
      matrix:
@@ -238,7 +235,7 @@ jobs:

  build-asset-shim-v2:
    name: build-asset-shim-v2
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
    permissions:
      contents: read
@@ -298,7 +295,7 @@ jobs:

  create-kata-tarball:
    name: create-kata-tarball
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
    permissions:
      contents: read
--- a/.github/workflows/build-kata-static-tarball-ppc64le.yaml
+++ b/.github/workflows/build-kata-static-tarball-ppc64le.yaml
@@ -32,7 +32,7 @@ jobs:
    permissions:
      contents: read
      packages: write
-    runs-on: ppc64le-small
+    runs-on: ubuntu-24.04-ppc64le
    strategy:
      matrix:
        asset:
@@ -89,7 +89,7 @@ jobs:

  build-asset-rootfs:
    name: build-asset-rootfs
-    runs-on: ppc64le-small
+    runs-on: ubuntu-24.04-ppc64le
    needs: build-asset
    permissions:
      contents: read
@@ -170,7 +170,7 @@ jobs:

  build-asset-shim-v2:
    name: build-asset-shim-v2
-    runs-on: ppc64le-small
+    runs-on: ubuntu-24.04-ppc64le
    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
    permissions:
      contents: read
@@ -230,7 +230,7 @@ jobs:

  create-kata-tarball:
    name: create-kata-tarball
-    runs-on: ppc64le-small
+    runs-on: ubuntu-24.04-ppc64le
    needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
    permissions:
      contents: read
--- a/.github/workflows/build-kata-static-tarball-riscv64.yaml
+++ b/.github/workflows/build-kata-static-tarball-riscv64.yaml
@@ -20,6 +20,9 @@ on:
        required: false
        type: string
        default: ""
+    secrets:
+      QUAY_DEPLOYER_PASSWORD:
+        required: true

 permissions: {}

@@ -38,6 +41,14 @@ jobs:
          - kernel
          - virtiofsd
    steps:
+      - name: Login to Kata Containers quay.io
+        if: ${{ inputs.push-to-registry == 'yes' }}
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: quay.io
+          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
+          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.commit-hash }}
@@ -71,5 +82,5 @@ jobs:
        with:
          name: kata-artifacts-riscv64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
-          retention-days: 3
+          retention-days: 15
          if-no-files-found: error
--- a/.github/workflows/build-kata-static-tarball-s390x.yaml
+++ b/.github/workflows/build-kata-static-tarball-s390x.yaml
@@ -32,7 +32,7 @@ permissions: {}
 jobs:
  build-asset:
    name: build-asset
-    runs-on: s390x
+    runs-on: ubuntu-24.04-s390x
    permissions:
      contents: read
      packages: write
@@ -257,7 +257,7 @@ jobs:

  build-asset-shim-v2:
    name: build-asset-shim-v2
-    runs-on: s390x
+    runs-on: ubuntu-24.04-s390x
    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
    permissions:
      contents: read
@@ -319,7 +319,7 @@ jobs:

  create-kata-tarball:
    name: create-kata-tarball
-    runs-on: s390x
+    runs-on: ubuntu-24.04-s390x
    needs:
      - build-asset
      - build-asset-rootfs
--- a/.github/workflows/ci-nightly-riscv.yaml
+++ b/.github/workflows/ci-nightly-riscv.yaml
@@ -1,34 +0,0 @@
-on:
-  schedule:
-    - cron: '0 5 * * *'
-
-name: Nightly CI for RISC-V
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  build-kata-static-tarball-riscv:
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
-    with:
-      tarball-suffix: -${{ github.sha }}
-      commit-hash: ${{ github.sha }}
-      target-branch: ${{ github.ref_name }}
-
-  build-checks-preview:
-    strategy:
-      fail-fast: false
-      matrix:
-        instance:
-          - "riscv-builder"
-    uses: ./.github/workflows/build-checks-preview-riscv64.yaml
-    with:
-      instance: ${{ matrix.instance }}
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -86,8 +86,6 @@ jobs:
      tarball-suffix: -${{ inputs.tag }}
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  publish-kata-deploy-payload-arm64:
    needs: build-kata-static-tarball-arm64
@@ -102,7 +100,7 @@ jobs:
      tag: ${{ inputs.tag }}-arm64
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-24.04-arm
+      runner: ubuntu-22.04-arm
      arch: arm64
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
@@ -134,6 +132,20 @@ jobs:
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

+  build-kata-static-tarball-riscv64:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
+    with:
+      tarball-suffix: -${{ inputs.tag }}
+      commit-hash: ${{ inputs.commit-hash }}
+      target-branch: ${{ inputs.target-branch }}
+    secrets:
+      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+
  publish-kata-deploy-payload-s390x:
    needs: build-kata-static-tarball-s390x
    permissions:
@@ -147,7 +159,7 @@ jobs:
      tag: ${{ inputs.tag }}-s390x
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-      runner: s390x
+      runner: ubuntu-24.04-s390x
      arch: s390x
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
@@ -165,7 +177,7 @@ jobs:
      tag: ${{ inputs.tag }}-ppc64le
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-      runner: ppc64le-small
+      runner: ppc64le
      arch: ppc64le
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
@@ -297,6 +309,18 @@ jobs:
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}

+  run-k8s-tests-on-amd64:
+    if: ${{ inputs.skip-test != 'yes' }}
+    needs: publish-kata-deploy-payload-amd64
+    uses: ./.github/workflows/run-k8s-tests-on-amd64.yaml
+    with:
+      registry: ghcr.io
+      repo: ${{ github.repository_owner }}/kata-deploy-ci
+      tag: ${{ inputs.tag }}-amd64
+      commit-hash: ${{ inputs.commit-hash }}
+      pr-number: ${{ inputs.pr-number }}
+      target-branch: ${{ inputs.target-branch }}
+
  run-k8s-tests-on-arm64:
    if: ${{ inputs.skip-test != 'yes' }}
    needs: publish-kata-deploy-payload-arm64
@@ -415,11 +439,13 @@ jobs:
          { containerd_version: lts,    vmm: clh              },
          { containerd_version: lts,    vmm: dragonball       },
          { containerd_version: lts,    vmm: qemu             },
+          { containerd_version: lts,    vmm: stratovirt       },
          { containerd_version: lts,    vmm: cloud-hypervisor },
          { containerd_version: lts,    vmm: qemu-runtime-rs  },
          { containerd_version: active, vmm: clh              },
          { containerd_version: active, vmm: dragonball       },
          { containerd_version: active, vmm: qemu             },
+          { containerd_version: active, vmm: stratovirt       },
          { containerd_version: active, vmm: cloud-hypervisor },
          { containerd_version: active, vmm: qemu-runtime-rs  },
         ]
@@ -467,7 +493,7 @@ jobs:
      tarball-suffix: -${{ inputs.tag }}
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-      runner: ppc64le-small
+      runner: ppc64le
      arch: ppc64le
      containerd_version: ${{ matrix.params.containerd_version }}
      vmm: ${{ matrix.params.vmm }}
--- a/.github/workflows/payload-after-push.yaml
+++ b/.github/workflows/payload-after-push.yaml
@@ -39,7 +39,6 @@ jobs:
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-assets-s390x:
    permissions:
@@ -97,7 +96,7 @@ jobs:
      repo: kata-containers/kata-deploy-ci
      tag: kata-containers-latest-arm64
      target-branch: ${{ github.ref_name }}
-      runner: ubuntu-24.04-arm
+      runner: ubuntu-22.04-arm
      arch: arm64
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
@@ -131,7 +130,7 @@ jobs:
      repo: kata-containers/kata-deploy-ci
      tag: kata-containers-latest-ppc64le
      target-branch: ${{ github.ref_name }}
-      runner: ppc64le-small
+      runner: ppc64le
      arch: ppc64le
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
@@ -162,42 +161,3 @@ jobs:
        env:
          KATA_DEPLOY_IMAGE_TAGS: "kata-containers-latest"
          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy-ci"
-
-  upload-helm-chart-tarball:
-    name: upload-helm-chart-tarball
-    needs: publish-manifest
-    runs-on: ubuntu-22.04
-    permissions:
-      packages: write # needed to push the helm chart to ghcr.io
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Install helm
-        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
-        id: install
-
-      - name: Login to the OCI registries
-        env:
-          QUAY_DEPLOYER_USERNAME: ${{ vars.QUAY_DEPLOYER_USERNAME }}
-          QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          echo "${QUAY_DEPLOYER_PASSWORD}" | helm registry login quay.io --username "${QUAY_DEPLOYER_USERNAME}" --password-stdin
-          echo "${GITHUB_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
-
-      - name: Push helm chart to the OCI registries
-        run: |
-          echo "Adjusting the Chart.yaml and values.yaml"
-          yq eval '.version = "0.0.0-dev" | .appVersion = "0.0.0-dev"' -i tools/packaging/kata-deploy/helm-chart/kata-deploy/Chart.yaml
-          yq eval '.image.reference = "quay.io/kata-containers/kata-deploy-ci" | .image.tag = "kata-containers-latest"' -i tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml
-
-          echo "Generating the chart package"
-          helm dependencies update tools/packaging/kata-deploy/helm-chart/kata-deploy
-          helm package tools/packaging/kata-deploy/helm-chart/kata-deploy
-
-          echo "Pushing the chart to the OCI registries"
-          helm push "kata-deploy-0.0.0-dev.tgz" oci://quay.io/kata-containers/kata-deploy-charts
-          helm push "kata-deploy-0.0.0-dev.tgz" oci://ghcr.io/kata-containers/kata-deploy-charts
--- a/.github/workflows/release-arm64.yaml
+++ b/.github/workflows/release-arm64.yaml
@@ -8,8 +8,6 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: true
-      KBUILD_SIGN_PIN:
-        required: true

 permissions: {}

@@ -21,7 +19,6 @@ jobs:
      stage: release
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
    permissions:
      contents: read
      packages: write
@@ -34,7 +31,7 @@ jobs:
    permissions:
      contents: read
      packages: write
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    steps:
      - name: Login to Kata Containers ghcr.io
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
--- a/.github/workflows/release-ppc64le.yaml
+++ b/.github/workflows/release-ppc64le.yaml
@@ -31,7 +31,7 @@ jobs:
    permissions:
      contents: read
      packages: write
-    runs-on: ppc64le-small
+    runs-on: ppc64le
    steps:
      - name: Login to Kata Containers ghcr.io
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -49,7 +49,6 @@ jobs:
      target-arch: arm64
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-and-push-assets-s390x:
    needs: release
--- a/.github/workflows/run-containerd-multi-snapshotter-stability-test.yaml
+++ b/.github/workflows/run-containerd-multi-snapshotter-stability-test.yaml
@@ -1,4 +1,4 @@
-name: CI | Run containerd guest pull stability tests
+name: CI | Run containerd multi-snapshotter stability test
 on:
  schedule:
    - cron: "0 */1 * * *" #run every hour
@@ -7,22 +7,20 @@ permissions: {}

 # This job relies on k8s pre-installed using kubeadm
 jobs:
-  run-containerd-guest-pull-stability-tests:
-    name: run-containerd-guest-pull-stability-tests-${{ matrix.environment.test-type }}-${{ matrix.environment.containerd }}
+  run-containerd-multi-snapshotter-stability-tests:
+    name: run-containerd-multi-snapshotter-stability-tests
    strategy:
      fail-fast: false
      matrix:
-        environment: [
-          { test-type: multi-snapshotter, containerd: v2.2 },
-          { test-type: force-guest-pull, containerd: v1.7 },
-          { test-type: force-guest-pull, containerd: v2.0 },
-          { test-type: force-guest-pull, containerd: v2.1 },
-          { test-type: force-guest-pull, containerd: v2.2 },
-        ]
+        containerd:
+          - v1.7
+          - v2.0
+          - v2.1
+          - v2.2
    env:
      # I don't want those to be inside double quotes, so I'm deliberately ignoring the double quotes here.
      IMAGES_LIST: quay.io/mongodb/mongodb-community-server@sha256:8b73733842da21b6bbb6df4d7b2449229bb3135d2ec8c6880314d88205772a11 ghcr.io/edgelesssys/redis@sha256:ecb0a964c259a166a1eb62f0eb19621d42bd1cce0bc9bb0c71c828911d4ba93d
-    runs-on: containerd-${{ matrix.environment.test-type }}-${{ matrix.environment.containerd }}
+    runs-on: containerd-${{ matrix.containerd }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -39,9 +37,8 @@ jobs:
        env:
          KATA_HYPERVISOR: qemu-coco-dev
          KUBERNETES: vanilla
-          SNAPSHOTTER: ${{ matrix.environment.test-type == 'multi-snapshotter' && 'nydus' || '' }}
-          USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ matrix.environment.test-type == 'multi-snapshotter' }}
-          EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.environment.test-type == 'force-guest-pull' && 'qemu-coco-dev' || '' }}
+          SNAPSHOTTER: nydus
+          USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: true

      # This is needed as we may hit the createContainerTimeout
      - name: Adjust Kata Containers' create_container_timeout
--- a/.github/workflows/run-k8s-tests-on-aks.yaml
+++ b/.github/workflows/run-k8s-tests-on-aks.yaml
@@ -49,6 +49,7 @@ jobs:
          - dragonball
          - qemu
          - qemu-runtime-rs
+          - stratovirt
          - cloud-hypervisor
        instance-type:
          - small
@@ -58,13 +59,16 @@ jobs:
            vmm: clh
            instance-type: small
            genpolicy-pull-method: oci-distribution
+            auto-generate-policy: yes
          - host_os: cbl-mariner
            vmm: clh
            instance-type: small
            genpolicy-pull-method: containerd
+            auto-generate-policy: yes
          - host_os: cbl-mariner
            vmm: clh
            instance-type: normal
+            auto-generate-policy: yes
    runs-on: ubuntu-22.04
    permissions:
      contents: read
@@ -78,8 +82,10 @@ jobs:
      KATA_HOST_OS: ${{ matrix.host_os }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: "vanilla"
+      USING_NFD: "false"
      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
      GENPOLICY_PULL_METHOD: ${{ matrix.genpolicy-pull-method }}
+      AUTO_GENERATE_POLICY: ${{ matrix.auto-generate-policy }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -135,7 +141,7 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks

      - name: Run tests
@@ -143,7 +149,6 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh run-tests

      - name: Refresh OIDC token in case access token expired
-        if: always()
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ secrets.AZ_APPID }}
--- a/.github/workflows/run-k8s-tests-on-amd64.yaml
+++ b/.github/workflows/run-k8s-tests-on-amd64.yaml
@@ -0,0 +1,130 @@
+name: CI | Run kubernetes tests on amd64
+on:
+  workflow_call:
+    inputs:
+      registry:
+        required: true
+        type: string
+      repo:
+        required: true
+        type: string
+      tag:
+        required: true
+        type: string
+      pr-number:
+        required: true
+        type: string
+      commit-hash:
+        required: false
+        type: string
+      target-branch:
+        required: false
+        type: string
+        default: ""
+
+permissions: {}
+
+jobs:
+  run-k8s-tests-amd64:
+    name: run-k8s-tests-amd64
+    strategy:
+      fail-fast: false
+      matrix:
+        vmm:
+          - qemu
+        container_runtime:
+          - containerd
+        snapshotter:
+          - devmapper
+        k8s:
+          - k3s
+        include:
+          - vmm: qemu
+            container_runtime: crio
+            snapshotter: ""
+            k8s: k0s
+    runs-on: ubuntu-22.04
+    env:
+      DOCKER_REGISTRY: ${{ inputs.registry }}
+      DOCKER_REPO: ${{ inputs.repo }}
+      DOCKER_TAG: ${{ inputs.tag }}
+      GH_PR_NUMBER: ${{ inputs.pr-number }}
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+      KUBERNETES: ${{ matrix.k8s }}
+      KUBERNETES_EXTRA_PARAMS: ${{ matrix.container_runtime != 'crio' && '' || '--cri-socket remote:unix:///var/run/crio/crio.sock --kubelet-extra-args --cgroup-driver="systemd"' }}
+      SNAPSHOTTER: ${{ matrix.snapshotter }}
+      USING_NFD: "false"
+      K8S_TEST_HOST_TYPE: all
+      CONTAINER_RUNTIME: ${{ matrix.container_runtime }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Remove unnecessary directories to free up space
+        run: |
+          sudo rm -rf /usr/local/.ghcup
+          sudo rm -rf /opt/hostedtoolcache/CodeQL
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /usr/local/share/boost
+          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
+          sudo rm -rf /usr/lib/jvm
+          sudo rm -rf /usr/share/swift
+          sudo rm -rf /usr/local/share/powershell
+          sudo rm -rf /usr/local/julia*
+          sudo rm -rf /opt/az
+          sudo rm -rf /usr/local/share/chromium
+          sudo rm -rf /opt/microsoft
+          sudo rm -rf /opt/google
+          sudo rm -rf /usr/lib/firefox
+
+      - name: Configure CRI-O
+        if: matrix.container_runtime == 'crio'
+        run: bash tests/integration/kubernetes/gha-run.sh setup-crio
+
+      - name: Deploy ${{ matrix.k8s }}
+        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
+        env:
+          CONTAINER_RUNTIME: ${{ matrix.container_runtime }}
+
+      - name: Configure the ${{ matrix.snapshotter }} snapshotter
+        if: matrix.snapshotter != ''
+        run: bash tests/integration/kubernetes/gha-run.sh configure-snapshotter
+
+      - name: Deploy Kata
+        timeout-minutes: 10
+        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
+
+      - name: Install `bats`
+        run: bash tests/integration/kubernetes/gha-run.sh install-bats
+
+      - name: Run tests
+        timeout-minutes: 30
+        run: bash tests/integration/kubernetes/gha-run.sh run-tests
+
+      - name: Collect artifacts ${{ matrix.vmm }}
+        if: always()
+        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
+        continue-on-error: true
+
+      - name: Archive artifacts ${{ matrix.vmm }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: k8s-tests-${{ matrix.vmm }}-${{ matrix.snapshotter }}-${{ matrix.k8s }}-${{ inputs.tag }}
+          path: /tmp/artifacts
+          retention-days: 1
+
+      - name: Delete kata-deploy
+        if: always()
+        timeout-minutes: 5
+        run: bash tests/integration/kubernetes/gha-run.sh cleanup
--- a/.github/workflows/run-k8s-tests-on-arm64.yaml
+++ b/.github/workflows/run-k8s-tests-on-arm64.yaml
@@ -42,6 +42,7 @@ jobs:
      GH_PR_NUMBER: ${{ inputs.pr-number }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: ${{ matrix.k8s }}
+      USING_NFD: "false"
      K8S_TEST_HOST_TYPE: all
      TARGET_ARCH: "aarch64"
    steps:
@@ -58,7 +59,7 @@ jobs:
          TARGET_BRANCH: ${{ inputs.target-branch }}

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata

      - name: Install `bats`
@@ -82,5 +83,5 @@ jobs:

      - name: Delete kata-deploy
        if: always()
-        timeout-minutes: 15
+        timeout-minutes: 5
        run: bash tests/integration/kubernetes/gha-run.sh cleanup
--- a/.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml
+++ b/.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml
@@ -29,23 +29,24 @@ permissions: {}

 jobs:
  run-nvidia-gpu-tests-on-amd64:
-    name: run-${{ matrix.environment.name }}-tests-on-amd64
+    name: run-nvidia-gpu-tests-on-amd64
    strategy:
      fail-fast: false
      matrix:
-        environment: [
-          { name: nvidia-gpu,     vmm: qemu-nvidia-gpu,     runner: amd64-nvidia-a100 },
-          { name: nvidia-gpu-snp, vmm: qemu-nvidia-gpu-snp, runner: amd64-nvidia-h100-snp },
-        ]
-    runs-on: ${{ matrix.environment.runner }}
+        vmm:
+          - qemu-nvidia-gpu
+        k8s:
+          - kubeadm
+    runs-on: amd64-nvidia-a100
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
      DOCKER_TAG: ${{ inputs.tag }}
      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.environment.vmm }}
-      KUBERNETES: kubeadm
-      K8S_TEST_HOST_TYPE: baremetal
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+      KUBERNETES: ${{ matrix.k8s }}
+      USING_NFD: "false"
+      K8S_TEST_HOST_TYPE: all
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -59,54 +60,31 @@ jobs:
        env:
          TARGET_BRANCH: ${{ inputs.target-branch }}

-      - name: Uninstall previous `kbs-client`
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
-
-      - name: Deploy CoCo KBS
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-        env:
-          NVIDIA_VERIFIER_MODE: remote
-          KBS_INGRESS: nodeport
-
-      - name: Install `kbs-client`
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata

      - name: Install `bats`
        run: bash tests/integration/kubernetes/gha-run.sh install-bats

-      - name: Run tests ${{ matrix.environment.vmm }}
+      - name: Run tests
        timeout-minutes: 30
        run: bash tests/integration/kubernetes/gha-run.sh run-nv-tests
        env:
          NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
-      - name: Collect artifacts ${{ matrix.environment.vmm }}
+      - name: Collect artifacts ${{ matrix.vmm }}
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
        continue-on-error: true

-      - name: Archive artifacts ${{ matrix.environment.vmm }}
+      - name: Archive artifacts ${{ matrix.vmm }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
-          name: k8s-tests-${{ matrix.environment.vmm }}-kubeadm-${{ inputs.tag }}
+          name: k8s-tests-${{ matrix.vmm }}-${{ matrix.k8s }}-${{ inputs.tag }}
          path: /tmp/artifacts
          retention-days: 1

      - name: Delete kata-deploy
        if: always()
-        timeout-minutes: 15
+        timeout-minutes: 5
        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
-      - name: Delete CoCo KBS
-        if: always() && matrix.environment.name != 'nvidia-gpu'
-        run: |
-          bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
--- a/.github/workflows/run-k8s-tests-on-ppc64le.yaml
+++ b/.github/workflows/run-k8s-tests-on-ppc64le.yaml
@@ -34,7 +34,7 @@ jobs:
          - qemu
        k8s:
          - kubeadm
-    runs-on: ppc64le-k8s
+    runs-on: k8s-ppc64le
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
@@ -43,6 +43,7 @@ jobs:
      GOPATH: ${{ github.workspace }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: ${{ matrix.k8s }}
+      USING_NFD: "false"
      TARGET_ARCH: "ppc64le"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -62,16 +63,19 @@ jobs:
          ./tests/install_go.sh -f -p
          echo "/usr/local/go/bin" >> "$GITHUB_PATH"

-      - name: Prepare the runner for k8s test suite
-        run: bash "${HOME}/scripts/k8s_cluster_prepare.sh"
+      - name: Prepare the runner for k8s cluster creation
+        run: bash "${HOME}/scripts/k8s_cluster_cleanup.sh"

-      - name: Check if cluster is healthy to run the tests
-        run: bash "${HOME}/scripts/k8s_cluster_check.sh"
+      - name: Create k8s cluster using kubeadm
+        run: bash "${HOME}/scripts/k8s_cluster_create.sh"

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-kubeadm

      - name: Run tests
        timeout-minutes: 30
        run: bash tests/integration/kubernetes/gha-run.sh run-tests
+
+      - name: Delete cluster and post cleanup actions
+        run: bash "${HOME}/scripts/k8s_cluster_cleanup.sh"
--- a/.github/workflows/run-k8s-tests-on-zvsi.yaml
+++ b/.github/workflows/run-k8s-tests-on-zvsi.yaml
@@ -46,9 +46,11 @@ jobs:
        include:
          - snapshotter: devmapper
            pull-type: default
+            using-nfd: true
            deploy-cmd: configure-snapshotter
          - snapshotter: nydus
            pull-type: guest-pull
+            using-nfd: false
            deploy-cmd: deploy-snapshotter
        exclude:
          - snapshotter: overlayfs
@@ -74,6 +76,7 @@ jobs:
      KUBERNETES: ${{ matrix.k8s }}
      PULL_TYPE: ${{ matrix.pull-type }}
      SNAPSHOTTER: ${{ matrix.snapshotter }}
+      USING_NFD: ${{ matrix.using-nfd }}
      TARGET_ARCH: "s390x"
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
@@ -109,7 +112,7 @@ jobs:
        if: ${{ matrix.snapshotter != 'overlayfs' }}

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-zvsi

      - name: Uninstall previous `kbs-client`
--- a/.github/workflows/run-kata-coco-stability-tests.yaml
+++ b/.github/workflows/run-kata-coco-stability-tests.yaml
@@ -70,6 +70,7 @@ jobs:
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
      SNAPSHOTTER: ${{ matrix.snapshotter }}
+      USING_NFD: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -140,7 +141,6 @@ jobs:
        run: bash tests/stability/gha-stability-run.sh run-tests

      - name: Refresh OIDC token in case access token expired
-        if: always()
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ secrets.AZ_APPID }}
--- a/.github/workflows/run-kata-coco-tests.yaml
+++ b/.github/workflows/run-kata-coco-tests.yaml
@@ -57,6 +57,7 @@ jobs:
      GH_PR_NUMBER: ${{ inputs.pr-number }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: "vanilla"
+      USING_NFD: "false"
      KBS: "true"
      K8S_TEST_HOST_TYPE: "baremetal"
      KBS_INGRESS: "nodeport"
@@ -80,7 +81,7 @@ jobs:
          TARGET_BRANCH: ${{ inputs.target-branch }}

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata

      - name: Uninstall previous `kbs-client`
@@ -131,14 +132,12 @@ jobs:
      matrix:
        vmm:
          - qemu-coco-dev
-          - qemu-coco-dev-runtime-rs
        snapshotter:
          - nydus
        pull-type:
          - guest-pull
        include:
          - pull-type: experimental-force-guest-pull
-            vmm: qemu-coco-dev
            snapshotter: ""
    runs-on: ubuntu-22.04
    permissions:
@@ -164,6 +163,7 @@ jobs:
      # host type chose it will result on the creation of a cluster with
      # insufficient resources.
      K8S_TEST_HOST_TYPE: "all"
+      USING_NFD: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -214,7 +214,7 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
        env:
          EXPERIMENTAL_FORCE_GUEST_PULL: ${{ env.PULL_TYPE == 'experimental-force-guest-pull' && env.KATA_HYPERVISOR || '' }}
@@ -242,7 +242,6 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh report-tests

      - name: Refresh OIDC token in case access token expired
-        if: always()
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ secrets.AZ_APPID }}
@@ -251,7 +250,6 @@ jobs:

      - name: Delete AKS cluster
        if: always()
-        timeout-minutes: 15
        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

  # Generate jobs for testing CoCo on non-TEE environments with erofs-snapshotter
@@ -285,6 +283,7 @@ jobs:
      SNAPSHOTTER: ${{ matrix.snapshotter }}
      USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: "true"
      K8S_TEST_HOST_TYPE: "all"
+      USING_NFD: "false"
      # We are skipping the auto generated policy tests for now,
      # but those should be enabled as soon as we work on that.
      AUTO_GENERATE_POLICY: "no"
@@ -330,7 +329,7 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh install-bats

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata

      - name: Deploy CSI driver
--- a/.github/workflows/run-kata-deploy-tests-on-aks.yaml
+++ b/.github/workflows/run-kata-deploy-tests-on-aks.yaml
@@ -59,6 +59,7 @@ jobs:
      KATA_HOST_OS: ${{ matrix.host_os }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: "vanilla"
+      USING_NFD: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -103,7 +104,6 @@ jobs:
        run: bash tests/functional/kata-deploy/gha-run.sh run-tests

      - name: Refresh OIDC token in case access token expired
-        if: always()
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ secrets.AZ_APPID }}
--- a/.github/workflows/run-kata-deploy-tests.yaml
+++ b/.github/workflows/run-kata-deploy-tests.yaml
@@ -45,6 +45,7 @@ jobs:
      GH_PR_NUMBER: ${{ inputs.pr-number }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: ${{ matrix.k8s }}
+      USING_NFD: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
--- a/.github/workflows/run-metrics.yaml
+++ b/.github/workflows/run-metrics.yaml
@@ -44,6 +44,7 @@ jobs:
      DOCKER_TAG: ${{ inputs.tag }}
      GH_PR_NUMBER: ${{ inputs.pr-number }}
      K8S_TEST_HOST_TYPE: "baremetal"
+      USING_NFD: "false"
      KUBERNETES: kubeadm
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
--- a/.github/workflows/static-checks-self-hosted.yaml
+++ b/.github/workflows/static-checks-self-hosted.yaml
@@ -28,9 +28,21 @@ jobs:
      fail-fast: false
      matrix:
        instance:
-          - "ubuntu-24.04-arm"
-          - "s390x"
+          - "ubuntu-22.04-arm"
+          - "ubuntu-24.04-s390x"
          - "ubuntu-24.04-ppc64le"
    uses: ./.github/workflows/build-checks.yaml
    with:
      instance: ${{ matrix.instance }}
+
+  build-checks-preview:
+    needs: skipper
+    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        instance:
+          - "riscv-builder"
+    uses: ./.github/workflows/build-checks-preview-riscv64.yaml
+    with:
+      instance: ${{ matrix.instance }}
--- a/README.md
+++ b/README.md
@@ -1,3 +1,5 @@
+foo
+
 <img src="https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-images-prod/openstack-logo/kata/SVG/kata-1.svg" width="900">

 [![CI | Publish Kata Containers payload](https://github.com/kata-containers/kata-containers/actions/workflows/payload-after-push.yaml/badge.svg)](https://github.com/kata-containers/kata-containers/actions/workflows/payload-after-push.yaml) [![Kata Containers Nightly CI](https://github.com/kata-containers/kata-containers/actions/workflows/ci-nightly.yaml/badge.svg)](https://github.com/kata-containers/kata-containers/actions/workflows/ci-nightly.yaml)
--- a/2
+++ b/2
@@ -1 +1 @@
-3.22.0
+3.21.0
--- a/ci/openshift-ci/cluster/install_kata.sh
+++ b/ci/openshift-ci/cluster/install_kata.sh
@@ -44,9 +44,8 @@ WORKAROUND_9206_CRIO=${WORKAROUND_9206_CRIO:-no}
 #
 apply_kata_deploy() {
 	if ! command -v helm &>/dev/null; then
-		echo "Helm not installed, installing in current location..."
-		PATH=".:${PATH}"
-		curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | HELM_INSTALL_DIR='.' bash -s -- --no-sudo
+		echo "Helm not installed, installing..."
+		curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 	fi

 	oc label --overwrite ns kube-system pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
@@ -54,9 +53,6 @@ apply_kata_deploy() {
 	version=$(curl -sSL https://api.github.com/repos/kata-containers/kata-containers/releases/latest | jq .tag_name | tr -d '"')
 	chart="oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy"

-	# Ensure any potential leftover is cleaned up ... and this secret usually is not in case of previous failures
-	oc delete secret sh.helm.release.v1.kata-deploy.v1 -n kube-system || true
-
 	echo "Installing kata using helm ${chart} ${version}"
 	helm install kata-deploy --wait --namespace kube-system --set "image.reference=${KATA_DEPLOY_IMAGE%%:*},image.tag=${KATA_DEPLOY_IMAGE##*:}" "${chart}" --version "${version}"
 }
--- a/docs/Limitations.md
+++ b/docs/Limitations.md
@@ -168,55 +168,16 @@ See [this issue](https://github.com/kata-containers/runtime/issues/2812) for mor

 ### Kubernetes [hostPath][k8s-hostpath] volumes

-In Kata, Kubernetes hostPath volumes can mount host directories and
-regular files into the guest VM via filesystem sharing, if it is enabled
-through the `shared_fs` [configuration][runtime-config] flag.
+When the source path of a hostPath volume is under `/dev`, and the path
+either corresponds to a host device or is not accessible by the Kata
+shim, the Kata agent bind mounts the source path directly from the
+*guest* filesystem into the container.

-By default:
-
- - Non-TEE environment: Filesystem sharing is used to mount host files.
- - TEE environment: Filesystem sharing is disabled. Instead, host files
-   are copied into the guest VM when the container starts, and file
-   changes are *not* synchronized between the host and the guest.
-
-In some cases, the behavior of hostPath volumes in Kata is further
-different compared to `runc` containers:
-
-**Mounting host block devices**: When a hostPath volume is of type
-[`BlockDevice`][k8s-blockdevice], Kata hotplugs the host block device
-into the guest and exposes it directly to the container.
-
-**Mounting guest devices**: When the source path of a hostPath volume is
-under `/dev`, and the path either corresponds to a host device or is not
-accessible by the Kata shim, the Kata agent bind mounts the source path
-directly from the *guest* filesystem into the container.
-
-[runtime-config]: /src/runtime/README.md#configuration
 [k8s-hostpath]: https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
-[k8s-blockdevice]: https://kubernetes.io/docs/concepts/storage/volumes/#hostpath-volume-types

-### Mounting `procfs` and `sysfs`
+## Host resource sharing

-For security reasons, the following mounts are disallowed:
-
-| Type              | Source    | Destination                      | Rationale      |
-|-------------------|-----------|----------------------------------|----------------|
-| `bind`            | `!= proc` | `/proc`                          | CVE-2019-16884 |
-| `bind`            | `*`       | `/proc/*` (see exceptions below) | CVE-2019-16884 |
-| `proc \|\| sysfs` | `*`       | not a directory (e.g. symlink)   | CVE-2019-19921 |
-
-For bind mounts under /proc, these destinations are allowed:
-	
- * `/proc/cpuinfo`
- * `/proc/diskstats`
- * `/proc/meminfo`
- * `/proc/stat`
- * `/proc/swaps`
- * `/proc/uptime`
- * `/proc/loadavg`
- * `/proc/net/dev`
-
-## Privileged containers
+### Privileged containers

 Privileged support in Kata is essentially different from `runc` containers.
 The container runs with elevated capabilities within the guest.
--- a/docs/how-to/README.md
+++ b/docs/how-to/README.md
@@ -31,7 +31,6 @@
 - [Setting Sysctls with Kata](how-to-use-sysctls-with-kata.md)
 - [What Is VMCache and How To Enable It](what-is-vm-cache-and-how-do-I-use-it.md)
 - [What Is VM Templating and How To Enable It](what-is-vm-templating-and-how-do-I-use-it.md)
- [How to Use Template in runtime-rs](how-to-use-template-in-runtime-rs.md)
 - [Privileged Kata Containers](privileged.md)
 - [How to load kernel modules in Kata Containers](how-to-load-kernel-modules-with-kata.md)
 - [How to use Kata Containers with `virtio-mem`](how-to-use-virtio-mem-with-kata.md)
--- a/docs/how-to/how-to-use-kata-containers-with-firecracker.md
+++ b/docs/how-to/how-to-use-kata-containers-with-firecracker.md
@@ -104,20 +104,12 @@ LOW_WATER_MARK=32768
 sudo dmsetup create "${POOL_NAME}" \
    --table "0 ${LENGTH_IN_SECTORS} thin-pool ${META_DEV} ${DATA_DEV} ${DATA_BLOCK_SIZE} ${LOW_WATER_MARK}"

-# Determine plugin name based on containerd config version
-CONFIG_VERSION=$(containerd config dump | awk '/^version/ {print $3}')
-if [ "$CONFIG_VERSION" -ge 2 ]; then
-    PLUGIN="io.containerd.snapshotter.v1.devmapper"
-else
-    PLUGIN="devmapper"
-fi
-
 cat << EOF
 #
 # Add this to your config.toml configuration file and restart containerd daemon
 #
 [plugins]
-  [plugins."${PLUGIN}"]
+  [plugins.devmapper]
    pool_name = "${POOL_NAME}"
    root_path = "${DATA_DIR}"
    base_image_size = "10GB"
--- a/docs/how-to/how-to-use-template-in-runtime-rs.md
+++ b/docs/how-to/how-to-use-template-in-runtime-rs.md
@@ -1,119 +0,0 @@
-# How to Use Template in runtime-rs
-
-## What is VM Templating
-
-VM templating is a Kata Containers feature that enables new VM creation using a cloning technique. When enabled, new VMs are created by cloning from a pre-created template VM, and they will share the same initramfs, kernel and agent memory in readonly mode. It is very much like a process fork done by the kernel but here we *fork* VMs.
-
-For more details on VM templating, refer to the [What is VM templating and how do I use it](./what-is-vm-templating-and-how-do-I-use-it.md) article.
-
-## How to Enable VM Templating
-
-VM templating can be enabled by changing your Kata Containers config file (`/opt/kata/share/defaults/kata-containers/runtime-rs/configuration.toml`, overridden by `/etc/kata-containers/configuration.toml` if provided) such that:
-
- `qemu` version `v4.1.0` or above is specified in `hypervisor.qemu`->`path` section
- `enable_template = true`
- `template_path = "/run/vc/vm/template"` (default value, can be customized as needed)
- `initrd =` is set
- `image =` option is commented out or removed
- `shared_fs =` option is commented out or removed
- `default_memory =` should be set to more than 256MB
-
-Then you can create a VM template for later usage by calling:
-
-### Initialize and create the VM template
-The `factory init` command creates a VM template by launching a new VM, initializing the Kata Agent, then pausing and saving its state (memory and device snapshots) to the template directory. This saved template is used to rapidly clone new VMs using QEMU's memory sharing capabilities.
-
-```bash
-sudo kata-ctl factory init
-```
-
-### Check the status of the VM template
-
-The `factory status` command checks whether a VM template currently exists by verifying the presence of template files (memory snapshot and device state). It will output "VM factory is on" if the template exists, or "VM factory is off" otherwise.
-
-```bash
-sudo kata-ctl factory status
-```
-
-### Destroy and clean up the VM template
-
-The `factory destroy` command removes the VM template by remove the `tmpfs` filesystem and deleting the template directory along with all its contents.
-
-```bash
-sudo kata-ctl factory destroy
-```
-
-## How to Create a New VM from VM Template
-In the Go version of Kata Containers, the VM templating mechanism is implemented using virtio-9p (9pfs). However, 9pfs is not supported in runtime-rs due to its poor performance, limited cache coherence, and security risks. Instead, runtime-rs adopts `VirtioFS` as the default mechanism to provide rootfs for containers and VMs.
-
-Yet, when enabling the VM template mechanism, `VirtioFS` introduces conflicts in memory sharing because its DAX-based shared memory mapping overlaps with the template's page-sharing design. To resolve these conflicts and ensure strict isolation between cloned VMs, runtime-rs replaces `VirtioFS` with the snapshotter approach — specifically, the `blockfile` snapshotter.
-
-The `blockfile` snapshotter is used in runtime-rs because it provides each VM with an independent block-based root filesystem, ensuring strong isolation and full compatibility with the VM templating mechanism.
-
-### Configure Snapshotter
-
-#### Check if `Blockfile` Snapshotter is Available
-```bash
-ctr plugins ls | grep blockfile
-```
-
-If not available, continue with the following steps:
-
-#### Create Scratch File
-```bash
-dd if=/dev/zero of=/opt/containerd/blockfile bs=1M count=500
-sudo mkfs.ext4 /opt/containerd/blockfile
-```
-
-#### Configure containerd
-Edit the containerd configuration file:
-```bash
-sudo vim /etc/containerd/config.toml
-```
-Add or modify the following configuration for the `blockfile` snapshotter:
-```toml
-[plugins."io.containerd.snapshotter.v1.blockfile"]
-  scratch_file = "/opt/containerd/blockfile"
-  root_path = ""
-  fs_type = "ext4"
-  mount_options = []
-  recreate_scratch = true
-```
-
-#### Restart containerd
-After modifying the configuration, restart containerd to apply changes:
-
-```bash
-sudo systemctl restart containerd
-```
-
-### Run Container with `blockfile` Snapshotter
-After the VM template is created, you can pull an image and run a container using the `blockfile` snapshotter:
-
-```bash
-ctr run --rm -t --snapshotter blockfile docker.io/library/busybox:latest template sh
-```
-
-We can verify whether a VM was launched from a template or started normally by checking the launch parameters — if the parameters contain `incoming`, it indicates that the VM was started from a template rather than created directly.
-
-## Performance Test
-
-The comparative experiment between **template-based VM** creation and **direct VM** creation showed that the template-based approach achieved a ≈ **73.2%** reduction in startup latency (average launch time of **0.6s** vs. **0.82s**) and a ≈ **79.8%** reduction in memory usage (average memory usage of **178.2 MiB** vs. **223.2 MiB**), demonstrating significant improvements in VM startup efficiency and resource utilization.
-
-The test script is as follows:
-
-```bash
-# Clear the page cache, dentries, and inodes to free up memory
-echo 3 | sudo tee /proc/sys/vm/drop_caches
-
-# Display the current memory usage
-free -h
-
-# Create 100 normal VMs and template-based VMs, and track the time
-time for I in $(seq 100); do
-  echo -n " ${I}th"  # Display the iteration number
-  ctr run -d --runtime io.containerd.kata.v2 --snapshotter blockfile docker.io/library/busybox:latest normal/template${I}
-done
-
-# Display the memory usage again after running the test
-free -h
--- a/docs/install/README.md
+++ b/docs/install/README.md
@@ -8,11 +8,50 @@ Kata Containers requires nested virtualization or bare metal. Check
 [hardware requirements](./../../README.md#hardware-requirements) to see if your system is capable of running Kata 
 Containers.

-The Kata Deploy Helm chart is the preferred  way to install all of the binaries and
+## Packaged installation methods
+
+The packaged installation method uses your distribution's native package format (such as RPM or DEB).
+
+> **Note:**
+>
+> We encourage you to select an installation method that provides
+> automatic updates, to ensure you get the latest security updates and
+> bug fixes.
+
+| Installation method                                  | Description                                                                                  | Automatic updates | Use case                                                                                      |
+|------------------------------------------------------|----------------------------------------------------------------------------------------------|-------------------|-----------------------------------------------------------------------------------------------|
+| [Using official distro packages](#official-packages) | Kata packages provided by Linux distributions official repositories                          | yes               | Recommended for most users.                                                                   |
+| [Automatic](#automatic-installation)                 | Run a single command to install a full system                                                | **No!**           | For those wanting the latest release quickly.                                                 |
+| [Using kata-deploy Helm chart](#kata-deploy-helm-chart)       | The preferred way to deploy the Kata Containers distributed binaries on a Kubernetes cluster | **No!**           | Best way to give it a try on kata-containers on an already up and running Kubernetes cluster. |
+
+### Kata Deploy Helm Chart
+
+The Kata Deploy Helm chart is a convenient way to install all of the binaries and
 artifacts required to run Kata Containers on Kubernetes.

 [Use Kata Deploy Helm Chart](/tools/packaging/kata-deploy/helm-chart/README.md) to install Kata Containers on a Kubernetes Cluster.

+### Official packages
+
+Kata packages are provided by official distribution repositories for:
+
+| Distribution (link to installation guide)                | Minimum versions                                                               |
+|----------------------------------------------------------|--------------------------------------------------------------------------------|
+| [CentOS](centos-installation-guide.md)                   | 8                                                                              |
+| [Fedora](fedora-installation-guide.md)                   | 34                                                                             |
+
+### Automatic Installation
+
+[Use `kata-manager`](/utils/README.md) to automatically install a working Kata Containers system.
+
+## Installing on a Cloud Service Platform
+
+* [Amazon Web Services (AWS)](aws-installation-guide.md)
+* [Google Compute Engine (GCE)](gce-installation-guide.md)
+* [Microsoft Azure](azure-installation-guide.md)
+* [Minikube](minikube-installation-guide.md)
+* [VEXXHOST OpenStack Cloud](vexxhost-installation-guide.md)
+
 ## Further information

 * [upgrading document](../Upgrading.md)
--- a/docs/install/aws-installation-guide.md
+++ b/docs/install/aws-installation-guide.md
@@ -0,0 +1,135 @@
+# Install Kata Containers on Amazon Web Services
+
+Kata Containers on Amazon Web Services (AWS) makes use of [i3.metal](https://aws.amazon.com/ec2/instance-types/i3/) instances. Most of the installation procedure is identical to that for Kata on your preferred distribution, except that you have to run it on bare metal instances since AWS doesn't support nested virtualization yet. This guide walks you through creating an i3.metal instance.
+
+## Install and Configure AWS CLI
+
+### Requirements
+
+* Python:
+  * Python 2 version 2.6.5+
+  * Python 3 version 3.3+
+
+### Install
+
+Install with this command:
+
+```bash
+$ pip install awscli --upgrade --user
+```
+
+### Configure
+
+First, verify it:
+
+```bash
+$ aws --version
+```
+
+Then configure it:
+
+```bash
+$ aws configure
+```
+
+Specify the required parameters:
+
+```
+AWS Access Key ID []: <your-key-id-from-iam>
+AWS Secret Access Key []: <your-secret-access-key-from-iam>
+Default region name []: <your-aws-region-for-your-i3-metal-instance>
+Default output format [None]: <yaml-or-json-or-empty>
+```
+
+Alternatively, you can create the files: `~/.aws/credentials` and `~/.aws/config`:
+
+```bash
+$ cat <<EOF > ~/.aws/credentials
+[default]
+aws_access_key_id = <your-key-id-from-iam>
+aws_secret_access_key = <your-secret-access-key-from-iam>
+EOF
+$ cat <<EOF > ~/.aws/config
+[default]
+region = <your-aws-region-for-your-i3-metal-instance>
+EOF
+```
+
+For more information on how to get AWS credentials please refer to [this guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). Alternatively, you can ask the administrator of your AWS account to issue one with the AWS CLI:
+
+```sh
+$ aws_username="myusername"
+$ aws iam create-access-key --user-name="$aws_username"
+```
+
+More general AWS CLI guidelines can be found [here](https://docs.aws.amazon.com/cli/latest/userguide/installing.html).
+
+## Create or Import an EC2 SSH key pair
+
+You will need this to access your instance.
+
+To create:
+
+```bash
+$ aws ec2 create-key-pair --key-name MyKeyPair | grep KeyMaterial | cut -d: -f2- | tr -d ' \n\"\,' > MyKeyPair.pem
+$ chmod 400 MyKeyPair.pem
+```
+
+Alternatively to import using your public SSH key:
+
+```bash
+$ aws ec2 import-key-pair --key-name "MyKeyPair" --public-key-material file://MyKeyPair.pub
+```
+
+## Launch i3.metal instance
+
+Get the latest Bionic Ubuntu AMI (Amazon Image) or the latest AMI for the Linux distribution you would like to use. For example:
+
+```bash
+$ aws ec2 describe-images --owners 099720109477 --filters "Name=name,Values=ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server*" --query 'sort_by(Images, &CreationDate)[].ImageId '
+```
+
+This command will produce output similar to the following:
+
+```
+[
+    ...
+    "ami-063aa838bd7631e0b",
+    "ami-03d5270fcb641f79b"
+]
+```
+
+Launch the EC2 instance and pick IP the `INSTANCEID`:
+
+```bash
+$ aws ec2 run-instances --image-id ami-03d5270fcb641f79b --count 1 --instance-type i3.metal --key-name MyKeyPair --associate-public-ip-address > /tmp/aws.json
+$ export INSTANCEID=$(grep InstanceId /tmp/aws.json | cut -d: -f2- | tr -d ' \n\"\,')
+```
+
+Wait for the instance to come up, the output of the following command should be `running`:
+
+```bash
+$ aws ec2 describe-instances --instance-id=${INSTANCEID} | grep running | cut -d: -f2- | tr -d ' \"\,'
+```
+
+Get the public IP address for the instances:
+
+```bash
+$ export IP=$(aws ec2 describe-instances --instance-id=${INSTANCEID} | grep PublicIpAddress | cut -d: -f2- | tr -d ' \n\"\,')
+```
+
+Refer to [this guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-ec2-launch.html) for more details on how to launch instances with the AWS CLI.
+
+SSH into the machine
+
+```bash
+$ ssh -i MyKeyPair.pem ubuntu@${IP}
+```
+
+Go onto the next step.
+
+## Install Kata
+
+The process for installing Kata itself on bare metal is identical to that of a virtualization-enabled VM.
+
+For detailed information to install Kata on your distribution of choice, see the [Kata Containers installation user guides](../install/README.md).
--- a/docs/install/azure-installation-guide.md
+++ b/docs/install/azure-installation-guide.md
@@ -0,0 +1,18 @@
+# Install Kata Containers on Microsoft Azure
+
+Kata Containers on Azure use nested virtualization to provide an identical installation
+experience to Kata on your preferred Linux distribution.
+
+This guide assumes you have an Azure account set up and tools to remotely login to your virtual
+machine (SSH). Instructions will use the Azure Portal to avoid
+local dependencies and setup.
+
+## Create a new virtual machine with nesting support
+
+Create a new virtual machine with:
+* Nesting support (v3 series)
+* your distro of choice
+
+## Set up with distribution specific quick start
+
+Follow distribution specific [install guides](../install/README.md#packaged-installation-methods).
--- a/docs/install/centos-installation-guide.md
+++ b/docs/install/centos-installation-guide.md
@@ -0,0 +1,21 @@
+# Install Kata Containers on CentOS
+
+1. Install the Kata Containers components with the following commands:
+
+   ```bash
+   $ sudo -E dnf install -y centos-release-advanced-virtualization
+   $ sudo -E dnf module disable -y virt:rhel
+   $ source /etc/os-release
+   $ cat <<EOF | sudo -E tee /etc/yum.repos.d/kata-containers.repo
+     [kata-containers]
+     name=Kata Containers
+     baseurl=http://mirror.centos.org/\$contentdir/\$releasever/virt/\$basearch/kata-containers
+     enabled=1
+     gpgcheck=1
+     skip_if_unavailable=1
+     EOF
+   $ sudo -E dnf install -y kata-containers
+   ```
+
+2. Decide which container manager to use and select the corresponding link that follows:
+   - [Kubernetes](../Developer-Guide.md#run-kata-containers-with-kubernetes)
--- a/docs/install/fedora-installation-guide.md
+++ b/docs/install/fedora-installation-guide.md
@@ -0,0 +1,10 @@
+# Install Kata Containers on Fedora
+
+1. Install the Kata Containers components with the following commands:
+
+   ```bash
+   $ sudo -E dnf -y install kata-containers
+   ```
+
+2. Decide which container manager to use and select the corresponding link that follows:
+   - [Kubernetes](../Developer-Guide.md#run-kata-containers-with-kubernetes)
--- a/docs/install/gce-installation-guide.md
+++ b/docs/install/gce-installation-guide.md
@@ -0,0 +1,127 @@
+# Install Kata Containers on Google Compute Engine
+
+Kata Containers on Google Compute Engine (GCE) makes use of [nested virtualization](https://cloud.google.com/compute/docs/instances/enable-nested-virtualization-vm-instances). Most of the installation procedure is identical to that for Kata on your preferred distribution, but enabling nested virtualization currently requires extra steps on GCE. This guide walks you through creating an image and instance with nested virtualization enabled. Note that `kata-runtime check` checks for nested virtualization, but does not fail if support is not found.
+
+As a pre-requisite this guide assumes an installed and configured instance of the [Google Cloud SDK](https://cloud.google.com/sdk/downloads). For a zero-configuration option, all of the commands below were been tested under [Google Cloud Shell](https://cloud.google.com/shell/) (as of Jun 2018). Verify your `gcloud` installation and configuration:
+
+```bash
+$ gcloud info || { echo "ERROR: no Google Cloud SDK"; exit 1; }
+```
+
+## Create an Image with Nested Virtualization Enabled
+
+VM images on GCE are grouped into families under projects. Officially supported images are automatically discoverable with `gcloud compute images list`. That command produces a list similar to the following (likely with different image names):
+
+```bash
+$ gcloud compute images list
+NAME                                                  PROJECT            FAMILY                            DEPRECATED  STATUS
+centos-7-v20180523                                    centos-cloud       centos-7                                      READY
+coreos-stable-1745-5-0-v20180531                      coreos-cloud       coreos-stable                                 READY
+cos-beta-67-10575-45-0                                cos-cloud          cos-beta                                      READY
+cos-stable-66-10452-89-0                              cos-cloud          cos-stable                                    READY
+debian-9-stretch-v20180510                            debian-cloud       debian-9                                      READY
+rhel-7-v20180522                                      rhel-cloud         rhel-7                                        READY
+sles-11-sp4-v20180523                                 suse-cloud         sles-11                                       READY
+ubuntu-1604-xenial-v20180522                          ubuntu-os-cloud    ubuntu-1604-lts                               READY
+ubuntu-1804-bionic-v20180522                          ubuntu-os-cloud    ubuntu-1804-lts                               READY
+```
+
+Each distribution has its own project, and each project can host images for multiple versions of the distribution, typically grouped into families. We recommend you select images by project and family, rather than by name. This ensures any scripts or other automation always works with a non-deprecated image, including security updates, updates to GCE-specific scripts, etc.
+
+### Create the Image
+
+The following example (substitute your preferred distribution project and image family) produces an image with nested virtualization enabled in your currently active GCE project:
+
+```bash
+$ SOURCE_IMAGE_PROJECT=ubuntu-os-cloud
+$ SOURCE_IMAGE_FAMILY=ubuntu-1804-lts
+$ IMAGE_NAME=${SOURCE_IMAGE_FAMILY}-nested
+
+$ gcloud compute images create \
+    --source-image-project $SOURCE_IMAGE_PROJECT \
+    --source-image-family $SOURCE_IMAGE_FAMILY \
+    --licenses=https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx \
+    $IMAGE_NAME
+```
+
+If successful, `gcloud` reports that the image was created. Verify that the image has the nested virtualization license with `gcloud compute images describe $IMAGE_NAME`. This produces output like the following (some fields have been removed for clarity and to redact personal info):
+
+```yaml
+diskSizeGb: '10'
+kind: compute#image
+licenseCodes:
+  - '1002001'
+  - '5926592092274602096'
+licenses:
+  - https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx
+  - https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/licenses/ubuntu-1804-lts
+name: ubuntu-1804-lts-nested
+sourceImage: https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/images/ubuntu-1804-bionic-v20180522
+sourceImageId: '3280575157699667619'
+sourceType: RAW
+status: READY
+```
+
+The primary criterion of interest here is the presence of the `enable-vmx` license. Without that licence Kata will not work. Without that license Kata does not work. The presence of that license instructs the Google Compute Engine hypervisor to enable Intel's VT-x instructions in virtual machines created from the image. Note that nested virtualization is only available in VMs running on Intel Haswell or later CPU micro-architectures.
+
+### Verify VMX is Available
+
+Assuming you created a nested-enabled image using the previous instructions, verify that VMs created from this image are VMX-enabled with the following:
+
+1. Create a VM from the image created previously:
+
+    ```bash
+    $ gcloud compute instances create \
+        --image $IMAGE_NAME \
+        --machine-type n1-standard-2 \
+        --min-cpu-platform "Intel Broadwell" \
+        kata-testing
+    ```
+
+> **NOTE**: In most zones the `--min-cpu-platform` argument can be omitted. It is only necessary in GCE Zones that include hosts based on Intel's Ivybridge platform.
+
+2. Verify that the VMX CPUID flag is set:
+
+    ```bash
+    $ gcloud compute ssh kata-testing
+    
+    # While ssh'd into the VM:
+    $ [ -z "$(lscpu|grep GenuineIntel)" ] && { echo "ERROR: Need an Intel CPU"; exit 1; }
+    ```
+
+If this fails, ensure you created your instance from the correct image and that the previously listed `enable-vmx` license is included.
+
+## Install Kata
+
+The process for installing Kata itself on a virtualization-enabled VM is identical to that for bare metal.
+
+For detailed information to install Kata on your distribution of choice, see the [Kata Containers installation user guides](../install/README.md).
+
+## Create a Kata-enabled Image
+
+Optionally, after installing Kata, create an image to preserve the fruits of your labor:
+
+```bash
+$ gcloud compute instances stop kata-testing
+$ gcloud compute images create \
+    --source-disk kata-testing \
+    kata-base
+```
+
+The result is an image that includes any changes made to the `kata-testing` instance as well as the `enable-vmx` flag. Verify this with `gcloud compute images describe kata-base`. The result, which omits some fields for clarity, should be similar to the following:
+
+```yaml
+diskSizeGb: '10'
+kind: compute#image
+licenseCodes:
+  - '1002001'
+  - '5926592092274602096'
+licenses:
+  - https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx
+  - https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/licenses/ubuntu-1804-lts
+name: kata-base
+selfLink: https://www.googleapis.com/compute/v1/projects/my-kata-project/global/images/kata-base
+sourceDisk: https://www.googleapis.com/compute/v1/projects/my-kata-project/zones/us-west1-a/disks/kata-testing
+sourceType: RAW
+status: READY
+```
--- a/docs/install/vexxhost-installation-guide.md
+++ b/docs/install/vexxhost-installation-guide.md
@@ -0,0 +1,16 @@
+# Install Kata Containers on VEXXHOST
+
+Kata Containers on VEXXHOST use nested virtualization to provide an identical
+installation experience to Kata on your preferred Linux distribution.
+
+This guide assumes you have an OpenStack public cloud account set up and tools
+to remotely connect to your virtual machine (SSH).
+
+## Create a new virtual machine with nesting support
+
+All regions support nested virtualization using the V2 flavors (those prefixed
+with v2).  The recommended machine type for container workloads is `v2-highcpu` range.
+
+## Set up with distribution specific quick start
+
+Follow distribution specific [install guides](../install/README.md#packaged-installation-methods).
--- a/src/agent/Cargo.lock
+++ b/src/agent/Cargo.lock
@@ -2065,7 +2065,7 @@ dependencies = [
 "libc",
 "log",
 "logging",
- "mem-agent",
+ "mem-agent-lib",
 "netlink-packet-core",
 "netlink-packet-route",
 "netlink-sys 0.7.0",
@@ -2351,7 +2351,7 @@ dependencies = [
 ]

 [[package]]
-name = "mem-agent"
+name = "mem-agent-lib"
 version = "0.2.0"
 dependencies = [
 "anyhow",
--- a/src/agent/Cargo.toml
+++ b/src/agent/Cargo.toml
@@ -85,7 +85,7 @@ kata-agent-policy = { path = "policy" }
 rustjail = { path = "rustjail" }
 vsock-exporter = { path = "vsock-exporter" }

-mem-agent = { path = "../libs/mem-agent" }
+mem-agent = { path = "../mem-agent", package = "mem-agent-lib" }

 kata-sys-util = { path = "../libs/kata-sys-util" }
 kata-types = { path = "../libs/kata-types", features = ["safe-path"] }
--- a/src/agent/Makefile
+++ b/src/agent/Makefile
@@ -122,7 +122,7 @@ $(TARGET): $(GENERATED_CODE) $(TARGET_PATH)
 $(TARGET_PATH): show-summary
 	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)

-$(GENERATED_FILES): %: %.in $(VERSION_FILE)
+$(GENERATED_FILES): %: %.in
 	@sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@"

 ##TARGET optimize: optimized  build
--- a/src/agent/src/initdata.rs
+++ b/src/agent/src/initdata.rs
@@ -39,12 +39,6 @@ pub const CDH_CONFIG_PATH: &str = concatcp!(INITDATA_PATH, "/cdh.toml");
 /// Magic number of initdata device
 pub const INITDATA_MAGIC_NUMBER: &[u8] = b"initdata";

-/// initdata device with disk type 'vd*'
-const INITDATA_PREFIX_DISK_VDX: &str = "vd";
-
-/// initdata device with disk type 'sd*'
-const INITDATA_PREFIX_DISK_SDX: &str = "sd";
-
 async fn detect_initdata_device(logger: &Logger) -> Result<Option<String>> {
    let dev_dir = Path::new("/dev");
    let mut read_dir = tokio::fs::read_dir(dev_dir).await?;
@@ -52,15 +46,9 @@ async fn detect_initdata_device(logger: &Logger) -> Result<Option<String>> {
        let filename = entry.file_name();
        let filename = filename.to_string_lossy();
        debug!(logger, "Initdata check device `{filename}`");
-
-        // Currently there're two disk types supported:
-        // virtio-blk (vd*) and virtio-scsi (sd*)
-        if !filename.starts_with(INITDATA_PREFIX_DISK_VDX)
-            && !filename.starts_with(INITDATA_PREFIX_DISK_SDX)
-        {
+        if !filename.starts_with("vd") {
            continue;
        }
-
        let path = entry.path();

        debug!(logger, "Initdata find potential device: `{path:?}`");
--- a/src/agent/src/mount.rs
+++ b/src/agent/src/mount.rs
@@ -336,17 +336,11 @@ mod tests {
        let plain = slog_term::PlainSyncDecorator::new(std::io::stdout());
        let logger = Logger::root(slog_term::FullFormat::new(plain).build().fuse(), o!());

-        // Detect actual filesystem types mounted in this environment
-        // Z runners mount /dev as tmpfs, while normal systems use devtmpfs
-        let dev_fs_type = get_mount_fs_type("/dev").unwrap_or_else(|_| String::from("devtmpfs"));
-        let proc_fs_type = get_mount_fs_type("/proc").unwrap_or_else(|_| String::from("proc"));
-        let sys_fs_type = get_mount_fs_type("/sys").unwrap_or_else(|_| String::from("sysfs"));
-
        let test_cases = [
-            ("dev", "/dev", dev_fs_type.as_str()),
-            ("udev", "/dev", dev_fs_type.as_str()),
-            ("proc", "/proc", proc_fs_type.as_str()),
-            ("sysfs", "/sys", sys_fs_type.as_str()),
+            ("dev", "/dev", "devtmpfs"),
+            ("udev", "/dev", "devtmpfs"),
+            ("proc", "/proc", "proc"),
+            ("sysfs", "/sys", "sysfs"),
        ];

        for &(source, destination, fs_type) in &test_cases {
@@ -387,22 +381,6 @@ mod tests {
        let drain = slog::Discard;
        let logger = slog::Logger::root(drain, o!());

-        // Detect filesystem type of root directory
-        let tmp_fs_type = get_mount_fs_type("/").unwrap_or_else(|_| String::from("unknown"));
-
-        // Error messages that vary based on filesystem type
-        const DEFAULT_ERROR_EPERM: &str = "Operation not permitted";
-        const BTRFS_ERROR_ENODEV: &str = "No such device";
-
-        // Helper to select error message based on filesystem type (e.g. btrfs for s390x runners)
-        let get_error_msg = |default: &'static str, btrfs_specific: &'static str| -> &'static str {
-            if tmp_fs_type == "btrfs" && !btrfs_specific.is_empty() {
-                btrfs_specific
-            } else {
-                default
-            }
-        };
-
        let tests = &[
            TestData {
                test_user: TestUserType::Any,
@@ -438,7 +416,7 @@ mod tests {
                fs_type: "bind",
                flags: MsFlags::empty(),
                options: "bind",
-                error_contains: get_error_msg(DEFAULT_ERROR_EPERM, BTRFS_ERROR_ENODEV),
+                error_contains: "Operation not permitted",
            },
            TestData {
                test_user: TestUserType::NonRootOnly,
@@ -518,14 +496,7 @@ mod tests {

            let err = result.unwrap_err();
            let error_msg = format!("{}", err);
-
-            assert!(
-                error_msg.contains(d.error_contains),
-                "{}: expected error containing '{}', got '{}'",
-                msg,
-                d.error_contains,
-                error_msg
-            );
+            assert!(error_msg.contains(d.error_contains), "{}", msg);
        }
    }

--- a/src/agent/src/netlink.rs
+++ b/src/agent/src/netlink.rs
@@ -922,18 +922,6 @@ mod tests {
    const TEST_DUMMY_INTERFACE: &str = "dummy_for_arp";
    const TEST_ARP_IP: &str = "192.0.2.127";

-    /// Helper function to check if the result is a netlink EACCES error
-    fn is_netlink_permission_error<T>(result: &Result<T>) -> bool {
-        if let Err(e) = result {
-            let error_string = format!("{:?}", e);
-            if error_string.contains("code: Some(-13)") {
-                println!("INFO: skipping test - netlink operations are restricted in this environment (EACCES)");
-                return true;
-            }
-        }
-        false
-    }
-
    #[tokio::test]
    async fn find_link_by_name() {
        let message = Handle::new()
@@ -1057,14 +1045,10 @@ mod tests {
        let lo = handle.find_link(LinkFilter::Name("lo")).await.unwrap();

        for network in list {
-            let result = handle.add_addresses(lo.index(), iter::once(network)).await;
-
-            // Skip test if netlink operations are restricted (EACCES = -13)
-            if is_netlink_permission_error(&result) {
-                return;
-            }
-
-            result.expect("Failed to add IP");
+            handle
+                .add_addresses(lo.index(), iter::once(network))
+                .await
+                .expect("Failed to add IP");

            // Make sure the address is there
            let result = handle
@@ -1079,14 +1063,10 @@ mod tests {
            assert!(result.is_some());

            // Update it
-            let result = handle.add_addresses(lo.index(), iter::once(network)).await;
-
-            // Skip test if netlink operations are restricted (EACCES = -13)
-            if is_netlink_permission_error(&result) {
-                return;
-            }
-
-            result.expect("Failed to delete address");
+            handle
+                .add_addresses(lo.index(), iter::once(network))
+                .await
+                .expect("Failed to delete address");
        }
    }

--- a/src/agent/src/random.rs
+++ b/src/agent/src/random.rs
@@ -59,26 +59,10 @@ pub fn reseed_rng(data: &[u8]) -> Result<()> {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use nix::errno::Errno;
    use std::fs::File;
    use std::io::prelude::*;
    use test_utils::skip_if_not_root;

-    /// Helper function to check if the result is an EPERM error
-    fn is_permission_error(result: &Result<()>) -> bool {
-        if let Err(e) = result {
-            if let Some(errno) = e.downcast_ref::<Errno>() {
-                if *errno == Errno::EPERM {
-                    println!(
-                        "EPERM: skipping test - reseeding RNG is not permitted in this environment"
-                    );
-                    return true;
-                }
-            }
-        }
-        false
-    }
-
    #[test]
    fn test_reseed_rng() {
        skip_if_not_root!();
@@ -89,9 +73,6 @@ mod tests {
        // Ensure the buffer was filled.
        assert!(n == POOL_SIZE);
        let ret = reseed_rng(&seed);
-        if is_permission_error(&ret) {
-            return;
-        }
        assert!(ret.is_ok());
    }

@@ -104,9 +85,6 @@ mod tests {
        // Ensure the buffer was filled.
        assert!(n == POOL_SIZE);
        let ret = reseed_rng(&seed);
-        if is_permission_error(&ret) {
-            return;
-        }
        if nix::unistd::Uid::effective().is_root() {
            assert!(ret.is_ok());
        } else {
--- a/src/agent/src/rpc.rs
+++ b/src/agent/src/rpc.rs
@@ -2481,26 +2481,6 @@ mod tests {
        // normally this module should eixsts...
        m.name = "bridge".to_string();
        let result = load_kernel_module(&m);
-
-        // Skip test if loading kernel modules is not permitted
-        // or kernel module is not found
-        if let Err(e) = &result {
-            let error_string = format!("{:?}", e);
-            // Let's print out the error message first
-            println!("DEBUG: error: {}", error_string);
-            if error_string.contains("Operation not permitted")
-                || error_string.contains("EPERM")
-                || error_string.contains("Permission denied")
-            {
-                println!("INFO: skipping test - loading kernel modules is not permitted in this environment");
-                return;
-            }
-            if error_string.contains("not found") {
-                println!("INFO: skipping test - kernel module is not found in this environment");
-                return;
-            }
-        }
-
        assert!(result.is_ok(), "load module should success");
    }

--- a/src/dragonball/Cargo.lock
+++ b/src/dragonball/Cargo.lock
@@ -1121,9 +1121,9 @@ dependencies = [

 [[package]]
 name = "kvm-ioctls"
-version = "0.12.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d592c9b0da14bacab1fe89c78e7ed873b20cf7f502d0fc26f628d733215b1e5"
+checksum = "c3a321cabd827642499c77e27314f388dd83a717a5ca716b86476fb947f73ae4"
 dependencies = [
 "kvm-bindings",
 "libc",
--- a/src/dragonball/Cargo.toml
+++ b/src/dragonball/Cargo.toml
@@ -31,7 +31,7 @@ resolver = "2"
 # Rust-VMM crates
 event-manager = "0.2.1"
 kvm-bindings = "0.6.0"
-kvm-ioctls = "=0.12.1"
+kvm-ioctls = "0.12.0"
 linux-loader = "0.8.0"
 seccompiler = "0.5.0"
 vfio-bindings = "0.3.0"
--- a/src/libs/Cargo.toml
+++ b/src/libs/Cargo.toml
@@ -3,9 +3,8 @@ members = [
    "kata-sys-util",
    "kata-types",
    "logging",
-    "mem-agent",
-    "protocols",
    "runtime-spec",
+    "protocols",
    "safe-path",
    "shim-interface",
    "test-utils",
--- a/src/libs/kata-sys-util/src/k8s.rs
+++ b/src/libs/kata-sys-util/src/k8s.rs
@@ -42,15 +42,15 @@ pub fn is_ephemeral_volume(mount: &Mount) -> bool {
 /// K8s `EmptyDir` volumes are directories on the host. If the fs type is tmpfs, it's a ephemeral
 /// volume instead of a `EmptyDir` volume.
 pub fn is_host_empty_dir(path: &str) -> bool {
-    if !is_empty_dir(path) {
-        return false;
+    if is_empty_dir(path) {
+        if let Ok(info) = get_linux_mount_info(path) {
+            if info.fs_type != "tmpfs" {
+                return true;
+            }
+        }
    }

-    match get_linux_mount_info(path) {
-        Ok(info) => info.fs_type != "tmpfs",
-        Err(crate::mount::Error::NoMountEntry(_)) => true,
-        Err(_) => false,
-    }
+    false
 }

 // update_ephemeral_storage_type sets the mount type to 'ephemeral'
@@ -58,7 +58,7 @@ pub fn is_host_empty_dir(path: &str) -> bool {
 // For the given pod ephemeral volume is created only once
 // backed by tmpfs inside the VM. For successive containers
 // of the same pod the already existing volume is reused.
-pub fn update_ephemeral_storage_type(oci_spec: &mut Spec, disable_guest_empty_dir: bool) {
+pub fn update_ephemeral_storage_type(oci_spec: &mut Spec) {
    if let Some(mounts) = oci_spec.mounts_mut() {
        for m in mounts.iter_mut() {
            if let Some(typ) = &m.typ() {
@@ -69,12 +69,13 @@ pub fn update_ephemeral_storage_type(oci_spec: &mut Spec, disable_guest_empty_di

            if let Some(source) = &m.source() {
                let mnt_src = &source.display().to_string();
-                // We only care about the "bind" mount volume here.
+                //here we only care about the "bind" mount volume.
                if is_ephemeral_volume(m) {
                    m.set_typ(Some(String::from(mount::KATA_EPHEMERAL_VOLUME_TYPE)));
-                }
-                if is_host_empty_dir(mnt_src) && !disable_guest_empty_dir {
-                    m.set_typ(Some(mount::KATA_K8S_LOCAL_STORAGE_TYPE.to_string()));
+                } else if is_host_empty_dir(mnt_src) {
+                    // FIXME support disable_guest_empty_dir
+                    // https://github.com/kata-containers/kata-containers/blob/02a51e75a7e0c6fce5e8abe3b991eeac87e09645/src/runtime/pkg/katautils/create.go#L105
+                    m.set_typ(Some(String::from(mount::KATA_HOST_DIR_VOLUME_TYPE)));
                }
            }
        }
--- a/src/libs/kata-sys-util/src/protection.rs
+++ b/src/libs/kata-sys-util/src/protection.rs
@@ -6,8 +6,6 @@
 #[cfg(any(target_arch = "s390x", target_arch = "x86_64", target_arch = "aarch64"))]
 use anyhow::Result;
 use serde::{Deserialize, Serialize};
-#[cfg(target_arch = "x86_64")]
-use std::arch::x86_64;
 use std::fmt;
 #[cfg(all(target_arch = "powerpc64", target_endian = "little"))]
 use std::fs;
@@ -28,7 +26,6 @@ use std::fs;
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct SevSnpDetails {
    pub cbitpos: u32,
-    pub phys_addr_reduction: u32,
 }

 #[allow(dead_code)]
@@ -120,44 +117,17 @@ pub fn arch_guest_protection(
        Ok(false)
    };

-    let retrieve_sev_params = || -> Result<(u32, u32), ProtectionError> {
-        // The initial checks for AMD and SEV shouldn't be necessary due to
-        // the context this function is currently called from, however it
-        // shouldn't hurt to double-check and have better logging if anything
-        // goes wrong.
-
-        let fn0 = unsafe { x86_64::__cpuid(0) };
-        // The values in [ ebx, edx, ecx ] spell out "AuthenticAMD" when
-        // interpreted byte-wise as ASCII.  No need to bother here with an
-        // actual conversion to string though.
-        // See also AMD64 Architecture Programmer's Manual pg. 600
-        // https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24594.pdf
-        if fn0.ebx != 0x68747541 || fn0.edx != 0x69746e65 || fn0.ecx != 0x444d4163 {
-            return Err(ProtectionError::CheckFailed(
-                "Not an AMD processor".to_owned(),
-            ));
-        }
-
-        // AMD64 Architecture Prgrammer's Manual Fn8000_001f docs on pg. 640
-        let fn8000_001f = unsafe { x86_64::__cpuid(0x8000_001f) };
-        if fn8000_001f.eax & 0x10 == 0 {
-            return Err(ProtectionError::CheckFailed("SEV not supported".to_owned()));
-        }
-
-        let cbitpos = fn8000_001f.ebx & 0b11_1111;
-        let phys_addr_reduction = (fn8000_001f.ebx & 0b1111_1100_0000) >> 6;
-
-        Ok((cbitpos, phys_addr_reduction))
+    let retrieve_sev_cbitpos = || -> Result<u32, ProtectionError> {
+        Err(ProtectionError::CheckFailed(
+            "cbitpos retrieval NOT IMPLEMENTED YET".to_owned(),
+        ))
    };

    let is_snp_available = check_contents(snp_path)?;
    let is_sev_available = is_snp_available || check_contents(sev_path)?;
    if is_snp_available || is_sev_available {
-        let (cbitpos, phys_addr_reduction) = retrieve_sev_params()?;
-        let sev_snp_details = SevSnpDetails {
-            cbitpos,
-            phys_addr_reduction,
-        };
+        let cbitpos = retrieve_sev_cbitpos()?;
+        let sev_snp_details = SevSnpDetails { cbitpos };
        return Ok(if is_snp_available {
            GuestProtection::Snp(sev_snp_details)
        } else {
--- a/src/libs/kata-types/Cargo.toml
+++ b/src/libs/kata-types/Cargo.toml
@@ -28,7 +28,7 @@ toml = "0.5.8"
 serde-enum-str = "0.4"
 sysinfo = "0.34.2"
 sha2 = "0.10.8"
-flate2 = "1.1"
+flate2 = { version = "1.0", features = ["zlib"] }
 hex = "0.4"

 oci-spec = { version = "0.8.1", features = ["runtime"] }
--- a/src/libs/kata-types/src/annotations/mod.rs
+++ b/src/libs/kata-types/src/annotations/mod.rs
@@ -296,10 +296,6 @@ pub const KATA_ANNO_CFG_RUNTIME_AGENT: &str = "io.katacontainers.config.runtime.
 /// A sandbox annotation that determines if seccomp should be applied inside guest.
 pub const KATA_ANNO_CFG_DISABLE_GUEST_SECCOMP: &str =
    "io.katacontainers.config.runtime.disable_guest_seccomp";
-/// A sandbox annotation that determines if it should create Kubernetes emptyDir mounts on the guest filesystem.
-pub const KATA_ANNO_CFG_DISABLE_GUEST_EMPTY_DIR: &str =
-    "io.katacontainers.config.runtime.disable_guest_empty_dir";
-
 /// A sandbox annotation that determines if pprof enabled.
 pub const KATA_ANNO_CFG_ENABLE_PPROF: &str = "io.katacontainers.config.runtime.enable_pprof";
 /// A sandbox annotation that determines if experimental features enabled.
@@ -1027,14 +1023,6 @@ impl Annotation {
                            return Err(bool_err);
                        }
                    },
-                    KATA_ANNO_CFG_DISABLE_GUEST_EMPTY_DIR => match self.get_value::<bool>(key) {
-                        Ok(r) => {
-                            config.runtime.disable_guest_empty_dir = r.unwrap_or_default();
-                        }
-                        Err(_e) => {
-                            return Err(bool_err);
-                        }
-                    },
                    KATA_ANNO_CFG_ENABLE_PPROF => match self.get_value::<bool>(key) {
                        Ok(r) => {
                            config.runtime.enable_pprof = r.unwrap_or_default();
--- a/src/libs/kata-types/src/config/agent.rs
+++ b/src/libs/kata-types/src/config/agent.rs
@@ -148,10 +148,6 @@ pub struct Agent {
    /// Memory agent configuration
    #[serde(default)]
    pub mem_agent: MemAgent,
-
-    /// Agent policy
-    #[serde(default)]
-    pub policy: String,
 }

 fn deserialize_secs_to_millis<'de, D>(deserializer: D) -> std::result::Result<u32, D::Error>
@@ -180,7 +176,6 @@ impl std::default::Default for Agent {
            kernel_modules: Default::default(),
            container_pipe_size: 0,
            mem_agent: MemAgent::default(),
-            policy: Default::default(),
        }
    }
 }
--- a/src/libs/kata-types/src/config/default.rs
+++ b/src/libs/kata-types/src/config/default.rs
@@ -9,7 +9,6 @@
 use crate::config::agent::AGENT_NAME_KATA;
 use crate::config::hypervisor::HYPERVISOR_NAME_DRAGONBALL;
 use crate::config::runtime::RUNTIME_NAME_VIRTCONTAINER;
-use crate::machine_type::MACHINE_TYPE_Q35_TYPE;
 use lazy_static::lazy_static;

 lazy_static! {
@@ -66,7 +65,7 @@ pub const MIN_DRAGONBALL_MEMORY_SIZE_MB: u32 = 64;
 pub const DEFAULT_QEMU_BINARY_PATH: &str = "/usr/bin/qemu-system-x86_64";
 pub const DEFAULT_QEMU_ROOTFS_TYPE: &str = "ext4";
 pub const DEFAULT_QEMU_CONTROL_PATH: &str = "";
-pub const DEFAULT_QEMU_MACHINE_TYPE: &str = MACHINE_TYPE_Q35_TYPE;
+pub const DEFAULT_QEMU_MACHINE_TYPE: &str = "q35";
 pub const DEFAULT_QEMU_ENTROPY_SOURCE: &str = "/dev/urandom";
 pub const DEFAULT_QEMU_GUEST_KERNEL_IMAGE: &str = "vmlinuz";
 pub const DEFAULT_QEMU_GUEST_KERNEL_PARAMS: &str = "";
--- a/src/libs/kata-types/src/config/hypervisor/mod.rs
+++ b/src/libs/kata-types/src/config/hypervisor/mod.rs
@@ -49,7 +49,7 @@ mod remote;
 pub use self::remote::{RemoteConfig, HYPERVISOR_NAME_REMOTE};

 mod rate_limiter;
-pub use self::rate_limiter::{RateLimiterConfig, DEFAULT_RATE_LIMITER_REFILL_TIME};
+pub use self::rate_limiter::RateLimiterConfig;

 /// Virtual PCI block device driver.
 pub const VIRTIO_BLK_PCI: &str = "virtio-blk-pci";
@@ -1224,52 +1224,6 @@ pub struct RemoteInfo {
    pub default_gpu_model: String,
 }

-/// Configuration information for vm template.
-#[derive(Clone, Debug, Default, Deserialize, Serialize)]
-pub struct VmTemplateInfo {
-    /// Indicate whether the VM is being created as a template VM.
-    #[serde(default)]
-    pub boot_to_be_template: bool,
-
-    /// Indicate whether the VM should be created from an existing template VM.
-    #[serde(default)]
-    pub boot_from_template: bool,
-
-    /// memory_path is the memory file path of VM memory.
-    #[serde(default)]
-    pub memory_path: String,
-
-    /// device_state_path is the VM device state file path.
-    #[serde(default)]
-    pub device_state_path: String,
-}
-
-impl VmTemplateInfo {
-    /// Adjust the configuration information after loading from configuration file.
-    pub fn adjust_config(&mut self) -> Result<()> {
-        Ok(())
-    }
-
-    /// Validate the configuration information.
-    pub fn validate(&self) -> Result<()> {
-        Ok(())
-    }
-}
-
-/// Configuration information for VM factory (templating, caches, etc.).
-#[derive(Clone, Debug, Default, Deserialize, Serialize)]
-pub struct Factory {
-    /// Enable VM templating support.
-    /// When enabled, new VMs may be created from a template to speed up creation.
-    #[serde(default, rename = "enable_template")]
-    pub enable_template: bool,
-
-    /// Specifies the path of template.
-    /// Example: "/run/vc/vm/template"
-    #[serde(default)]
-    pub template_path: String,
-}
-
 /// Common configuration information for hypervisors.
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct Hypervisor {
@@ -1360,14 +1314,6 @@ pub struct Hypervisor {
    #[serde(default, flatten)]
    pub remote_info: RemoteInfo,

-    /// vm template configuration information.
-    #[serde(default, flatten)]
-    pub vm_template: VmTemplateInfo,
-
-    /// VM factory configuration information.
-    #[serde(default)]
-    pub factory: Factory,
-
    /// A sandbox annotation used to specify the host path to the `prefetch_files.list`
    /// for the container image being used. The runtime will pass this path to the
    /// Hypervisor to search for the corresponding prefetch list file.
@@ -1441,7 +1387,6 @@ impl ConfigOps for Hypervisor {
                hv.network_info.adjust_config()?;
                hv.security_info.adjust_config()?;
                hv.shared_fs.adjust_config()?;
-                hv.vm_template.adjust_config()?;
                resolve_path!(
                    hv.prefetch_list_path,
                    "prefetch_list_path `{}` is invalid: {}"
@@ -1479,7 +1424,6 @@ impl ConfigOps for Hypervisor {
                hv.network_info.validate()?;
                hv.security_info.validate()?;
                hv.shared_fs.validate()?;
-                hv.vm_template.validate()?;
                validate_path!(hv.path, "Hypervisor binary path `{}` is invalid: {}")?;
                validate_path!(
                    hv.ctlpath,
--- a/src/libs/kata-types/src/config/hypervisor/rate_limiter.rs
+++ b/src/libs/kata-types/src/config/hypervisor/rate_limiter.rs
@@ -6,10 +6,10 @@

 use serde::{Deserialize, Serialize};

-/// The DEFAULT_RATE_LIMITER_REFILL_TIME is used for calculating the rate at
-/// which a TokenBucket is replinished, in cases where a RateLimiter is
-/// applied to either network or disk I/O.
-pub const DEFAULT_RATE_LIMITER_REFILL_TIME: u64 = 1000;
+// The DEFAULT_RATE_LIMITER_REFILL_TIME is used for calculating the rate at
+// which a TokenBucket is replinished, in cases where a RateLimiter is
+// applied to either network or disk I/O.
+pub(crate) const DEFAULT_RATE_LIMITER_REFILL_TIME: u64 = 1000;

 #[derive(Clone, Copy, Debug, Default, Deserialize, Serialize, PartialEq, Eq)]
 pub struct TokenBucketConfig {
--- a/src/libs/kata-types/src/config/mod.rs
+++ b/src/libs/kata-types/src/config/mod.rs
@@ -24,9 +24,8 @@ pub mod hypervisor;
 pub use self::agent::Agent;
 use self::default::DEFAULT_AGENT_DBG_CONSOLE_PORT;
 pub use self::hypervisor::{
-    BootInfo, CloudHypervisorConfig, DragonballConfig, Factory, FirecrackerConfig, Hypervisor,
-    QemuConfig, RemoteConfig, HYPERVISOR_NAME_DRAGONBALL, HYPERVISOR_NAME_FIRECRACKER,
-    HYPERVISOR_NAME_QEMU,
+    BootInfo, CloudHypervisorConfig, DragonballConfig, FirecrackerConfig, Hypervisor, QemuConfig,
+    RemoteConfig, HYPERVISOR_NAME_DRAGONBALL, HYPERVISOR_NAME_FIRECRACKER, HYPERVISOR_NAME_QEMU,
 };

 mod runtime;
@@ -178,15 +177,6 @@ impl TomlConfig {
        Ok(config)
    }

-    /// Get the `Factory` configuration from the active hypervisor.
-    pub fn get_factory(&self) -> Factory {
-        let hypervisor_name = self.runtime.hypervisor_name.as_str();
-        self.hypervisor
-            .get(hypervisor_name)
-            .map(|hv| hv.factory.clone())
-            .unwrap_or_default()
-    }
-
    /// Adjust Kata configuration information.
    pub fn adjust_config(&mut self) -> Result<()> {
        Hypervisor::adjust_config(self)?;
--- a/src/libs/kata-types/src/config/runtime.rs
+++ b/src/libs/kata-types/src/config/runtime.rs
@@ -128,12 +128,6 @@ pub struct Runtime {
    #[serde(default)]
    pub disable_guest_seccomp: bool,

-    /// If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem.
-    /// Instead, emptyDir mounts will be created on the host and shared via virtio-fs.
-    /// This is potentially slower, but allows sharing of files from host to guest.
-    #[serde(default)]
-    pub disable_guest_empty_dir: bool,
-
    /// Determines how VFIO devices should be be presented to the container.
    ///
    /// Options:
--- a/src/libs/kata-types/src/lib.rs
+++ b/src/libs/kata-types/src/lib.rs
@@ -51,9 +51,6 @@ pub mod initdata;
 /// rootless vmm
 pub mod rootless;

-/// machine type
-pub mod machine_type;
-
 use std::path::Path;

 use crate::rootless::{is_rootless, rootless_dir};
--- a/src/libs/kata-types/src/machine_type.rs
+++ b/src/libs/kata-types/src/machine_type.rs
@@ -1,11 +0,0 @@
-// Copyright 2025 Kata Contributors
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-/// Default x86-64 machine type
-pub const MACHINE_TYPE_Q35_TYPE: &str = "q35";
-
-/// S390x CCW virtio machine type identifier.
-/// Used on IBM Z architecture for channel I/O (CCW) virtio devices.
-pub const MACHINE_TYPE_S390X_TYPE: &str = "s390-ccw-virtio";
--- a/src/libs/kata-types/src/mount.rs
+++ b/src/libs/kata-types/src/mount.rs
@@ -23,9 +23,8 @@ pub const KATA_SHAREDFS_GUEST_PREMOUNT_TAG: &str = "kataShared";
 /// KATA_EPHEMERAL_VOLUME_TYPE creates a tmpfs backed volume for sharing files between containers.
 pub const KATA_EPHEMERAL_VOLUME_TYPE: &str = "ephemeral";

-/// KATA_K8S_LOCAL_STORAGE_TYPE is used for k8s empty dir (a disk-backed volume),
-/// to create a local directory inside the VM for sharing files between containers.
-pub const KATA_K8S_LOCAL_STORAGE_TYPE: &str = "local";
+/// KATA_HOST_DIR_TYPE use for host empty dir
+pub const KATA_HOST_DIR_VOLUME_TYPE: &str = "kata:hostdir";

 /// KATA_MOUNT_INFO_FILE_NAME is used for the file that holds direct-volume mount info
 pub const KATA_MOUNT_INFO_FILE_NAME: &str = "mountInfo.json";
@@ -522,6 +521,11 @@ pub fn is_kata_ephemeral_volume(ty: &str) -> bool {
    ty == KATA_EPHEMERAL_VOLUME_TYPE
 }

+/// Checks whether a mount type is a marker for a Kata hostdir volume.
+pub fn is_kata_host_dir_volume(ty: &str) -> bool {
+    ty == KATA_HOST_DIR_VOLUME_TYPE
+}
+
 /// Splits a sandbox bindmount string into its real path and mode.
 ///
 /// The `bindmount` format is typically `/path/to/dir` or `/path/to/dir:ro[:rw]`.
--- a/src/libs/protocols/protos/remote.proto
+++ b/src/libs/protocols/protos/remote.proto
@@ -5,7 +5,7 @@

 syntax = "proto3";

-package hypervisor;
+package remote;

 service Hypervisor {
 	rpc CreateVM(CreateVMRequest) returns (CreateVMResponse) {}
--- a/src/libs/shim-interface/src/shim_mgmt/mod.rs
+++ b/src/libs/shim-interface/src/shim_mgmt/mod.rs
@@ -20,7 +20,5 @@ pub const IP_TABLE_URL: &str = "/iptables";
 pub const IP6_TABLE_URL: &str = "/ip6tables";
 /// URL for querying metrics inside shim
 pub const METRICS_URL: &str = "/metrics";
-/// URL for setting agent policy
-pub const AGENT_POLICY_URL: &str = "/policy";

 pub const ERR_NO_SHIM_SERVER: &str = "Failed to create shim management server";
--- a/src/libs/mem-agent/.gitignore
+++ b/src/libs/mem-agent/.gitignore
--- a/src/libs/mem-agent/Cargo.toml
+++ b/src/libs/mem-agent/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "mem-agent"
+name = "mem-agent-lib"
 version = "0.2.0"
 edition = "2021"

@@ -20,5 +20,3 @@ slog-term = "2.9.0"
 slog-async = "2.7"
 once_cell = "1.9.0"
 lazy_static = "1.4"
-nix = { version = "0.30.1", features = ["user"] }
-test-utils = { path = "../test-utils" }
--- a/src/libs/mem-agent/src/agent.rs
+++ b/src/libs/mem-agent/src/agent.rs
@@ -105,7 +105,7 @@ async fn async_get_remaining_tokio_duration(

 fn agent_work(mut memcg: memcg::MemCG, mut comp: compact::Compact) -> Result<Duration> {
    let memcg_work_list = memcg.get_timeout_list();
-    if !memcg_work_list.is_empty() {
+    if memcg_work_list.len() > 0 {
        info!("memcg.work start");
        memcg
            .work(&memcg_work_list)
@@ -202,8 +202,10 @@ async fn mem_agent_loop(
            });

            mas.timeout = false;
-        } else if mas.refresh() {
-            continue;
+        } else {
+            if mas.refresh() {
+                continue;
+            }
        }

        info!("mem_agent_loop wait timeout {:?}", mas.duration);
@@ -344,11 +346,9 @@ impl MemAgent {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use test_utils::skip_if_not_root;

    #[test]
    fn test_agent() {
-        skip_if_not_root!();
        let mut memcg_config = memcg::Config::default();
        memcg_config.default.disabled = true;
        let compact_config = compact::Config {
@@ -381,7 +381,6 @@ mod tests {

    #[test]
    fn test_agent_memcg_status() {
-        skip_if_not_root!();
        let mut memcg_config = memcg::Config::default();
        memcg_config.default.disabled = true;
        let compact_config = compact::Config {
--- a/src/libs/mem-agent/src/cgroup.rs
+++ b/src/libs/mem-agent/src/cgroup.rs
--- a/src/libs/mem-agent/src/compact.rs
+++ b/src/libs/mem-agent/src/compact.rs
@@ -2,10 +2,6 @@
 //
 // SPDX-License-Identifier: Apache-2.0

-// TODO: Enable precedence and identity_op check
-#![allow(clippy::precedence)]
-#![allow(clippy::identity_op)]
-
 use crate::cgroup::CGROUP_PATH;
 use crate::proc;
 use crate::psi;
@@ -67,7 +63,7 @@ impl Default for Config {
            compact_sec_max: 5 * 60,
            compact_order: PAGE_REPORTING_MIN_ORDER,
            compact_threshold: 2 << PAGE_REPORTING_MIN_ORDER,
-            compact_force_times: u64::MAX,
+            compact_force_times: std::u64::MAX,
        }
    }
 }
@@ -133,7 +129,7 @@ impl CompactCore {
    }

    fn need_force_compact(&self) -> bool {
-        if self.config.compact_force_times == u64::MAX {
+        if self.config.compact_force_times == std::u64::MAX {
            return false;
        }

@@ -354,12 +350,14 @@ impl Compact {
                        } else {
                            debug!("compact killed and keep wait");
                        }
-                    } else if rest_sec <= 0 {
-                        debug!("compact timeout");
-                        child
-                            .kill()
-                            .map_err(|e| anyhow!("child.kill failed: {}", e))?;
-                        killed = true;
+                    } else {
+                        if rest_sec <= 0 {
+                            debug!("compact timeout");
+                            child
+                                .kill()
+                                .map_err(|e| anyhow!("child.kill failed: {}", e))?;
+                            killed = true;
+                        }
                    }

                    let percent = compact_psi
--- a/src/libs/mem-agent/src/lib.rs
+++ b/src/libs/mem-agent/src/lib.rs
--- a/src/libs/mem-agent/src/memcg.rs
+++ b/src/libs/mem-agent/src/memcg.rs
@@ -14,7 +14,7 @@ use page_size;
 use std::collections::HashMap;
 use std::collections::HashSet;
 use std::hash::Hash;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 use std::sync::Arc;
 use tokio::sync::RwLock;
 use tokio::time::Duration as TokioDuration;
@@ -113,13 +113,24 @@ impl SingleConfig {
    }
 }

-#[derive(Debug, Clone, PartialEq, Default)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct CgroupConfig {
    pub no_subdir: bool,
    pub numa_id: Vec<u32>,
    pub config: SingleConfig,
 }

+impl Default for CgroupConfig {
+    fn default() -> Self {
+        Self {
+            no_subdir: false,
+            // empty numa_id means this config not limit numa
+            numa_id: vec![],
+            config: SingleConfig::default(),
+        }
+    }
+}
+
 impl CgroupConfig {
    fn set(&mut self, config: &CgroupOptionConfig) -> bool {
        let mut need_reset = false;
@@ -211,7 +222,7 @@ impl Config {

        // make sure the empty numa_id CgroupConfig at the end of Cgroup
        for vec in self.cgroups.values_mut() {
-            let (keep, moved) = vec.drain(..).partition(|c| !c.numa_id.is_empty());
+            let (keep, moved) = vec.drain(..).partition(|c| c.numa_id.len() > 0);
            *vec = keep;
            vec.extend(moved);
        }
@@ -289,7 +300,7 @@ pub struct Numa {
 }

 impl Numa {
-    fn new(mglru: &MGenLRU, path: &str, psi_path: &Path) -> Self {
+    fn new(mglru: &MGenLRU, path: &str, psi_path: &PathBuf) -> Self {
        Self {
            max_seq: mglru.max_seq,
            min_seq: mglru.min_seq,
@@ -351,9 +362,9 @@ impl MemCgroup {
        id: &usize,
        ino: &usize,
        path: &str,
-        numa: &[u32],
+        numa: &Vec<u32>,
        hmg: &HashMap<usize, MGenLRU>,
-        psi_path: &Path,
+        psi_path: &PathBuf,
    ) -> Self {
        let m = Self {
            id: *id as u16,
@@ -361,8 +372,11 @@ impl MemCgroup {
            numa: numa
                .iter()
                .filter_map(|numa_id| {
-                    hmg.get(&(*numa_id as usize))
-                        .map(|hmg| (*numa_id, Numa::new(hmg, path, psi_path)))
+                    if let Some(hmg) = hmg.get(&(*numa_id as usize)) {
+                        Some((*numa_id, Numa::new(hmg, path, psi_path)))
+                    } else {
+                        None
+                    }
                })
                .collect(),
        };
@@ -375,7 +389,7 @@ impl MemCgroup {
        &mut self,
        numa: &Vec<u32>,
        path: &str,
-        psi_path: &Path,
+        psi_path: &PathBuf,
        hmg: &HashMap<usize, MGenLRU>,
    ) {
        for numa_id in numa {
@@ -438,7 +452,7 @@ impl Info {
    fn new(path: &str, memcg_id: usize, numa_id: usize, numa: &Numa) -> Self {
        Self {
            memcg_id,
-            numa_id,
+            numa_id: numa_id,
            path: path.to_string(),
            min_seq: numa.min_seq,
            max_seq: numa.max_seq,
@@ -520,9 +534,9 @@ impl MemCgroups {
                    }
                    should_keep
                });
-                !path_cgs.is_empty()
+                path_cgs.len() != 0
            });
-            !period_cgs.cgs.is_empty()
+            period_cgs.cgs.len() != 0
        });

        self.cgroups.retain(|path, cgroup| {
@@ -560,7 +574,7 @@ impl MemCgroups {
            let need_insert = if update_cgroups {
                if let Some(mg) = self.cgroups.get_mut(path) {
                    // Update current
-                    mg.update_from_hostmemcg(hmg);
+                    mg.update_from_hostmemcg(&hmg);
                    false
                } else {
                    true
@@ -580,8 +594,8 @@ impl MemCgroups {
                    loop {
                        if let Some(secs_config_map) = self.config_map.get_mut(&config.period_secs)
                        {
-                            if let Some(config_map) = secs_config_map.cgs.get_mut(config) {
-                                if config_map.get_mut(path).is_some() {
+                            if let Some(config_map) = secs_config_map.cgs.get_mut(&config) {
+                                if let Some(_) = config_map.get_mut(path) {
                                    error!(
                                        "update_and_add found an memcg {:?} {} existed",
                                        config, path
@@ -610,7 +624,7 @@ impl MemCgroups {
                                            );

                                            cgroups.add_numa(
-                                                numa_id,
+                                                &numa_id,
                                                path,
                                                &self.config.psi_path,
                                                hmg,
@@ -627,7 +641,7 @@ impl MemCgroups {
                                                    id,
                                                    ino,
                                                    path,
-                                                    numa_id,
+                                                    &numa_id,
                                                    hmg,
                                                    &self.config.psi_path,
                                                ),
@@ -668,7 +682,7 @@ impl MemCgroups {
                for (path, numa_map) in path_map {
                    if let Some(mcg) = self.cgroups.get_mut(path) {
                        for numa_id in &numa_map.numa {
-                            if let Some(numa) = mcg.numa.get_mut(numa_id) {
+                            if let Some(numa) = mcg.numa.get_mut(&numa_id) {
                                let pass = match numa
                                    .check_psi(single_config.period_psi_percent_limit as u64)
                                {
@@ -688,7 +702,7 @@ impl MemCgroups {
                                }

                                info_ret.push(Info::new(
-                                    path,
+                                    &path,
                                    mcg.id as usize,
                                    *numa_id as usize,
                                    numa,
@@ -704,7 +718,7 @@ impl MemCgroups {
                    }
                }

-                if !info_ret.is_empty() {
+                if info_ret.len() > 0 {
                    infos_ret.push((single_config.clone(), info_ret));
                }
            }
@@ -795,7 +809,7 @@ impl MemCgroups {
    pub fn get_remaining_tokio_duration(&self) -> TokioDuration {
        let mut ret = TokioDuration::MAX;

-        for secs_map in self.config_map.values() {
+        for (_, secs_map) in &self.config_map {
            let cur = secs_map.timeout.remaining_tokio_duration();

            trace!(
@@ -808,7 +822,7 @@ impl MemCgroups {
                // check secs_map, make sure it has enabled config
                let mut has_enable_config = false;

-                for single_config in secs_map.cgs.keys() {
+                for (single_config, _) in &secs_map.cgs {
                    if !single_config.disabled {
                        has_enable_config = true;
                        break;
@@ -841,7 +855,11 @@ impl MemCgroups {
            let cur_path = format_path(&path);
            let should_del = if let Some(configs) = self.config.cgroups.get_mut(&cur_path) {
                configs.retain(|cfg| cfg.numa_id != numa);
-                configs.is_empty()
+                if configs.is_empty() {
+                    true
+                } else {
+                    false
+                }
            } else {
                false
            };
@@ -870,10 +888,8 @@ impl MemCgroups {
                        }
                    }

-                    let mut numa_cg = CgroupConfig {
-                        numa_id: numa,
-                        ..Default::default()
-                    };
+                    let mut numa_cg = CgroupConfig::default();
+                    numa_cg.numa_id = numa;
                    numa_cg.set(&oc);

                    numa_cgs.push(numa_cg);
@@ -1008,7 +1024,7 @@ impl MemCG {

        let mut mgs = self.memcgs.blocking_write();

-        if target_paths.is_empty() {
+        if target_paths.len() == 0 {
            mgs.remove_changed(&mg_hash);
        }
        mgs.update_and_add(&mg_hash, true);
@@ -1016,7 +1032,7 @@ impl MemCG {
        Ok(())
    }

-    fn run_aging(&mut self, config_infov: &mut [(SingleConfig, Vec<Info>)]) {
+    fn run_aging(&mut self, config_infov: &mut Vec<(SingleConfig, Vec<Info>)>) {
        for (config, infov) in config_infov.iter_mut() {
            debug!("run_aging_single_config {:?}", config);
            self.run_aging_single_config(infov, config.swap);
@@ -1078,10 +1094,10 @@ impl MemCG {
        c as u8
    }

-    fn run_eviction(&mut self, config_infov: &mut [(SingleConfig, Vec<Info>)]) -> Result<()> {
+    fn run_eviction(&mut self, config_infov: &mut Vec<(SingleConfig, Vec<Info>)>) -> Result<()> {
        for (config, infov) in config_infov.iter_mut() {
            debug!("run_eviction_single_config {:?}", config);
-            self.run_eviction_single_config(infov, config)?;
+            self.run_eviction_single_config(infov, &config)?;
        }

        Ok(())
@@ -1103,7 +1119,7 @@ impl MemCG {
        }

        let psi_path = self.memcgs.blocking_read().config.psi_path.clone();
-        for info in infov.iter_mut() {
+        for info in infov.into_iter() {
            info.eviction = Some(EvictionInfo {
                psi: psi::Period::new(&psi_path.join(info.path.trim_start_matches('/')), false),
                last_min_lru_file: 0,
@@ -1119,7 +1135,7 @@ impl MemCG {

        let mut ret = Ok(());

-        'main_loop: while !infov.is_empty() {
+        'main_loop: while infov.len() != 0 {
            // update infov
            let path_set: HashSet<String> = infov.iter().map(|info| info.path.clone()).collect();
            match self.refresh(&path_set) {
@@ -1196,14 +1212,16 @@ impl MemCG {
                        );
                        ei.file_page_count += released;

-                        if !ei.only_swap_mode && ci.min_lru_file == 0 {
-                            info!(
-                            "{} {} run_eviction stop because min_lru_file is 0, release {} {} pages",
-                            ci.path, ci.numa_id, ei.anon_page_count, ei.file_page_count,
-                        );
-                            ei.stop_reason = EvictionStopReason::NoMinLru;
-                            removed_infov.push(infov.remove(i));
-                            continue;
+                        if !ei.only_swap_mode {
+                            if ci.min_lru_file == 0 {
+                                info!(
+                                "{} {} run_eviction stop because min_lru_file is 0, release {} {} pages",
+                                ci.path, ci.numa_id, ei.anon_page_count, ei.file_page_count,
+                            );
+                                ei.stop_reason = EvictionStopReason::NoMinLru;
+                                removed_infov.push(infov.remove(i));
+                                continue;
+                            }
                        }

                        let percent = match ei.psi.get_percent() {
@@ -1296,7 +1314,7 @@ impl MemCG {
        }

        let mut mgs = self.memcgs.blocking_write();
-        mgs.record_eviction(infov);
+        mgs.record_eviction(&infov);
        mgs.record_eviction(&removed_infov);

        ret
@@ -1335,15 +1353,12 @@ impl MemCG {
    }
 }

-#[cfg(test)]
 mod tests {
    #[allow(unused_imports)]
    use super::*;
-    use test_utils::skip_if_not_root;

    #[test]
    fn test_memcg_swap_not_available() {
-        skip_if_not_root!();
        let is_cg_v2 = crate::cgroup::is_cgroup_v2().unwrap();
        let m = MemCG::new(is_cg_v2, Config::default()).unwrap();
        assert!(m.swap_not_available().is_ok());
@@ -1351,7 +1366,6 @@ mod tests {

    #[test]
    fn test_memcg_get_swappiness() {
-        skip_if_not_root!();
        let is_cg_v2 = crate::cgroup::is_cgroup_v2().unwrap();
        let m = MemCG::new(is_cg_v2, Config::default()).unwrap();
        assert_eq!(m.get_swappiness(100, 50), 133);
@@ -1359,9 +1373,8 @@ mod tests {

    #[test]
    fn test_memcg_get_timeout_list() {
-        skip_if_not_root!();
        let is_cg_v2 = crate::cgroup::is_cgroup_v2().unwrap();
        let m = MemCG::new(is_cg_v2, Config::default()).unwrap();
-        assert!(!m.get_timeout_list().is_empty());
+        assert_eq!(m.get_timeout_list().len() > 0, true);
    }
 }
--- a/src/libs/mem-agent/src/mglru.rs
+++ b/src/libs/mem-agent/src/mglru.rs
@@ -26,8 +26,7 @@ fn lru_gen_head_parse(line: &str) -> Result<(usize, String)> {
        return Err(anyhow!("line {} format is not right", line));
    }

-    let id = words[1]
-        .parse::<usize>()
+    let id = usize::from_str_radix(words[1], 10)
        .map_err(|e| anyhow!("parse line {} failed: {}", line, e))?;

    Ok((id, words[2].to_string()))
@@ -78,7 +77,7 @@ impl MGenLRU {
 fn lru_gen_lines_parse(reader: &mut BufReader<File>) -> Result<(String, HashMap<usize, MGenLRU>)> {
    let mut line = String::new();
    let mut ret_hash = HashMap::new();
-    while !line.is_empty()
+    while line.len() > 0
        || reader
            .read_line(&mut line)
            .map_err(|e| anyhow!("read file {} failed: {}", LRU_GEN_PATH, e))?
@@ -87,8 +86,7 @@ fn lru_gen_lines_parse(reader: &mut BufReader<File>) -> Result<(String, HashMap<
        let words: Vec<&str> = line.split_whitespace().map(|word| word.trim()).collect();
        if words.len() == 2 && words[0] == "node" {
            // Got a new node
-            let node_id = words[1]
-                .parse::<usize>()
+            let node_id = usize::from_str_radix(words[1], 10)
                .map_err(|e| anyhow!("parse line {} failed: {}", line, e))?;
            let (ret_line, node_size) = lru_gen_seq_lines_parse(reader)
                .map_err(|e| anyhow!("lru_gen_seq_lines_parse failed: {}", e))?;
@@ -110,7 +108,7 @@ fn str_to_u64(str: &str) -> Result<u64> {
        warn!("{} format {} is not right", LRU_GEN_PATH, str);
        return Ok(0);
    }
-    Ok(str.parse::<u64>()?)
+    Ok(u64::from_str_radix(str, 10)?)
 }

 //result:
@@ -131,8 +129,7 @@ fn lru_gen_seq_lines_parse(reader: &mut BufReader<File>) -> Result<(String, Opti
            break;
        }

-        let msecs = words[1]
-            .parse::<i64>()
+        let msecs = i64::from_str_radix(words[1], 10)
            .map_err(|e| anyhow!("parse line {} failed: {}", line, e))?;
        // Use milliseconds because will got build error with try_milliseconds.
        #[allow(deprecated)]
@@ -141,12 +138,11 @@ fn lru_gen_seq_lines_parse(reader: &mut BufReader<File>) -> Result<(String, Opti
        let mut gen = GenLRU::new();
        gen.birth = birth;

-        gen.seq = words[0]
-            .parse::<u64>()
+        gen.seq = u64::from_str_radix(words[0], 10)
            .map_err(|e| anyhow!("parse line {} failed: {}", line, e))?;
-        gen.anon = str_to_u64(words[2 + WORKINGSET_ANON])
+        gen.anon = str_to_u64(&words[2 + WORKINGSET_ANON])
            .map_err(|e| anyhow!("parse line {} failed: {}", line, e))?;
-        gen.file = str_to_u64(words[2 + WORKINGSET_FILE])
+        gen.file = str_to_u64(&words[2 + WORKINGSET_FILE])
            .map_err(|e| anyhow!("parse line {} failed: {}", line, e))?;

        if !got {
@@ -177,15 +173,14 @@ fn lru_gen_seq_lines_parse(reader: &mut BufReader<File>) -> Result<(String, Opti
 // HashMap<node_id, MGenLRU> will be empty.
 //result:
 // HashMap<path, (id, HashMap<node_id, MGenLRU>)>
-#[allow(clippy::type_complexity)]
 fn lru_gen_file_parse(
-    reader: &mut BufReader<File>,
+    mut reader: &mut BufReader<File>,
    target_patchs: &HashSet<String>,
    parse_line: bool,
 ) -> Result<HashMap<String, (usize, HashMap<usize, MGenLRU>)>> {
    let mut line = String::new();
    let mut ret_hash = HashMap::new();
-    while !line.is_empty()
+    while line.len() > 0
        || reader
            .read_line(&mut line)
            .map_err(|e| anyhow!("read file {} failed: {}", LRU_GEN_PATH, e))?
@@ -194,9 +189,9 @@ fn lru_gen_file_parse(
        let mut clear_line = true;
        // Not handle the Err of lru_gen_head_parse because all lines of file will be checked.
        if let Ok((id, path)) = lru_gen_head_parse(&line) {
-            if target_patchs.is_empty() || target_patchs.contains(&path) {
+            if target_patchs.len() == 0 || target_patchs.contains(&path) {
                let seq_data = if parse_line {
-                    let (ret_line, data) = lru_gen_lines_parse(reader).map_err(|e| {
+                    let (ret_line, data) = lru_gen_lines_parse(&mut reader).map_err(|e| {
                        anyhow!(
                            "lru_gen_seq_lines_parse file {} failed: {}",
                            LRU_GEN_PATH,
@@ -227,7 +222,6 @@ fn lru_gen_file_parse(
    Ok(ret_hash)
 }

-#[allow(clippy::type_complexity)]
 fn file_parse(
    target_patchs: &HashSet<String>,
    parse_line: bool,
@@ -242,7 +236,6 @@ fn file_parse(

 //result:
 // HashMap<path, (id, ino, HashMap<node_id, MGenLRU>)>
-#[allow(clippy::type_complexity)]
 pub fn host_memcgs_get(
    target_patchs: &HashSet<String>,
    parse_line: bool,
@@ -283,8 +276,8 @@ pub fn check() -> Result<()> {
    let content = fs::read_to_string(LRU_GEN_ENABLED_PATH)
        .map_err(|e| anyhow!("open file {} failed: {}", LRU_GEN_ENABLED_PATH, e))?;
    let content = content.trim();
-    let r = if let Some(stripped) = content.strip_prefix("0x") {
-        u32::from_str_radix(stripped, 16)
+    let r = if content.starts_with("0x") {
+        u32::from_str_radix(&content[2..], 16)
    } else {
        content.parse()
    };
@@ -343,7 +336,9 @@ mod tests {
    use maplit::hashmap;
    use once_cell::sync::OnceCell;
    use slog::{Drain, Level, Logger};
+    use slog_async;
    use slog_scope::set_global_logger;
+    use slog_term;
    use std::collections::HashMap;
    use std::fs;
    use std::fs::File;
--- a/src/libs/mem-agent/src/misc.rs
+++ b/src/libs/mem-agent/src/misc.rs
@@ -9,35 +9,35 @@ pub fn sl() -> slog::Logger {
 #[macro_export]
 macro_rules! error {
    ($($arg:tt)*) => {
-        slog::error!($crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::error!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

 #[macro_export]
 macro_rules! warn {
    ($($arg:tt)*) => {
-        slog::warn!($crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::warn!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

 #[macro_export]
 macro_rules! info {
    ($($arg:tt)*) => {
-        slog::info!($crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::info!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

 #[macro_export]
 macro_rules! trace {
    ($($arg:tt)*) => {
-        slog::trace!($crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::trace!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

 #[macro_export]
 macro_rules! debug {
    ($($arg:tt)*) => {
-        slog::debug!($crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::debug!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

--- a/src/libs/mem-agent/src/proc.rs
+++ b/src/libs/mem-agent/src/proc.rs
--- a/src/libs/mem-agent/src/psi.rs
+++ b/src/libs/mem-agent/src/psi.rs
@@ -10,7 +10,7 @@ use std::fs;
 use std::fs::File;
 use std::fs::OpenOptions;
 use std::io::{BufRead, BufReader};
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;

 const MEM_PSI: &str = "memory.pressure";
 const IO_PSI: &str = "io.pressure";
@@ -20,8 +20,10 @@ fn find_psi_subdirs() -> Result<PathBuf> {
        for entry in fs::read_dir(CGROUP_PATH)? {
            let entry = entry?;
            let path = entry.path();
-            if path.is_dir() && path.join(MEM_PSI).is_file() && path.join(IO_PSI).is_file() {
-                return Ok(path.clone());
+            if path.is_dir() {
+                if path.join(MEM_PSI).is_file() && path.join(IO_PSI).is_file() {
+                    return Ok(path.clone());
+                }
            }
        }

@@ -31,15 +33,15 @@ fn find_psi_subdirs() -> Result<PathBuf> {
    }
 }

-pub fn check(psi_path: &Path) -> Result<PathBuf> {
+pub fn check(psi_path: &PathBuf) -> Result<PathBuf> {
    if crate::misc::is_test_environment() {
-        return Ok(psi_path.to_path_buf());
+        return Ok(psi_path.clone());
    }

    let p = if psi_path.as_os_str().is_empty() {
        find_psi_subdirs().map_err(|e| anyhow!("find_psi_subdirs failed: {}", e))?
    } else {
-        psi_path.to_path_buf()
+        psi_path.clone()
    };

    let mem_psi_path = p.join(MEM_PSI);
@@ -62,7 +64,7 @@ fn read_pressure_some_total(file_path: PathBuf) -> Result<u64> {
    if reader
        .read_line(&mut first_line)
        .map_err(|e| anyhow!("reader.read_line failed: {}", e))?
-        == 0
+        <= 0
    {
        return Err(anyhow!("File is empty"));
    }
--- a/src/libs/mem-agent/src/timer.rs
+++ b/src/libs/mem-agent/src/timer.rs
@@ -67,22 +67,22 @@ mod tests {
        let mut timeout = Timeout::new(1);

        // timeout should be timeout at once.
-        assert!(timeout.is_timeout());
+        assert_eq!(timeout.is_timeout(), true);

        timeout.reset();

-        assert!(!timeout.is_timeout());
+        assert_eq!(timeout.is_timeout(), false);
        thread::sleep(Duration::from_secs(2));
-        assert!(timeout.is_timeout());
+        assert_eq!(timeout.is_timeout(), true);

        timeout.set_sleep_duration(2);
        timeout.reset();

-        assert!(!timeout.is_timeout());
+        assert_eq!(timeout.is_timeout(), false);
        thread::sleep(Duration::from_secs(1));
-        assert!(!timeout.is_timeout());
+        assert_eq!(timeout.is_timeout(), false);

        thread::sleep(Duration::from_secs(1));
-        assert!(timeout.is_timeout());
+        assert_eq!(timeout.is_timeout(), true);
    }
 }
--- a/src/runtime-rs/Cargo.lock
+++ b/src/runtime-rs/Cargo.lock
@@ -38,12 +38,6 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"

-[[package]]
-name = "adler2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-
 [[package]]
 name = "agent"
 version = "0.1.0"
@@ -352,7 +346,7 @@ dependencies = [
 "cc",
 "cfg-if 1.0.0",
 "libc",
- "miniz_oxide 0.7.1",
+ "miniz_oxide",
 "object",
 "rustc-demangle",
 ]
@@ -1442,13 +1436,13 @@ checksum = "37ab347416e802de484e4d03c7316c48f1ecb56574dfd4a46a80f173ce1de04d"

 [[package]]
 name = "flate2"
-version = "1.1.5"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
+checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
 dependencies = [
 "crc32fast",
 "libz-sys",
- "miniz_oxide 0.8.9",
+ "miniz_oxide",
 ]

 [[package]]
@@ -2315,9 +2309,9 @@ dependencies = [

 [[package]]
 name = "kvm-ioctls"
-version = "0.12.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d592c9b0da14bacab1fe89c78e7ed873b20cf7f502d0fc26f628d733215b1e5"
+checksum = "c3a321cabd827642499c77e27314f388dd83a717a5ca716b86476fb947f73ae4"
 dependencies = [
 "kvm-bindings",
 "libc",
@@ -2519,16 +2513,6 @@ dependencies = [
 "adler",
 ]

-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
 [[package]]
 name = "mio"
 version = "0.8.11"
@@ -4482,12 +4466,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "simd-adler32"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
-
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -5290,9 +5268,6 @@ name = "uuid"
 version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
-dependencies = [
- "getrandom 0.3.2",
-]

 [[package]]
 name = "valuable"
@@ -5387,7 +5362,6 @@ dependencies = [
 "toml 0.4.10",
 "tracing",
 "url",
- "uuid 1.16.0",
 ]

 [[package]]
--- a/src/runtime-rs/Makefile
+++ b/src/runtime-rs/Makefile
@@ -77,9 +77,7 @@ CLHBINDIR := $(PREFIXDEPS)/bin
 QEMUBINDIR := $(PREFIXDEPS)/bin
 PROJECT_DIR = $(PROJECT_TAG)
 IMAGENAME = $(PROJECT_TAG).img
-IMAGECONFIDENTIALNAME = $(PROJECT_TAG)-confidential.img
 INITRDNAME = $(PROJECT_TAG)-initrd.img
-INITRDCONFIDENTIALNAME = $(PROJECT_TAG)-initrd-confidential.img
 TARGET = $(PROJECT_COMPONENT)
 SYSCONFDIR := /etc
 LOCALSTATEDIR := /var
@@ -114,9 +112,7 @@ PKGDATADIR := $(PREFIXDEPS)/share/$(PROJECT_DIR)
 PKGRUNDIR := $(LOCALSTATEDIR)/run/$(PROJECT_DIR)
 KERNELDIR := $(PKGDATADIR)
 IMAGEPATH := $(PKGDATADIR)/$(IMAGENAME)
-IMAGECONFIDENTIALPATH := $(PKGDATADIR)/$(IMAGECONFIDENTIALNAME)
 INITRDPATH := $(PKGDATADIR)/$(INITRDNAME)
-INITRDCONFIDENTIALPATH := $(PKGDATADIR)/$(INITRDCONFIDENTIALNAME)

 ROOTFSTYPE_EXT4 := \"ext4\"
 ROOTFSTYPE_XFS := \"xfs\"
@@ -190,8 +186,6 @@ QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT := 4050

 # Create Container Timeout in seconds
 DEFCREATECONTAINERTIMEOUT ?= 30
-DEFCREATECONTAINERTIMEOUT_COCO ?= 60
-DEFSTATICRESOURCEMGMT_COCO = true

 SED = sed
 CLI_DIR = cmd
@@ -270,7 +264,7 @@ ifneq (,$(CLHCMD))
    VMROOTFSDRIVER_CLH := virtio-pmem

    DEFSANDBOXCGROUPONLY_CLH := true
-    DEFSTATICRESOURCEMGMT_CLH := false
+    DEFSTATICRESOURCEMGMT_CLH := true
 endif

 ifneq (,$(QEMUCMD))
@@ -304,18 +298,6 @@ ifneq (,$(QEMUCMD))

    CONFIGS += $(CONFIG_QEMU_SE)

-    CONFIG_FILE_QEMU_COCO_DEV = configuration-qemu-coco-dev-runtime-rs.toml
-    CONFIG_QEMU_COCO_DEV = config/$(CONFIG_FILE_QEMU_COCO_DEV)
-    CONFIG_QEMU_COCO_DEV_IN = $(CONFIG_QEMU_COCO_DEV).in
-
-    CONFIG_PATH_QEMU_COCO_DEV = $(abspath $(CONFDIR)/$(CONFIG_FILE_QEMU_COCO_DEV))
-    CONFIG_PATHS += $(CONFIG_PATH_QEMU_COCO_DEV)
-
-    SYSCONFIG_QEMU_COCO_DEV = $(abspath $(SYSCONFDIR)/$(CONFIG_FILE_QEMU_COCO_DEV))
-    SYSCONFIG_PATHS += $(SYSCONFIG_QEMU_COCO_DEV)
-
-    CONFIGS += $(CONFIG_QEMU_COCO_DEV)
-
    KERNELTYPE_QEMU = uncompressed
    KERNEL_NAME_QEMU = $(call MAKE_KERNEL_NAME,$(KERNELTYPE_QEMU))
    KERNELPATH_QEMU = $(KERNELDIR)/$(KERNEL_NAME_QEMU)
@@ -323,12 +305,8 @@ ifneq (,$(QEMUCMD))
    KERNEL_NAME_QEMU_SE = kata-containers-se.img
    KERNELPATH_QEMU_SE = $(KERNELDIR)/$(KERNEL_NAME_QEMU_SE)

-    KERNEL_TYPE_COCO = compressed
-    KERNEL_NAME_COCO = $(call MAKE_KERNEL_NAME_COCO,$(KERNEL_TYPE_COCO))
-    KERNELPATH_COCO = $(KERNELDIR)/$(KERNEL_NAME_COCO)
-
    # overriding options
-    DEFSTATICRESOURCEMGMT_QEMU := false
+    DEFSTATICRESOURCEMGMT_QEMU := true

    # qemu-specific options
    DEFSANDBOXCGROUPONLY_QEMU := false
@@ -343,7 +321,6 @@ endif
    DEFMAXVCPUS_QEMU := 0
    DEFSHAREDFS_QEMU_VIRTIOFS := virtio-fs
    DEFSHAREDFS_QEMU_SEL_VIRTIOFS := none
-    DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS := none
    DEFBLOCKDEVICEAIO_QEMU := io_uring
    DEFNETWORKMODEL_QEMU := tcfilter
    DEFDISABLEGUESTSELINUX := true
@@ -410,7 +387,6 @@ USER_VARS += CONFIG_PATH
 USER_VARS += CONFIG_QEMU_IN
 USER_VARS += CONFIG_QEMU_SE_IN
 USER_VARS += CONFIG_REMOTE_IN
-USER_VARS += CONFIG_QEMU_COCO_DEV_IN
 USER_VARS += DESTDIR
 USER_VARS += HYPERVISOR
 USER_VARS += USE_BUILDIN_DB
@@ -436,13 +412,8 @@ USER_VARS += FCVALIDJAILERPATHS
 USER_VARS += DEFMAXMEMSZ_FC
 USER_VARS += SYSCONFIG
 USER_VARS += IMAGENAME
-USER_VARS += IMAGECONFIDENTIALNAME
 USER_VARS += IMAGEPATH
-USER_VARS += IMAGECONFIDENTIALPATH
-USER_VARS += INITRDNAME
-USER_VARS += INITRDCONFIDENTIALNAME
 USER_VARS += INITRDPATH
-USER_VARS += INITRDCONFIDENTIALPATH
 USER_VARS += DEFROOTFSTYPE
 USER_VARS += VMROOTFSDRIVER_DB
 USER_VARS += VMROOTFSDRIVER_CLH
@@ -454,7 +425,6 @@ USER_VARS += KERNELPATH_DB
 USER_VARS += KERNELPATH_QEMU
 USER_VARS += KERNELPATH_QEMU_SE
 USER_VARS += KERNELPATH_FC
-USER_VARS += KERNELPATH_COCO
 USER_VARS += KERNELPATH
 USER_VARS += KERNELVIRTIOFSPATH
 USER_VARS += FIRMWAREPATH
@@ -506,7 +476,6 @@ USER_VARS += DEFBLOCKSTORAGEDRIVER_FC
 USER_VARS += DEFSHAREDFS_CLH_VIRTIOFS
 USER_VARS += DEFSHAREDFS_QEMU_VIRTIOFS
 USER_VARS += DEFSHAREDFS_QEMU_SEL_VIRTIOFS
-USER_VARS += DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS
 USER_VARS += DEFVIRTIOFSDAEMON
 USER_VARS += DEFVALIDVIRTIOFSDAEMONPATHS
 USER_VARS += DEFVIRTIOFSCACHESIZE
@@ -535,7 +504,6 @@ USER_VARS += DEFSTATICRESOURCEMGMT_DB
 USER_VARS += DEFSTATICRESOURCEMGMT_FC
 USER_VARS += DEFSTATICRESOURCEMGMT_CLH
 USER_VARS += DEFSTATICRESOURCEMGMT_QEMU
-USER_VARS += DEFSTATICRESOURCEMGMT_COCO
 USER_VARS += DEFBINDMOUNTS
 USER_VARS += DEFVFIOMODE
 USER_VARS += DEFVFIOMODE_SE
@@ -554,7 +522,6 @@ USER_VARS += DEFDANCONF
 USER_VARS += DEFFORCEGUESTPULL
 USER_VARS += QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT
 USER_VARS += DEFCREATECONTAINERTIMEOUT
-USER_VARS += DEFCREATECONTAINERTIMEOUT_COCO

 SOURCES := \
  $(shell find . 2>&1 | grep -E '.*\.rs$$') \
@@ -643,10 +610,6 @@ define MAKE_KERNEL_NAME
 $(if $(findstring uncompressed,$1),vmlinux.container,vmlinuz.container)
 endef

-define MAKE_KERNEL_NAME_COCO
-$(if $(findstring uncompressed,$1),vmlinux-confidential.container,vmlinuz-confidential.container)
-endef
-
 .DEFAULT_GOAL := default

 GENERATED_FILES += $(CONFIGS)
--- a/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
+++ b/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
@@ -225,11 +225,6 @@ block_device_driver = "virtio-blk-pci"
 # result in memory pre allocation
 #enable_hugepages = true

-# Enable running clh VMM as a non-root user.
-# By default clh VMM run as root. When this is set to true, clh VMM process runs as
-# a non-root random user. See documentation for the limitations of this mode.
-#rootless = true
-
 # Disable the 'seccomp' feature from Cloud Hypervisor, firecracker or dragonball, default false
 # disable_seccomp = true

--- a/src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in
@@ -1,851 +0,0 @@
-# Copyright (c) 2017-2019 Intel Corporation
-# Copyright (c) 2021 Adobe Inc.
-# Copyright (c) 2024-2025 IBM Corp.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-# XXX: WARNING: this file is auto-generated.
-# XXX:
-# XXX: Source file: "@CONFIG_QEMU_IN@"
-# XXX: Project:
-# XXX:   Name: @PROJECT_NAME@
-# XXX:   Type: @PROJECT_TYPE@
-
-[hypervisor.qemu]
-path = "@QEMUPATH@"
-kernel = "@KERNELPATH_COCO@"
-image = "@IMAGECONFIDENTIALPATH@"
-# initrd = "@INITRDCONFIDENTIALPATH@"
-machine_type = "@MACHINETYPE@"
-
-# rootfs filesystem type:
-#   - ext4 (default)
-#   - xfs
-#   - erofs
-rootfs_type=@DEFROOTFSTYPE@
-
-# Block storage driver to be used for the VM rootfs is backed
-# by a block device. This is virtio-blk-pci, virtio-blk-mmio or nvdimm
-vm_rootfs_driver = "@VMROOTFSDRIVER_QEMU@"
-
-# Enable confidential guest support.
-# Toggling that setting may trigger different hardware features, ranging
-# from memory encryption to both memory and CPU-state encryption and integrity.
-# The Kata Containers runtime dynamically detects the available feature set and
-# aims at enabling the largest possible one, returning an error if none is
-# available, or none is supported by the hypervisor.
-#
-# Known limitations:
-# * Does not work by design:
-#   - CPU Hotplug
-#   - Memory Hotplug
-#   - NVDIMM devices
-#
-# Default false
-# confidential_guest = true
-
-# Choose AMD SEV-SNP confidential guests
-# In case of using confidential guests on AMD hardware that supports both SEV
-# and SEV-SNP, the following enables SEV-SNP guests. SEV guests are default.
-# Default false
-# sev_snp_guest = true
-
-# Enable running QEMU VMM as a non-root user.
-# By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
-# a non-root random user. See documentation for the limitations of this mode.
-# rootless = true
-
-# List of valid annotation names for the hypervisor
-# Each member of the list is a regular expression, which is the base name
-# of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
-enable_annotations = @DEFENABLEANNOTATIONS_COCO@
-
-# List of valid annotations values for the hypervisor
-# Each member of the list is a path pattern as described by glob(3).
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @QEMUVALIDHYPERVISORPATHS@
-valid_hypervisor_paths = @QEMUVALIDHYPERVISORPATHS@
-
-# Optional space-separated list of options to pass to the guest kernel.
-# For example, use `kernel_params = "vsyscall=emulate"` if you are having
-# trouble running pre-2.15 glibc.
-#
-# WARNING: - any parameter specified here will take priority over the default
-# parameter value of the same name used to start the virtual machine.
-# Do not set values here unless you understand the impact of doing so as you
-# may stop the virtual machine from booting.
-# To see the list of default parameters, enable hypervisor debug, create a
-# container and look for 'default-kernel-parameters' log entries.
-kernel_params = "@KERNELPARAMS@"
-
-# Path to the firmware.
-# If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWAREPATH@"
-
-# Path to the firmware volume.
-# firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
-# as configuration) and FIRMWARE_CODE.fd (UEFI program image). UEFI variables
-# can be customized per each user while UEFI code is kept same.
-firmware_volume = "@FIRMWAREVOLUMEPATH@"
-
-# Machine accelerators
-# comma-separated list of machine accelerators to pass to the hypervisor.
-# For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators="@MACHINEACCELERATORS@"
-
-# Qemu seccomp sandbox feature
-# comma-separated list of seccomp sandbox features to control the syscall access.
-# For example, `seccompsandbox= "on,obsolete=deny,spawn=deny,resourcecontrol=deny"`
-# Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
-# Another note: enabling this feature may reduce performance, you may enable
-# /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
-
-# CPU features
-# comma-separated list of cpu features to pass to the cpu
-# For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features="@CPUFEATURES@"
-
-# Default number of vCPUs per SB/VM:
-# unspecified or 0                --> will be set to @DEFVCPUS@
-# < 0                             --> will be set to the actual number of physical cores
-# > 0 <= number of physical cores --> will be set to the specified number
-# > number of physical cores      --> will be set to the actual number of physical cores
-default_vcpus = @DEFVCPUS_QEMU@
-
-# Default maximum number of vCPUs per SB/VM:
-# unspecified or == 0             --> will be set to the actual number of physical cores or to the maximum number
-#                                     of vCPUs supported by KVM if that number is exceeded
-# > 0 <= number of physical cores --> will be set to the specified number
-# > number of physical cores      --> will be set to the actual number of physical cores or to the maximum number
-#                                     of vCPUs supported by KVM if that number is exceeded
-# WARNING: Depending of the architecture, the maximum number of vCPUs supported by KVM is used when
-# the actual number of physical cores is greater than it.
-# WARNING: Be aware that this value impacts the virtual machine's memory footprint and CPU
-# the hotplug functionality. For example, `default_maxvcpus = 240` specifies that until 240 vCPUs
-# can be added to a SB/VM, but the memory footprint will be big. Another example, with
-# `default_maxvcpus = 8` the memory footprint will be small, but 8 will be the maximum number of
-# vCPUs supported by the SB/VM. In general, we recommend that you do not edit this variable,
-# unless you know what are you doing.
-# NOTICE: on arm platform with gicv2 interrupt controller, set it to 8.
-default_maxvcpus = @DEFMAXVCPUS_QEMU@
-
-# Bridges can be used to hot plug devices.
-# Limitations:
-# * Currently only pci bridges are supported
-# * Until 30 devices per bridge can be hot plugged.
-# * Until 5 PCI bridges can be cold plugged per VM.
-#   This limitation could be a bug in qemu or in the kernel
-# Default number of bridges per SB/VM:
-# unspecified or 0   --> will be set to @DEFBRIDGES@
-# > 1 <= 5           --> will be set to the specified number
-# > 5                --> will be set to 5
-default_bridges = @DEFBRIDGES@
-
-# Reclaim guest freed memory.
-# Enabling this will result in the VM balloon device having f_reporting=on set.
-# Then the hypervisor will use it to reclaim guest freed memory.
-# This is useful for reducing the amount of memory used by a VM.
-# Enabling this feature may sometimes reduce the speed of memory access in
-# the VM.
-#
-# Default false
-#reclaim_guest_freed_memory = true
-
-# Default memory size in MiB for SB/VM.
-# If unspecified then it will be set @DEFMEMSZ@ MiB.
-default_memory = @DEFMEMSZ@
-#
-# Default memory slots per SB/VM.
-# If unspecified then it will be set @DEFMEMSLOTS@.
-# This is will determine the times that memory will be hotadded to sandbox/VM.
-#memory_slots = @DEFMEMSLOTS@
-
-# Default maximum memory in MiB per SB / VM
-# unspecified or == 0           --> will be set to the actual amount of physical RAM
-# > 0 <= amount of physical RAM --> will be set to the specified number
-# > amount of physical RAM      --> will be set to the actual amount of physical RAM
-default_maxmemory = @DEFMAXMEMSZ@
-
-# The size in MiB will be plused to max memory of hypervisor.
-# It is the memory address space for the NVDIMM devie.
-# If set block storage driver (block_device_driver) to "nvdimm",
-# should set memory_offset to the size of block device.
-# Default 0
-#memory_offset = 0
-
-# Specifies virtio-mem will be enabled or not.
-# Please note that this option should be used with the command
-# "echo 1 > /proc/sys/vm/overcommit_memory".
-# Default false
-#enable_virtio_mem = true
-
-# Disable block device from being used for a container's rootfs.
-# In case of a storage driver like devicemapper where a container's
-# root file system is backed by a block device, the block device is passed
-# directly to the hypervisor for performance reasons.
-# This flag prevents the block device from being passed to the hypervisor,
-# virtio-fs is used instead to pass the rootfs.
-disable_block_device_use = @DEFDISABLEBLOCK@
-
-# Shared file system type:
-#   - virtio-fs (default)
-#   - virtio-9p
-#   - virtio-fs-nydus
-#   - none
-shared_fs = "@DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS@"
-
-# Path to vhost-user-fs daemon.
-virtio_fs_daemon = "@DEFVIRTIOFSDAEMON@"
-
-# List of valid annotations values for the virtiofs daemon
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDVIRTIOFSDAEMONPATHS@
-valid_virtio_fs_daemon_paths = @DEFVALIDVIRTIOFSDAEMONPATHS@
-
-# Default size of DAX cache in MiB
-virtio_fs_cache_size = @DEFVIRTIOFSCACHESIZE@
-
-# Default size of virtqueues
-virtio_fs_queue_size = @DEFVIRTIOFSQUEUESIZE@
-
-# Extra args for virtiofsd daemon
-#
-# Format example:
-#   ["--arg1=xxx", "--arg2=yyy"]
-# Examples:
-#   Set virtiofsd log level to debug : ["--log-level=debug"]
-#
-# see `virtiofsd -h` for possible options.
-virtio_fs_extra_args = @DEFVIRTIOFSEXTRAARGS@
-
-# Cache mode:
-#
-#  - never
-#    Metadata, data, and pathname lookup are not cached in guest. They are
-#    always fetched from host and any changes are immediately pushed to host.
-#
-#  - auto
-#    Metadata and pathname lookup cache expires after a configured amount of
-#    time (default is 1 second). Data is cached while the file is open (close
-#    to open consistency).
-#
-#  - always
-#    Metadata, data, and pathname lookup are cached in guest and never expire.
-virtio_fs_cache = "@DEFVIRTIOFSCACHE@"
-
-# Block storage driver to be used for the hypervisor in case the container
-# rootfs is backed by a block device. This is virtio-scsi, virtio-blk
-# or nvdimm.
-block_device_driver = "@DEFBLOCKSTORAGEDRIVER_QEMU@"
-
-# aio is the I/O mechanism used by qemu
-# Options:
-#
-#   - threads
-#     Pthread based disk I/O.
-#
-#   - native
-#     Native Linux I/O.
-#
-#   - io_uring
-#     Linux io_uring API. This provides the fastest I/O operations on Linux, requires kernel>5.1 and
-#     qemu >=5.0.
-block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
-
-# Specifies cache-related options will be set to block devices or not.
-# Default false
-#block_device_cache_set = true
-
-# Specifies cache-related options for block devices.
-# Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
-# Default false
-#block_device_cache_direct = true
-
-# Specifies cache-related options for block devices.
-# Denotes whether flush requests for the device are ignored.
-# Default false
-#block_device_cache_noflush = true
-
-# Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently only implemented
-# for SCSI.
-#
-enable_iothreads = @DEFENABLEIOTHREADS@
-
-# Enable pre allocation of VM RAM, default false
-# Enabling this will result in lower container density
-# as all of the memory will be allocated and locked
-# This is useful when you want to reserve all the memory
-# upfront or in the cases where you want memory latencies
-# to be very predictable
-# Default false
-#enable_mem_prealloc = true
-
-# Enable huge pages for VM RAM, default false
-# Enabling this will result in the VM memory
-# being allocated using huge pages.
-# This is useful when you want to use vhost-user network
-# stacks within the container. This will automatically
-# result in memory pre allocation
-#enable_hugepages = true
-
-# Enable vhost-user storage device, default false
-# Enabling this will result in some Linux reserved block type
-# major range 240-254 being chosen to represent vhost-user devices.
-enable_vhost_user_store = @DEFENABLEVHOSTUSERSTORE@
-
-# The base directory specifically used for vhost-user devices.
-# Its sub-path "block" is used for block devices; "block/sockets" is
-# where we expect vhost-user sockets to live; "block/devices" is where
-# simulated block device nodes for vhost-user devices to live.
-vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
-
-# Enable vIOMMU, default false
-# Enabling this will result in the VM having a vIOMMU device
-# This will also add the following options to the kernel's
-# command line: intel_iommu=on,iommu=pt
-#enable_iommu = true
-
-# Enable IOMMU_PLATFORM, default false
-# Enabling this will result in the VM device having iommu_platform=on set
-#enable_iommu_platform = true
-
-# List of valid annotations values for the vhost user store path
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDVHOSTUSERSTOREPATHS@
-valid_vhost_user_store_paths = @DEFVALIDVHOSTUSERSTOREPATHS@
-
-# The timeout for reconnecting on non-server spdk sockets when the remote end goes away.
-# qemu will delay this many seconds and then attempt to reconnect.
-# Zero disables reconnecting, and the default is zero.
-vhost_user_reconnect_timeout_sec = 0
-
-# Enable file based guest memory support. The default is an empty string which
-# will disable this feature. In the case of virtio-fs, this is enabled
-# automatically and '/dev/shm' is used as the backing folder.
-# This option will be ignored if VM templating is enabled.
-#file_mem_backend = "@DEFFILEMEMBACKEND@"
-
-# List of valid annotations values for the file_mem_backend annotation
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDFILEMEMBACKENDS@
-valid_file_mem_backends = @DEFVALIDFILEMEMBACKENDS@
-
-# -pflash can add image file to VM. The arguments of it should be in format
-# of ["/path/to/flash0.img", "/path/to/flash1.img"]
-pflashes = []
-
-# This option changes the default hypervisor and kernel parameters
-# to enable debug output where available.
-#
-# Default false
-#enable_debug = true
-
-# This option allows to add an extra HMP or QMP socket when `enable_debug = true`
-#
-# WARNING: Anyone with access to the extra socket can take full control of
-# Qemu. This is for debugging purpose only and must *NEVER* be used in
-# production.
-#
-# Valid values are :
-# - "hmp"
-# - "qmp"
-# - "qmp-pretty" (same as "qmp" with pretty json formatting)
-#
-# If set to the empty string "", no extra monitor socket is added. This is
-# the default.
-#extra_monitor_socket = "hmp"
-
-# Disable the customizations done in the runtime when it detects
-# that it is running on top a VMM. This will result in the runtime
-# behaving as it would when running on bare metal.
-#
-#disable_nesting_checks = true
-
-# This is the msize used for 9p shares. It is the number of bytes
-# used for 9p packet payload.
-#msize_9p = @DEFMSIZE9P@
-
-# If false and nvdimm is supported, use nvdimm device to plug guest image.
-# Otherwise virtio-block device is used.
-#
-# nvdimm is not supported when `confidential_guest = true`.
-#
-# Default is false
-#disable_image_nvdimm = true
-
-# VFIO devices are hotplugged on a bridge by default.
-# Enable hotplugging on root bus. This may be required for devices with
-# a large PCI bar, as this is a current limitation with hotplugging on
-# a bridge.
-# Default false
-#hotplug_vfio_on_root_bus = true
-
-# Enable hot-plugging of VFIO devices to a bridge-port,
-# root-port or switch-port.
-# The default setting is  "no-port"
-#hot_plug_vfio = "root-port"
-
-# In a confidential compute environment hot-plugging can compromise
-# security.
-# Enable cold-plugging of VFIO devices to a bridge-port,
-# root-port or switch-port.
-# The default setting is  "no-port", which means disabled.
-#cold_plug_vfio = "root-port"
-
-# Before hot plugging a PCIe device, you need to add a pcie_root_port device.
-# Use this parameter when using some large PCI bar devices, such as Nvidia GPU
-# The value means the number of pcie_root_port
-# This value is valid when hotplug_vfio_on_root_bus is true and machine_type is "q35"
-# Default 0
-#pcie_root_port = 2
-
-# Before hot plugging a PCIe device onto a switch port, you need add a pcie_switch_port device fist.
-# Use this parameter when using some large PCI bar devices, such as Nvidia GPU
-# The value means how many devices attached onto pcie_switch_port will be created.
-# This value is valid when hotplug_vfio_on_root_bus is true, and machine_type is "q35"
-# Default 0
-#pcie_switch_port = 2
-
-# If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
-# security (vhost-net runs ring0) for network I/O performance.
-#disable_vhost_net = true
-
-#
-# Default entropy source.
-# The path to a host source of entropy (including a real hardware RNG)
-# /dev/urandom and /dev/random are two main options.
-# Be aware that /dev/random is a blocking source of entropy.  If the host
-# runs out of entropy, the VMs boot time will increase leading to get startup
-# timeouts.
-# The source of entropy /dev/urandom is non-blocking and provides a
-# generally acceptable source of entropy. It should work well for pretty much
-# all practical purposes.
-#entropy_source= "@DEFENTROPYSOURCE@"
-
-# List of valid annotations values for entropy_source
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDENTROPYSOURCES@
-valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
-
-# Path to OCI hook binaries in the *guest rootfs*.
-# This does not affect host-side hooks which must instead be added to
-# the OCI spec passed to the runtime.
-#
-# You can create a rootfs with hooks by customizing the osbuilder scripts:
-# https://github.com/kata-containers/kata-containers/tree/main/tools/osbuilder
-#
-# Hooks must be stored in a subdirectory of guest_hook_path according to their
-# hook type, i.e. "guest_hook_path/{prestart,poststart,poststop}".
-# The agent will scan these directories for executable files and add them, in
-# lexicographical order, to the lifecycle of the guest container.
-# Hooks are executed in the runtime namespace of the guest. See the official documentation:
-# https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
-# Warnings will be logged if any error is encountered while scanning for hooks,
-# but it will not abort container execution.
-#guest_hook_path = "/usr/share/oci/hooks"
-
-# Enable connection to Quote Generation Service (QGS)
-# The "tdx_quote_generation_service_socket_port" parameter configures how QEMU connects to the TDX Quote Generation Service (QGS).
-# This connection is essential for Trusted Domain (TD) attestation, as QGS signs the TDREPORT sent by QEMU via the GetQuote hypercall.
-# By default QGS runs on vsock port 4050, but can be modified by the host admin. For QEMU's tdx-guest object, this connection needs to
-# be specified in a JSON format, for example:
-# -object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'
-# It's important to note that setting "tdx_quote_generation_service_socket_port" to 0 enables communication via Unix Domain Sockets (UDS).
-# To activate UDS, the QGS service itself must be launched with the "-port=0" parameter and the UDS will always be located at /var/run/tdx-qgs/qgs.socket.
-# -object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"unix","path":"/var/run/tdx-qgs/qgs.socket"}}'
-# tdx_quote_generation_service_socket_port = @QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT@
-
-#
-# Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
-# In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
-# Default 0-sized value means unlimited rate.
-#rx_rate_limiter_max_rate = 0
-# Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
-# In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
-# to discipline traffic.
-# Default 0-sized value means unlimited rate.
-#tx_rate_limiter_max_rate = 0
-
-# Set where to save the guest memory dump file.
-# If set, when GUEST_PANICKED event occurred,
-# guest memeory will be dumped to host filesystem under guest_memory_dump_path,
-# This directory will be created automatically if it does not exist.
-#
-# The dumped file(also called vmcore) can be processed with crash or gdb.
-#
-# WARNING:
-#   Dump guest’s memory can take very long depending on the amount of guest memory
-#   and use much disk space.
-#guest_memory_dump_path="/var/crash/kata"
-
-# If enable paging.
-# Basically, if you want to use "gdb" rather than "crash",
-# or need the guest-virtual addresses in the ELF vmcore,
-# then you should enable paging.
-#
-# See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-#guest_memory_dump_paging=false
-
-# use legacy serial for guest console if available and implemented for architecture. Default false
-#use_legacy_serial = true
-
-# disable applying SELinux on the VMM process (default false)
-disable_selinux=@DEFDISABLESELINUX@
-
-# disable applying SELinux on the container process
-# If set to false, the type `container_t` is applied to the container process by default.
-# Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
-# with `SELINUX=yes`.
-# (default: true)
-disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
-
-
-[factory]
-# VM templating support. Once enabled, new VMs are created from template
-# using vm cloning. They will share the same initial kernel, initramfs and
-# agent memory by mapping it readonly. It helps speeding up new container
-# creation and saves a lot of memory if there are many kata containers running
-# on the same host.
-#
-# When disabled, new VMs are created from scratch.
-#
-# Note: Requires "initrd=" to be set ("image=" is not supported).
-#
-# Default false
-#enable_template = true
-
-# Specifies the path of template.
-#
-# Default "/run/vc/vm/template"
-#template_path = "/run/vc/vm/template"
-
-# The number of caches of VMCache:
-# unspecified or == 0   --> VMCache is disabled
-# > 0                   --> will be set to the specified number
-#
-# VMCache is a function that creates VMs as caches before using it.
-# It helps speed up new container creation.
-# The function consists of a server and some clients communicating
-# through Unix socket.  The protocol is gRPC in protocols/cache/cache.proto.
-# The VMCache server will create some VMs and cache them by factory cache.
-# It will convert the VM to gRPC format and transport it when gets
-# requestion from clients.
-# Factory grpccache is the VMCache client.  It will request gRPC format
-# VM and convert it back to a VM.  If VMCache function is enabled,
-# kata-runtime will request VM from factory grpccache when it creates
-# a new sandbox.
-#
-# Default 0
-#vm_cache_number = 0
-
-# Specify the address of the Unix socket that is used by VMCache.
-#
-# Default /var/run/kata-containers/cache.sock
-#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
-
-[agent.@PROJECT_TYPE@]
-# If enabled, make the agent display debug-level messages.
-# (default: disabled)
-#enable_debug = true
-
-# Enable agent tracing.
-#
-# If enabled, the agent will generate OpenTelemetry trace spans.
-#
-# Notes:
-#
-# - If the runtime also has tracing enabled, the agent spans will be
-#   associated with the appropriate runtime parent span.
-# - If enabled, the runtime will wait for the container to shutdown,
-#   increasing the container shutdown time slightly.
-#
-# (default: disabled)
-#enable_tracing = true
-
-# Comma separated list of kernel modules and their parameters.
-# These modules will be loaded in the guest kernel using modprobe(8).
-# The following example can be used to load two kernel modules with parameters
-#  - kernel_modules=["e1000e InterruptThrottleRate=3000,3000,3000 EEE=1", "i915 enable_ppgtt=0"]
-# The first word is considered as the module name and the rest as its parameters.
-# Container will not be started when:
-#  * A kernel module is specified and the modprobe command is not installed in the guest
-#    or it fails loading the module.
-#  * The module is not available in the guest or it doesn't met the guest kernel
-#    requirements, like architecture and version.
-#
-kernel_modules=[]
-
-# Enable debug console.
-
-# If enabled, user can connect guest OS running inside hypervisor
-# through "kata-runtime exec <sandbox-id>" command
-
-#debug_console_enabled = true
-
-# Agent dial timeout in millisecond.
-# (default: 10)
-#dial_timeout_ms = 10
-
-# Agent reconnect timeout in millisecond.
-# Retry times = reconnect_timeout_ms / dial_timeout_ms (default: 300)
-# If you find pod cannot connect to the agent when starting, please
-# consider increasing this value to increase the retry times.
-# You'd better not change the value of dial_timeout_ms, unless you have an
-# idea of what you are doing.
-# (default: 3000)
-#reconnect_timeout_ms = 3000
-
-# Create Container Request Timeout
-# This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
-# It's also used to ensure that workloads, especially those involving large image pulls within the guest,
-# have sufficient time to become ready.
-#
-# Effective Timeout Determination:
-# The effective timeout for a CreateContainerRequest is determined by taking the minimum of the following two values:
-# - create_container_timeout: The timeout value configured for creating containers (default: 30 seconds).
-# - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
-# (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
-# Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)
-# create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
-
-[agent.@PROJECT_TYPE@.mem_agent]
-# Control the mem-agent function enable or disable.
-# Default to false
-#mem_agent_enable = true
-
-# Control the mem-agent memcg function disable or enable
-# Default to false
-#memcg_disable = false
-
-# Control the mem-agent function swap enable or disable.
-# Default to false
-#memcg_swap = false
-
-# Control the mem-agent function swappiness max number.
-# Default to 50
-#memcg_swappiness_max = 50
-
-# Control the mem-agent memcg function wait period seconds
-# Default to 600
-#memcg_period_secs = 600
-
-# Control the mem-agent memcg wait period PSI percent limit.
-# If the percentage of memory and IO PSI stall time within
-# the memcg waiting period for a cgroup exceeds this value,
-# then the aging and eviction for this cgroup will not be
-# executed after this waiting period.
-# Default to 1
-#memcg_period_psi_percent_limit = 1
-
-# Control the mem-agent memcg eviction PSI percent limit.
-# If the percentage of memory and IO PSI stall time for a cgroup
-# exceeds this value during an eviction cycle, the eviction for
-# this cgroup will immediately stop and will not resume until
-# the next memcg waiting period.
-# Default to 1
-#memcg_eviction_psi_percent_limit = 1
-
-# Control the mem-agent memcg eviction run aging count min.
-# A cgroup will only perform eviction when the number of aging cycles
-# in memcg is greater than or equal to memcg_eviction_run_aging_count_min.
-# Default to 3
-#memcg_eviction_run_aging_count_min = 3
-
-# Control the mem-agent compact function disable or enable
-# Default to false
-#compact_disable = false
-
-# Control the mem-agent compaction function wait period seconds
-# Default to 600
-#compact_period_secs = 600
-
-# Control the mem-agent compaction function wait period PSI percent limit.
-# If the percentage of memory and IO PSI stall time within
-# the compaction waiting period exceeds this value,
-# then the compaction will not be executed after this waiting period.
-# Default to 1
-#compact_period_psi_percent_limit = 1
-
-# Control the mem-agent compaction function compact PSI percent limit.
-# During compaction, the percentage of memory and IO PSI stall time
-# is checked every second. If this percentage exceeds
-# compact_psi_percent_limit, the compaction process will stop.
-# Default to 5
-#compact_psi_percent_limit = 5
-
-# Control the maximum number of seconds for each compaction of mem-agent compact function.
-# Default to 180
-#compact_sec_max = 180
-
-# Control the mem-agent compaction function compact order.
-# compact_order is use with compact_threshold.
-# Default to 9
-#compact_order = 9
-
-# Control the mem-agent compaction function compact threshold.
-# compact_threshold is the pages number.
-# When examining the /proc/pagetypeinfo, if there's an increase in the
-# number of movable pages of orders smaller than the compact_order
-# compared to the amount following the previous compaction,
-# and this increase surpasses a certain threshold—specifically,
-# more than 'compact_threshold' number of pages.
-# Or the number of free pages has decreased by 'compact_threshold'
-# since the previous compaction.
-# then the system should initiate another round of memory compaction.
-# Default to 1024
-#compact_threshold = 1024
-
-# Control the mem-agent compaction function force compact times.
-# After one compaction, if there has not been a compaction within
-# the next compact_force_times times, a compaction will be forced
-# regardless of the system's memory situation.
-# If compact_force_times is set to 0, will do force compaction each time.
-# If compact_force_times is set to 18446744073709551615, will never do force compaction.
-# Default to 18446744073709551615
-#compact_force_times = 18446744073709551615
-
-# Create Container Request Timeout
-# This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
-# It's also used to ensure that workloads, especially those involving large image pulls within the guest,
-# have sufficient time to complete.
-#
-# Effective Timeout Determination:
-# The effective timeout for a CreateContainerRequest is determined by taking the minimum of the following two values:
-# - create_container_timeout: The timeout value configured for creating containers (default: @DEFCREATECONTAINERTIMEOUT_COCO@ seconds).
-# - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
-# (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
-# Defaults to @DEFCREATECONTAINERTIMEOUT_COCO@ second(s)
-# create_container_timeout = @DEFCREATECONTAINERTIMEOUT_COCO@
-
-[runtime]
-# If enabled, the runtime will log additional debug messages to the
-# system log
-# (default: disabled)
-#enable_debug = true
-#
-# Internetworking model
-# Determines how the VM should be connected to the
-# the container network interface
-# Options:
-#
-#   - macvtap
-#     Used when the Container network interface can be bridged using
-#     macvtap.
-#
-#   - none
-#     Used when customize network. Only creates a tap device. No veth pair.
-#
-#   - tcfilter
-#     Uses tc filter rules to redirect traffic from the network interface
-#     provided by plugin to a tap interface connected to the VM.
-#
-internetworking_model="@DEFNETWORKMODEL_QEMU@"
-
-name="@RUNTIMENAME@"
-hypervisor_name="@HYPERVISOR_QEMU@"
-agent_name="@PROJECT_TYPE@"
-
-# disable guest seccomp
-# Determines whether container seccomp profiles are passed to the virtual
-# machine and applied by the kata agent. If set to true, seccomp is not applied
-# within the guest
-# (default: true)
-disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
-
-# vCPUs pinning settings
-# if enabled, each vCPU thread will be scheduled to a fixed CPU
-# qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-# enable_vcpus_pinning = false
-
-# Apply a custom SELinux security policy to the container process inside the VM.
-# This is used when you want to apply a type other than the default `container_t`,
-# so general users should not uncomment and apply it.
-# (format: "user:role:type")
-# Note: You cannot specify MCS policy with the label because the sensitivity levels and
-# categories are determined automatically by high-level container runtimes such as containerd.
-#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
-
-# If enabled, the runtime will create opentracing.io traces and spans.
-# (See https://www.jaegertracing.io/docs/getting-started).
-# (default: disabled)
-#enable_tracing = true
-
-# Set the full url to the Jaeger HTTP Thrift collector.
-# The default if not set will be "http://localhost:14268/api/traces"
-#jaeger_endpoint = ""
-
-# Sets the username to be used if basic auth is required for Jaeger.
-#jaeger_user = ""
-
-# Sets the password to be used if basic auth is required for Jaeger.
-#jaeger_password = ""
-
-# If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
-# This option may have some potential impacts to your host. It should only be used when you know what you're doing.
-# `disable_new_netns` conflicts with `internetworking_model=tcfilter` and `internetworking_model=macvtap`. It works only
-# with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
-# (like OVS) directly.
-# (default: false)
-#disable_new_netns = true
-
-# if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
-# The container cgroups in the host are not created, just one single cgroup per sandbox.
-# The runtime caller is free to restrict or collect cgroup stats of the overall Kata sandbox.
-# The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
-# The sandbox cgroup is constrained if there is no container type annotation.
-# See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_QEMU@
-
-# If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
-# this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
-# when a hardware architecture or hypervisor solutions is utilized which does not support CPU and/or memory hotplug.
-# Compatibility for determining appropriate sandbox (VM) size:
-# - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
-#   does not yet support sandbox sizing annotations.
-# - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_COCO@
-
-# If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
-# This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
-# If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
-# These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts=@DEFBINDMOUNTS@
-
-# VFIO Mode
-# Determines how VFIO devices should be be presented to the container.
-# Options:
-#
-#  - vfio
-#    Matches behaviour of OCI runtimes (e.g. runc) as much as
-#    possible.  VFIO devices will appear in the container as VFIO
-#    character devices under /dev/vfio.  The exact names may differ
-#    from the host (they need to match the VM's IOMMU group numbers
-#    rather than the host's)
-#
-#  - guest-kernel
-#    This is a Kata-specific behaviour that's useful in certain cases.
-#    The VFIO device is managed by whatever driver in the VM kernel
-#    claims it.  This means it will appear as one or more device nodes
-#    or network interfaces depending on the nature of the device.
-#    Using this mode requires specially built workloads that know how
-#    to locate the relevant device interfaces within the VM.
-#
-vfio_mode="@DEFVFIOMODE@"
-
-# If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
-# be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
-
-# Enabled experimental feature list, format: ["a", "b"].
-# Experimental features are features not stable enough for production,
-# they may break compatibility, and are prepared for a big version bump.
-# Supported experimental features:
-# (default: [])
-experimental=@DEFAULTEXPFEATURES@
-
-# If enabled, user can run pprof tools with shim v2 process through kata-monitor.
-# (default: false)
-# enable_pprof = true
--- a/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in
@@ -509,7 +509,7 @@ disable_selinux=@DEFDISABLESELINUX@
 disable_guest_selinux=@DEFDISABLEGUESTSELINUX@


-[hypervisor.qemu.factory]
+[factory]
 # VM templating support. Once enabled, new VMs are created from template
 # using vm cloning. They will share the same initial kernel, initramfs and
 # agent memory by mapping it readonly. It helps speeding up new container
--- a/src/runtime-rs/crates/agent/src/kata/agent.rs
+++ b/src/runtime-rs/crates/agent/src/kata/agent.rs
@@ -49,10 +49,6 @@ impl AgentManager for KataAgent {
    async fn agent_config(&self) -> AgentConfig {
        self.agent_config().await
    }
-
-    async fn disconnect(&self) -> Result<()> {
-        self.disconnect().await.context("disconnect agent")
-    }
 }

 // implement for health service
@@ -129,6 +125,5 @@ impl_agent!(
    get_metrics | crate::Empty | crate::MetricsResponse | None,
    get_guest_details | crate::GetGuestDetailsRequest | crate::GuestDetailsResponse | None,
    add_swap | crate::AddSwapRequest | crate::Empty | None,
-    add_swap_path | crate::AddSwapPathRequest | crate::Empty | None,
-    set_policy | crate::SetPolicyRequest | crate::Empty | None
+    add_swap_path | crate::AddSwapPathRequest | crate::Empty | None
 );
--- a/src/runtime-rs/crates/agent/src/kata/mod.rs
+++ b/src/runtime-rs/crates/agent/src/kata/mod.rs
@@ -14,7 +14,6 @@ use std::{

 use anyhow::{Context, Result};
 use kata_types::config::Agent as AgentConfig;
-use nix::unistd;
 use protocols::{agent_ttrpc_async as agent_ttrpc, health_ttrpc_async as health_ttrpc};
 use tokio::sync::RwLock;
 use ttrpc::asynchronous::Client;
@@ -162,21 +161,4 @@ impl KataAgent {
        let inner = self.inner.read().await;
        inner.config.clone()
    }
-
-    /// Disconnect from the agent gRPC server and clean up related resources.
-    pub(crate) async fn disconnect(&self) -> Result<()> {
-        let mut inner = self.inner.write().await;
-        inner.log_forwarder.stop();
-
-        // If there is a valid client, drop it
-        inner.client.take();
-
-        // If fd is valid (> 0), close it
-        if inner.client_fd >= 0 {
-            unistd::close(inner.client_fd).context("failed to close agent client fd")?;
-            inner.client_fd = -1;
-        }
-
-        Ok(())
-    }
 }
--- a/src/runtime-rs/crates/agent/src/kata/trans.rs
+++ b/src/runtime-rs/crates/agent/src/kata/trans.rs
@@ -28,8 +28,7 @@ use crate::{
        VersionCheckResponse, VolumeStatsRequest, VolumeStatsResponse, WaitProcessRequest,
        WriteStreamRequest,
    },
-    GetGuestDetailsRequest, OomEventResponse, SetPolicyRequest, WaitProcessResponse,
-    WriteStreamResponse,
+    GetGuestDetailsRequest, OomEventResponse, WaitProcessResponse, WriteStreamResponse,
 };

 fn trans_vec<F: Sized + Clone, T: From<F>>(from: Vec<F>) -> Vec<T> {
@@ -745,15 +744,6 @@ impl From<GetGuestDetailsRequest> for agent::GuestDetailsRequest {
    }
 }

-impl From<SetPolicyRequest> for agent::SetPolicyRequest {
-    fn from(from: SetPolicyRequest) -> Self {
-        Self {
-            policy: from.policy,
-            ..Default::default()
-        }
-    }
-}
-
 impl From<agent::AgentDetails> for AgentDetails {
    fn from(src: agent::AgentDetails) -> Self {
        Self {
--- a/src/runtime-rs/crates/agent/src/lib.rs
+++ b/src/runtime-rs/crates/agent/src/lib.rs
@@ -33,15 +33,12 @@ use async_trait::async_trait;

 use kata_types::config::Agent as AgentConfig;

-use crate::types::SetPolicyRequest;
-
 pub const AGENT_KATA: &str = "kata";

 #[async_trait]
 pub trait AgentManager: Send + Sync {
    async fn start(&self, address: &str) -> Result<()>;
    async fn stop(&self);
-    async fn disconnect(&self) -> Result<()>;

    async fn agent_sock(&self) -> Result<String>;
    async fn agent_config(&self) -> AgentConfig;
@@ -99,5 +96,4 @@ pub trait Agent: AgentManager + HealthService + Send + Sync {
    async fn get_guest_details(&self, req: GetGuestDetailsRequest) -> Result<GuestDetailsResponse>;
    async fn add_swap(&self, req: AddSwapRequest) -> Result<Empty>;
    async fn add_swap_path(&self, req: AddSwapPathRequest) -> Result<Empty>;
-    async fn set_policy(&self, req: SetPolicyRequest) -> Result<Empty>;
 }
--- a/src/runtime-rs/crates/agent/src/types.rs
+++ b/src/runtime-rs/crates/agent/src/types.rs
@@ -615,11 +615,6 @@ pub struct AddSwapPathRequest {
    pub path: String,
 }

-#[derive(PartialEq, Clone, Default, Debug)]
-pub struct SetPolicyRequest {
-    pub policy: String,
-}
-
 #[cfg(test)]
 mod test {
    use std::convert::TryFrom;
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/ch_api.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/ch_api.rs
@@ -6,12 +6,10 @@ use crate::{
    DeviceConfig, DiskConfig, FsConfig, NetConfig, VmConfig, VmInfo, VmResize, VsockConfig,
 };
 use anyhow::{anyhow, Context, Result};
-use api_client::{
-    simple_api_full_command_and_response, simple_api_full_command_with_fds_and_response,
-};
+use api_client::simple_api_full_command_and_response;

 use serde::{Deserialize, Serialize};
-use std::os::{fd::RawFd, unix::net::UnixStream};
+use std::os::unix::net::UnixStream;
 use tokio::task;

 pub async fn cloud_hypervisor_vmm_ping(mut socket: UnixStream) -> Result<Option<String>> {
@@ -122,28 +120,6 @@ pub async fn cloud_hypervisor_vm_netdev_add(
    .await?
 }

-pub async fn cloud_hypervisor_vm_netdev_add_with_fds(
-    mut socket: UnixStream,
-    net_config: NetConfig,
-    request_fds: Vec<RawFd>,
-) -> Result<Option<String>> {
-    let serialised = serde_json::to_string(&net_config)?;
-
-    task::spawn_blocking(move || -> Result<Option<String>> {
-        let response = simple_api_full_command_with_fds_and_response(
-            &mut socket,
-            "PUT",
-            "vm.add-net",
-            Some(&serialised),
-            request_fds,
-        )
-        .map_err(|e| anyhow!(e))?;
-
-        Ok(response)
-    })
-    .await?
-}
-
 pub async fn cloud_hypervisor_vm_device_add(
    mut socket: UnixStream,
    device_config: DeviceConfig,
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs
@@ -2144,10 +2144,7 @@ mod tests {

    #[test]
    fn test_check_tdx_rootfs_settings() {
-        let sev_snp_details = SevSnpDetails {
-            cbitpos: 42,
-            phys_addr_reduction: 42,
-        };
+        let sev_snp_details = SevSnpDetails { cbitpos: 42 };

        #[derive(Debug)]
        struct TestData<'a> {
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs
@@ -538,10 +538,7 @@ mod tests {

    #[test]
    fn test_guest_protection_is_tdx() {
-        let sev_snp_details = SevSnpDetails {
-            cbitpos: 42,
-            phys_addr_reduction: 42,
-        };
+        let sev_snp_details = SevSnpDetails { cbitpos: 42 };

        #[derive(Debug)]
        struct TestData {
--- a/src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs
@@ -5,11 +5,8 @@
 // SPDX-License-Identifier: Apache-2.0

 use super::inner::CloudHypervisorInner;
-use crate::ch::utils::get_rootless_symlink_sandbox_jailer_root;
 use crate::device::pci_path::PciPath;
 use crate::device::DeviceType;
-use crate::utils::create_dir_all_with_inherit_owner;
-use crate::utils::open_named_tuntap;
 use crate::HybridVsockDevice;
 use crate::NetworkConfig;
 use crate::NetworkDevice;
@@ -22,20 +19,15 @@ use anyhow::{anyhow, Context, Result};
 use ch_config::ch_api::cloud_hypervisor_vm_device_add;
 use ch_config::ch_api::{
    cloud_hypervisor_vm_blockdev_add, cloud_hypervisor_vm_device_remove,
-    cloud_hypervisor_vm_fs_add, cloud_hypervisor_vm_netdev_add_with_fds,
-    cloud_hypervisor_vm_vsock_add, PciDeviceInfo, VmRemoveDeviceData,
+    cloud_hypervisor_vm_fs_add, cloud_hypervisor_vm_netdev_add, cloud_hypervisor_vm_vsock_add,
+    PciDeviceInfo, VmRemoveDeviceData,
 };
 use ch_config::convert::{DEFAULT_DISK_QUEUES, DEFAULT_DISK_QUEUE_SIZE, DEFAULT_NUM_PCI_SEGMENTS};
 use ch_config::DiskConfig;
 use ch_config::{net_util::MacAddr, DeviceConfig, FsConfig, NetConfig, VsockConfig};
-use kata_sys_util::netns::NetnsGuard;
 use kata_types::config::hypervisor::RateLimiterConfig;
-use kata_types::rootless::is_rootless;
 use safe_path::scoped_join;
 use std::convert::TryFrom;
-use std::os::fd::AsRawFd;
-use std::os::fd::IntoRawFd;
-use std::os::unix::fs::symlink;
 use std::path::PathBuf;

 const VIRTIO_FS: &str = "virtio-fs";
@@ -373,20 +365,11 @@ impl CloudHypervisorInner {
            .ok_or("missing socket")
            .map_err(|e| anyhow!(e))?;

-        let mut clh_net_config = NetConfig::try_from(device.config)?;
-        // When using fds to pass the tap device to cloud-hypervisor, tap and id fields should be None
-        clh_net_config.tap = None;
-        clh_net_config.id = None;
+        let clh_net_config = NetConfig::try_from(device.config)?;

-        let files = open_named_tuntap(&netdev.config.host_dev_name, netdev.config.queue_num as u32)
-            .context("open named tuntap")?;
-
-        let fds = files.iter().map(|f| f.as_raw_fd()).collect();
-
-        let response = cloud_hypervisor_vm_netdev_add_with_fds(
+        let response = cloud_hypervisor_vm_netdev_add(
            socket.try_clone().context("failed to clone socket")?,
            clh_net_config,
-            fds,
        )
        .await?;

@@ -413,70 +396,12 @@ impl CloudHypervisorInner {
                DeviceType::ShareFs(dev) => {
                    let settings = ShareFsSettings::new(dev.config, self.vm_path.clone());

-                    let fs_cfg = if is_rootless() {
-                        // TODO: Replace this symlink workaround if a better approach for rootless socket paths appears.
-                        // In rootless mode the virtiofsd.sock lives under the rootless directory,
-                        // and its full path can exceed the 108-byte Unix domain socket limit.
-                        // To ensure the cloud-hypervisor VMM can connect to virtiofsd, create a
-                        // short symlink inside the rootless directory and point the VMM at it.
-                        let mut fs_cfg = FsConfig::try_from(settings)?;
-                        let rootless_symlink_sanbox_jailer_root =
-                            get_rootless_symlink_sandbox_jailer_root(self.id.as_str());
-
-                        create_dir_all_with_inherit_owner(
-                            rootless_symlink_sanbox_jailer_root.as_str(),
-                            0x750,
-                        )
-                        .map_err(|e| {
-                            anyhow!(
-                                "failed to create rootless sharefs symlink jailer root dir: {}",
-                                e
-                            )
-                        })?;
-                        let virtiofsd_name = fs_cfg.socket.file_name().ok_or_else(|| {
-                            anyhow!(
-                                "failed to get virtiofsd socket file name from path: {:?}",
-                                fs_cfg.socket
-                            )
-                        })?;
-                        let virtiofsd_symlink_path =
-                            PathBuf::from(rootless_symlink_sanbox_jailer_root.as_str())
-                                .join(virtiofsd_name);
-
-                        symlink(&fs_cfg.socket, &virtiofsd_symlink_path).map_err(|e| {
-                            anyhow!(
-                                "failed to create symlink for rootless sharefs socket: {}",
-                                e
-                            )
-                        })?;
-
-                        fs_cfg.socket = virtiofsd_symlink_path;
-
-                        fs_cfg
-                    } else {
-                        FsConfig::try_from(settings)?
-                    };
+                    let fs_cfg = FsConfig::try_from(settings)?;

                    shared_fs_devices.push(fs_cfg);
                }
                DeviceType::Network(net_device) => {
-                    let mut net_config = NetConfig::try_from(net_device.config.clone())?;
-                    // When using fds to pass the tap device to cloud-hypervisor, tap and id fields should be None
-                    net_config.tap = None;
-                    net_config.id = None;
-
-                    // we need ensure opening network device happens in netns.
-                    let netns = self.netns.clone().unwrap_or_default();
-                    let _netns_guard = NetnsGuard::new(&netns).context("new netns guard")?;
-                    let fds = open_named_tuntap(
-                        &net_device.config.host_dev_name,
-                        net_device.config.queue_num as u32,
-                    )
-                    .context("open named tuntap")?
-                    .into_iter()
-                    .map(|f| f.into_raw_fd())
-                    .collect();
-                    net_config.fds = Some(fds);
+                    let net_config = NetConfig::try_from(net_device.config)?;
                    network_devices.push(net_config);
                }
                DeviceType::Vfio(vfio_device) => {
--- a/src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs
@@ -5,20 +5,15 @@

 use super::inner::CloudHypervisorInner;
 use crate::ch::utils::get_api_socket_path;
-use crate::ch::utils::get_rootless_symlink_sandbox_path;
 use crate::ch::utils::get_vsock_path;
 use crate::kernel_param::KernelParams;
 use crate::selinux;
-use crate::utils::create_dir_all_with_inherit_owner;
-use crate::utils::set_groups;
-use crate::utils::vm_cleanup;
 use crate::utils::{bytes_to_megs, get_jailer_root, get_sandbox_path, megs_to_bytes};
 use crate::MemoryConfig;
 use crate::VM_ROOTFS_DRIVER_BLK;
 use crate::VM_ROOTFS_DRIVER_PMEM;
 use crate::{VcpuThreadIds, VmmState};
 use anyhow::{anyhow, Context, Result};
-use ch_config::ch_api::cloud_hypervisor_vm_netdev_add_with_fds;
 use ch_config::{
    ch_api::{
        cloud_hypervisor_vm_create, cloud_hypervisor_vm_info, cloud_hypervisor_vm_resize,
@@ -32,20 +27,14 @@ use futures::future::join_all;
 use kata_sys_util::protection::{available_guest_protection, GuestProtection};
 use kata_types::capabilities::{Capabilities, CapabilityBits};
 use kata_types::config::default::DEFAULT_CH_ROOTFS_TYPE;
-use kata_types::config::hypervisor::RootlessUser;
-use kata_types::rootless::is_rootless;
 use lazy_static::lazy_static;
 use nix::sched::{setns, CloneFlags};
-use nix::unistd::setgid;
-use nix::unistd::setuid;
-use nix::unistd::Gid;
-use nix::unistd::Uid;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use std::collections::HashMap;
 use std::convert::TryFrom;
 use std::fs;
-use std::fs::remove_dir_all;
+use std::fs::create_dir_all;
 use std::os::unix::io::AsRawFd;
 use std::os::unix::net::UnixStream;
 use std::path::Path;
@@ -206,8 +195,7 @@ impl CloudHypervisorInner {

        let sandbox_path = get_sandbox_path(&self.id);

-        create_dir_all_with_inherit_owner(sandbox_path.clone(), 0o750)
-            .context("failed to create sandbox path")?;
+        std::fs::create_dir_all(sandbox_path.clone()).context("failed to create sandbox path")?;

        let vsock_socket_path = get_vsock_path(&self.id)?;

@@ -226,8 +214,8 @@ impl CloudHypervisorInner {
            cfg: self.config.clone(),
            guest_protection_to_use: self.guest_protection_to_use.clone(),
            shared_fs_devices,
+            network_devices,
            host_devices,
-            ..Default::default()
        };

        let cfg = VmConfig::try_from(named_cfg)?;
@@ -247,28 +235,6 @@ impl CloudHypervisorInner {
            debug!(sl!(), "vm boot response: {:?}", detail);
        }

-        if let Some(network_devices) = network_devices {
-            for net in network_devices {
-                let vm_fds = net.fds.clone().unwrap_or_default();
-                let response = cloud_hypervisor_vm_netdev_add_with_fds(
-                    socket.try_clone().context("failed to clone socket")?,
-                    net,
-                    vm_fds.clone(),
-                )
-                .await
-                .context("failed to add vm netdev with fds")?;
-
-                if let Some(detail) = response {
-                    debug!(sl!(), "vm netdev add response: {:?}", detail);
-                }
-
-                for fd in vm_fds {
-                    // Explicitly close the fd now that it has been sent to CLH.
-                    nix::unistd::close(fd).context("failed to close netdev fd")?;
-                }
-            }
-        }
-
        let response =
            cloud_hypervisor_vm_start(socket.try_clone().context("failed to clone socket")?)
                .await?;
@@ -403,20 +369,6 @@ impl CloudHypervisorInner {
            );
        }

-        let user: Option<RootlessUser> = if is_rootless() {
-            Some(
-                self.config
-                    .security_info
-                    .rootless_user
-                    .clone()
-                    .ok_or_else(|| {
-                        anyhow!("rootless user must be specified for rootless cloud-hypervisor")
-                    })?,
-            )
-        } else {
-            None
-        };
-
        unsafe {
            let selinux_label = self.config.security_info.selinux_label.clone();
            let _pre = cmd.pre_exec(move || {
@@ -437,16 +389,6 @@ impl CloudHypervisorInner {
                        );
                    }
                }
-                if let Some(user) = &user {
-                    let groups = user.groups.clone();
-                    let gid = Gid::from_raw(user.gid);
-                    let uid = Uid::from_raw(user.uid);
-
-                    let _ = set_groups(&groups);
-                    let _ = setgid(gid).context("setgid failed");
-                    let _ = setuid(uid).context("setuid failed");
-                }
-
                Ok(())
            });
        }
@@ -679,11 +621,11 @@ impl CloudHypervisorInner {
        self.run_dir = get_sandbox_path(&self.id);
        self.vm_path = self.run_dir.to_string();

-        create_dir_all_with_inherit_owner(&self.run_dir, 0o750)
+        create_dir_all(&self.run_dir)
            .with_context(|| anyhow!("failed to create sandbox directory {}", self.run_dir))?;

        if !self.jailer_root.is_empty() {
-            create_dir_all_with_inherit_owner(self.jailer_root.as_str(), 0o750)
+            create_dir_all(self.jailer_root.as_str())
                .map_err(|e| anyhow!("Failed to create dir {} err : {:?}", self.jailer_root, e))?;
        }

@@ -762,9 +704,7 @@ impl CloudHypervisorInner {
    }

    pub(crate) async fn cleanup(&self) -> Result<()> {
-        info!(sl!(), "CloudHypervisor::cleanup()");
-        remove_dir_all(get_rootless_symlink_sandbox_path(self.id.as_str()))?;
-        vm_cleanup(&self.config, self.vm_path.as_str())
+        Ok(())
    }

    pub(crate) async fn resize_vcpu(
@@ -843,7 +783,7 @@ impl CloudHypervisorInner {
    pub(crate) async fn get_jailer_root(&self) -> Result<String> {
        let root_path = get_jailer_root(&self.id);

-        create_dir_all_with_inherit_owner(&root_path, 0o750)?;
+        std::fs::create_dir_all(&root_path)?;

        Ok(root_path)
    }
@@ -1196,10 +1136,7 @@ mod tests {
        // available_guest_protection() requires super user privs.
        skip_if_not_root!();

-        let sev_snp_details = SevSnpDetails {
-            cbitpos: 42,
-            phys_addr_reduction: 42,
-        };
+        let sev_snp_details = SevSnpDetails { cbitpos: 42 };

        #[derive(Debug)]
        struct TestData {
--- a/src/runtime-rs/crates/hypervisor/src/ch/utils.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/utils.rs
@@ -2,12 +2,9 @@
 //
 // SPDX-License-Identifier: Apache-2.0

-use std::path::Path;
+use anyhow::Result;

-use anyhow::{Ok, Result};
-use kata_types::build_path;
-
-use crate::{utils::get_sandbox_path, JAILER_ROOT};
+use crate::utils::get_sandbox_path;

 // The socket used to connect to CH. This is used for CH API communications.
 const CH_API_SOCKET_NAME: &str = "ch-api.sock";
@@ -37,17 +34,3 @@ pub fn get_vsock_path(id: &str) -> Result<String> {

    Ok(path)
 }
-
-/// Returns the symlink path of the sandbox for the virtio-fs socket in rootless mode.
-pub fn get_rootless_symlink_sandbox_path(id: &str) -> String {
-    Path::new(build_path(id).as_str())
-        .to_string_lossy()
-        .to_string()
-}
-
-/// Returns the symlink path of the sandbox's jailer root for the virtio-fs socket in rootless mode.
-pub fn get_rootless_symlink_sandbox_jailer_root(id: &str) -> String {
-    let sandbox_path = get_rootless_symlink_sandbox_path(id);
-
-    [&sandbox_path, JAILER_ROOT].join("/")
-}
--- a/src/runtime-rs/crates/hypervisor/src/device/driver/protection_device.rs
+++ b/src/runtime-rs/crates/hypervisor/src/device/driver/protection_device.rs
@@ -21,7 +21,6 @@ pub enum ProtectionDeviceConfig {
 pub struct SevSnpConfig {
    pub is_snp: bool,
    pub cbitpos: u32,
-    pub phys_addr_reduction: u32,
    pub firmware: String,
    pub host_data: Option<String>,
 }
--- a/src/runtime-rs/crates/hypervisor/src/dragonball/inner.rs
+++ b/src/runtime-rs/crates/hypervisor/src/dragonball/inner.rs
@@ -233,7 +233,7 @@ impl DragonballInner {
        let vm_config = VmConfigInfo {
            serial_path: Some(serial_path),
            mem_size_mib: self.config.memory_info.default_memory as usize,
-            vcpu_count: self.config.cpu_info.default_vcpus.ceil() as u8,
+            vcpu_count: self.config.cpu_info.default_vcpus as u8,
            max_vcpu_count: self.config.cpu_info.default_maxvcpus as u8,
            mem_type,
            mem_file_path,
--- a/src/runtime-rs/crates/hypervisor/src/dragonball/inner_device.rs
+++ b/src/runtime-rs/crates/hypervisor/src/dragonball/inner_device.rs
@@ -23,12 +23,10 @@ use dragonball::api::v1::{
    BlockDeviceConfigInfo, FsDeviceConfigInfo, FsMountConfigInfo, NetworkInterfaceConfig,
    VsockDeviceConfigInfo,
 };
-use dragonball::config_manager::{RateLimiterConfigInfo, TokenBucketConfigInfo};
 use dragonball::device_manager::{
    blk_dev_mgr::BlockDeviceType,
    vfio_dev_mgr::{HostDeviceConfig, VfioPciDeviceConfig},
 };
-use kata_types::config::hypervisor::DEFAULT_RATE_LIMITER_REFILL_TIME;

 const MB_TO_B: u32 = 1024 * 1024;
 const DEFAULT_VIRTIO_FS_NUM_QUEUES: i32 = 1;
@@ -227,27 +225,6 @@ impl DragonballInner {
        let jailed_drive = self.get_resource(path, id).context("get resource")?;
        self.cached_block_devices.insert(id.to_string());

-        let bandwidth = TokenBucketConfigInfo {
-            size: self.config.blockdev_info.disk_rate_limiter_bw_max_rate,
-            one_time_burst: self
-                .config
-                .blockdev_info
-                .disk_rate_limiter_bw_one_time_burst
-                .unwrap_or(0),
-            refill_time: DEFAULT_RATE_LIMITER_REFILL_TIME,
-        };
-
-        let ops = TokenBucketConfigInfo {
-            size: self.config.blockdev_info.disk_rate_limiter_ops_max_rate,
-            one_time_burst: self
-                .config
-                .blockdev_info
-                .disk_rate_limiter_ops_one_time_burst
-                .unwrap_or(0),
-            refill_time: DEFAULT_RATE_LIMITER_REFILL_TIME,
-        };
-        let block_rate_limit = RateLimiterConfigInfo { bandwidth, ops };
-
        let blk_cfg = BlockDeviceConfigInfo {
            drive_id: id.to_string(),
            device_type: BlockDeviceType::get_type(path),
@@ -256,7 +233,6 @@ impl DragonballInner {
            no_drop,
            is_read_only: read_only,
            use_pci_bus,
-            rate_limiter: Some(block_rate_limit),
            ..Default::default()
        };
        self.vmm_instance
--- a/src/runtime-rs/crates/hypervisor/src/dragonball/seccomp.rs
+++ b/src/runtime-rs/crates/hypervisor/src/dragonball/seccomp.rs
@@ -219,6 +219,5 @@ pub fn get_process_seccomp_rules() -> Vec<(i64, Vec<seccompiler::SeccompRule>)>
        (libc::SYS_chmod, vec![]),
        #[cfg(target_arch = "x86_64")]
        (libc::SYS_fchmodat2, vec![]),
-        (libc::SYS_pselect6, vec![]),
    ]
 }
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .22.0
 .21.0