runtime-rs: fix the issue of hot-unplug memory smaller

It should do nothing instead of return an error when
hot-unplug the memory to the size smaller than static
plugged memory size.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>

.github/actionlint.yaml

@@ -31,4 +31,4 @@ self-hosted-runner:
     - s390x
     - s390x-large
     - tdx
-    - ubuntu-24.04-arm
+    - ubuntu-22.04-arm

.github/workflows/basic-ci-amd64.yaml

@@ -71,7 +71,7 @@ jobs:
       fail-fast: false
       matrix:
         containerd_version: ['lts', 'active']
-        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu', 'qemu-runtime-rs']
+        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu']
     runs-on: ubuntu-22.04
     env:
       CONTAINERD_VERSION: ${{ matrix.containerd_version }}
@@ -117,7 +117,7 @@ jobs:
       fail-fast: false
       matrix:
         containerd_version: ['lts', 'active']
-        vmm: ['clh', 'qemu', 'dragonball', 'qemu-runtime-rs']
+        vmm: ['clh', 'qemu', 'dragonball']
     runs-on: ubuntu-22.04
     env:
       CONTAINERD_VERSION: ${{ matrix.containerd_version }}
@@ -279,6 +279,50 @@ jobs:
         timeout-minutes: 15
         run: bash tests/functional/vfio/gha-run.sh run
 
+  run-docker-tests:
+    name: run-docker-tests
+    strategy:
+      # We can set this to true whenever we're 100% sure that
+      # all the tests are not flaky, otherwise we'll fail them
+      # all due to a single flaky instance.
+      fail-fast: false
+      matrix:
+        vmm:
+          - qemu
+    runs-on: ubuntu-22.04
+    env:
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/docker/gha-run.sh install-dependencies
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
+
+      - name: Run docker smoke test
+        timeout-minutes: 5
+        run: bash tests/integration/docker/gha-run.sh run
+
   run-nerdctl-tests:
     name: run-nerdctl-tests
     strategy:
@@ -292,7 +336,6 @@ jobs:
           - dragonball
           - qemu
           - cloud-hypervisor
-          - qemu-runtime-rs
     runs-on: ubuntu-22.04
     env:
       KATA_HYPERVISOR: ${{ matrix.vmm }}

.github/workflows/basic-ci-s390x.yaml

@@ -106,3 +106,44 @@ jobs:
       - name: Run containerd-stability tests
         timeout-minutes: 15
         run: bash tests/stability/gha-run.sh run
+
+  run-docker-tests:
+    name: run-docker-tests
+    strategy:
+      # We can set this to true whenever we're 100% sure that
+      # all the tests are not flaky, otherwise we'll fail them
+      # all due to a single flaky instance.
+      fail-fast: false
+      matrix:
+        vmm: ['qemu']
+    runs-on: s390x-large
+    env:
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/docker/gha-run.sh install-dependencies
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
+
+      - name: Run docker smoke test
+        timeout-minutes: 5
+        run: bash tests/integration/docker/gha-run.sh run

.github/workflows/build-checks.yaml

@@ -12,7 +12,7 @@ name: Build checks
 jobs:
   check:
     name: check
-    runs-on: ${{ matrix.runner || inputs.instance }}
+    runs-on: ${{ matrix.component.name == 'runtime' && inputs.instance == 'ubuntu-24.04-s390x' && 's390x' || matrix.component.name == 'runtime' && inputs.instance == 'ubuntu-24.04-ppc64le' && 'ppc64le' || inputs.instance }}
     strategy:
       fail-fast: false
       matrix:
@@ -68,38 +68,6 @@ jobs:
             needs:
               - rust
               - protobuf-compiler
-        instance:
-          - ${{ inputs.instance }} 
-        include:
-          - component:
-              name: runtime
-              path: src/runtime
-              needs:
-                - golang
-                - XDG_RUNTIME_DIR
-            instance: ubuntu-24.04-s390x
-            runner: s390x
-          - component:
-              name: runtime
-              path: src/runtime
-              needs:
-                - golang
-                - XDG_RUNTIME_DIR
-            instance: ubuntu-24.04-ppc64le
-            runner: ppc64le
-          - component:
-              name: agent
-              path: src/agent
-              needs:
-                - rust
-                - libdevmapper
-                - libseccomp
-                - protobuf-compiler
-                - clang
-            instance: ubuntu-24.04-ppc64le
-            runner: ppc64le
-
-             
 
     steps:
       - name: Adjust a permission for repo

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -121,7 +121,7 @@ jobs:
           echo "oci-name=${oci_image%@*}" >> "$GITHUB_OUTPUT"
           echo "oci-digest=${oci_image#*@}" >> "$GITHUB_OUTPUT"
 
-      - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+      - uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1.2.2
         if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
         with:
           version: "1.2.0"

.github/workflows/build-kata-static-tarball-arm64.yaml

@@ -31,7 +31,7 @@ permissions: {}
 jobs:
   build-asset:
     name: build-asset
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
     permissions:
       contents: read
       packages: write
@@ -102,7 +102,7 @@ jobs:
           echo "oci-name=${oci_image%@*}" >> "$GITHUB_OUTPUT"
           echo "oci-digest=${oci_image#*@}" >> "$GITHUB_OUTPUT"
 
-      - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+      - uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1.2.2
         if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
         with:
           version: "1.2.0"
@@ -141,7 +141,7 @@ jobs:
 
   build-asset-rootfs:
     name: build-asset-rootfs
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
     needs: build-asset
     permissions:
       contents: read
@@ -209,7 +209,7 @@ jobs:
   # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
   remove-rootfs-binary-artifacts:
     name: remove-rootfs-binary-artifacts
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
     needs: build-asset-rootfs
     strategy:
       matrix:
@@ -224,7 +224,7 @@ jobs:
   # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
   remove-rootfs-binary-artifacts-for-release:
     name: remove-rootfs-binary-artifacts-for-release
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
     needs: build-asset-rootfs
     strategy:
       matrix:
@@ -238,7 +238,7 @@ jobs:
 
   build-asset-shim-v2:
     name: build-asset-shim-v2
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
     needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
     permissions:
       contents: read
@@ -298,7 +298,7 @@ jobs:
 
   create-kata-tarball:
     name: create-kata-tarball
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
     needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
     permissions:
       contents: read

.github/workflows/build-kata-static-tarball-riscv64.yaml

@@ -20,6 +20,9 @@ on:
         required: false
         type: string
         default: ""
+    secrets:
+      QUAY_DEPLOYER_PASSWORD:
+        required: true
 
 permissions: {}
 
@@ -38,6 +41,14 @@ jobs:
           - kernel
           - virtiofsd
     steps:
+      - name: Login to Kata Containers quay.io
+        if: ${{ inputs.push-to-registry == 'yes' }}
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: quay.io
+          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
+          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ inputs.commit-hash }}
@@ -71,5 +82,5 @@ jobs:
         with:
           name: kata-artifacts-riscv64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
           path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
-          retention-days: 3
+          retention-days: 15
           if-no-files-found: error

.github/workflows/ci-nightly-riscv.yaml

@@ -1,34 +0,0 @@
-on:
-  schedule:
-    - cron: '0 5 * * *'
-
-name: Nightly CI for RISC-V
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  build-kata-static-tarball-riscv:
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
-    with:
-      tarball-suffix: -${{ github.sha }}
-      commit-hash: ${{ github.sha }}
-      target-branch: ${{ github.ref_name }}
-
-  build-checks-preview:
-    strategy:
-      fail-fast: false
-      matrix:
-        instance:
-          - "riscv-builder"
-    uses: ./.github/workflows/build-checks-preview-riscv64.yaml
-    with:
-      instance: ${{ matrix.instance }}

.github/workflows/ci.yaml

@@ -102,7 +102,7 @@ jobs:
       tag: ${{ inputs.tag }}-arm64
       commit-hash: ${{ inputs.commit-hash }}
       target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-24.04-arm
+      runner: ubuntu-22.04-arm
       arch: arm64
     secrets:
       QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
@@ -134,6 +134,20 @@ jobs:
     secrets:
       QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
 
+  build-kata-static-tarball-riscv64:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
+    with:
+      tarball-suffix: -${{ inputs.tag }}
+      commit-hash: ${{ inputs.commit-hash }}
+      target-branch: ${{ inputs.target-branch }}
+    secrets:
+      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+
   publish-kata-deploy-payload-s390x:
     needs: build-kata-static-tarball-s390x
     permissions:

.github/workflows/payload-after-push.yaml

@@ -97,7 +97,7 @@ jobs:
       repo: kata-containers/kata-deploy-ci
       tag: kata-containers-latest-arm64
       target-branch: ${{ github.ref_name }}
-      runner: ubuntu-24.04-arm
+      runner: ubuntu-22.04-arm
       arch: arm64
     secrets:
       QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

.github/workflows/release-arm64.yaml

@@ -34,7 +34,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
     steps:
       - name: Login to Kata Containers ghcr.io
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0

.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml

@@ -1,4 +1,4 @@
-name: CI | Run NVIDIA GPU kubernetes tests on amd64
+name: CI | Run NVIDIA GPU kubernetes tests on arm64
 on:
   workflow_call:
     inputs:
@@ -45,7 +45,7 @@ jobs:
       GH_PR_NUMBER: ${{ inputs.pr-number }}
       KATA_HYPERVISOR: ${{ matrix.environment.vmm }}
       KUBERNETES: kubeadm
-      K8S_TEST_HOST_TYPE: baremetal
+      K8S_TEST_HOST_TYPE: all
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -59,24 +59,6 @@ jobs:
         env:
           TARGET_BRANCH: ${{ inputs.target-branch }}
 
-      - name: Uninstall previous `kbs-client`
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
-
-      - name: Deploy CoCo KBS
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-        env:
-          NVIDIA_VERIFIER_MODE: remote
-          KBS_INGRESS: nodeport
-
-      - name: Install `kbs-client`
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
       - name: Deploy Kata
         timeout-minutes: 20
         run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
@@ -105,8 +87,3 @@ jobs:
         if: always()
         timeout-minutes: 15
         run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
-      - name: Delete CoCo KBS
-        if: always() && matrix.environment.name != 'nvidia-gpu'
-        run: |
-          bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs

.github/workflows/run-kata-coco-stability-tests.yaml

@@ -46,7 +46,6 @@ jobs:
       matrix:
         vmm:
           - qemu-coco-dev
-          - qemu-coco-dev-runtime-rs
         snapshotter:
           - nydus
         pull-type:

.github/workflows/run-kata-coco-tests.yaml

@@ -131,14 +131,12 @@ jobs:
       matrix:
         vmm:
           - qemu-coco-dev
-          - qemu-coco-dev-runtime-rs
         snapshotter:
           - nydus
         pull-type:
           - guest-pull
         include:
           - pull-type: experimental-force-guest-pull
-            vmm: qemu-coco-dev
             snapshotter: ""
     runs-on: ubuntu-22.04
     permissions:
@@ -159,7 +157,6 @@ jobs:
       AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
       AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
       SNAPSHOTTER: ${{ matrix.snapshotter }}
-      EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.pull-type == 'experimental-force-guest-pull' && matrix.vmm || '' }}
       # Caution: current ingress controller used to expose the KBS service
       # requires much vCPUs, lefting only a few for the tests. Depending on the
       # host type chose it will result on the creation of a cluster with
@@ -218,6 +215,7 @@ jobs:
         timeout-minutes: 20
         run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
         env:
+          EXPERIMENTAL_FORCE_GUEST_PULL: ${{ env.PULL_TYPE == 'experimental-force-guest-pull' && env.KATA_HYPERVISOR || '' }}
           USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ env.SNAPSHOTTER == 'nydus' }}
           AUTO_GENERATE_POLICY: ${{ env.PULL_TYPE == 'experimental-force-guest-pull' && 'no' || 'yes' }}
 
@@ -251,7 +249,6 @@ jobs:
 
       - name: Delete AKS cluster
         if: always()
-        timeout-minutes: 15
         run: bash tests/integration/kubernetes/gha-run.sh delete-cluster
 
   # Generate jobs for testing CoCo on non-TEE environments with erofs-snapshotter

.github/workflows/static-checks-self-hosted.yaml

@@ -28,9 +28,21 @@ jobs:
       fail-fast: false
       matrix:
         instance:
-          - "ubuntu-24.04-arm"
+          - "ubuntu-22.04-arm"
           - "s390x"
           - "ubuntu-24.04-ppc64le"
     uses: ./.github/workflows/build-checks.yaml
     with:
       instance: ${{ matrix.instance }}
+
+  build-checks-preview:
+    needs: skipper
+    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        instance:
+          - "riscv-builder"
+    uses: ./.github/workflows/build-checks-preview-riscv64.yaml
+    with:
+      instance: ${{ matrix.instance }}

Cargo.toml

@@ -1,72 +0,0 @@
-[workspace.package]
-authors = ["The Kata Containers community <kata-dev@lists.katacontainers.io>"]
-edition = "2018"
-license = "Apache-2.0"
-rust-version = "1.85.1"
-
-[workspace]
-members = [
-    # Dragonball
-    "src/dragonball",
-    "src/dragonball/dbs_acpi",
-    "src/dragonball/dbs_address_space",
-    "src/dragonball/dbs_allocator",
-    "src/dragonball/dbs_arch",
-    "src/dragonball/dbs_boot",
-    "src/dragonball/dbs_device",
-    "src/dragonball/dbs_interrupt",
-    "src/dragonball/dbs_legacy_devices",
-    "src/dragonball/dbs_pci",
-    "src/dragonball/dbs_tdx",
-    "src/dragonball/dbs_upcall",
-    "src/dragonball/dbs_utils",
-    "src/dragonball/dbs_virtio_devices",
-]
-resolver = "2"
-
-# TODO: Add all excluded crates to root workspace
-exclude = [
-    "src/agent",
-    "src/tools",
-    "src/libs",
-    "src/runtime-rs",
-
-    # We are cloning and building rust packages under
-    # "tools/packaging/kata-deploy/local-build/build" folder, which may mislead
-    # those packages to think they are part of the kata root workspace
-    "tools/packaging/kata-deploy/local-build/build",
-]
-
-[workspace.dependencies]
-# Rust-VMM crates
-event-manager = "0.2.1"
-kvm-bindings = "0.6.0"
-kvm-ioctls = "=0.12.1"
-linux-loader = "0.8.0"
-seccompiler = "0.5.0"
-vfio-bindings = "0.3.0"
-vfio-ioctls = "0.1.0"
-virtio-bindings = "0.1.0"
-virtio-queue = "0.7.0"
-vm-fdt = "0.2.0"
-vm-memory = "0.10.0"
-vm-superio = "0.5.0"
-vmm-sys-util = "0.11.0"
-
-# Local dependencies from Dragonball Sandbox crates
-dbs-acpi = { path = "src/dragonball/dbs_acpi" }
-dbs-address-space = { path = "src/dragonball/dbs_address_space" }
-dbs-allocator = { path = "src/dragonball/dbs_allocator" }
-dbs-arch = { path = "src/dragonball/dbs_arch" }
-dbs-boot = { path = "src/dragonball/dbs_boot" }
-dbs-device = { path = "src/dragonball/dbs_device" }
-dbs-interrupt = { path = "src/dragonball/dbs_interrupt" }
-dbs-legacy-devices = { path = "src/dragonball/dbs_legacy_devices" }
-dbs-pci = { path = "src/dragonball/dbs_pci" }
-dbs-tdx = { path = "src/dragonball/dbs_tdx" }
-dbs-upcall = { path = "src/dragonball/dbs_upcall" }
-dbs-utils = { path = "src/dragonball/dbs_utils" }
-dbs-virtio-devices = { path = "src/dragonball/dbs_virtio_devices" }
-
-# Local dependencies from `src/lib`
-test-utils = { path = "src/libs/test-utils" }

VERSION

@@ -1 +1 @@
-3.23.0
+3.22.0

src/agent/Cargo.lock

@@ -459,9 +459,15 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec",
+ "bit-vec 0.8.0",
 ]
 
+[[package]]
+name = "bit-vec"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
+
 [[package]]
 name = "bit-vec"
 version = "0.8.0"
@@ -1244,6 +1250,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece"
 dependencies = [
  "crc32fast",
+ "libz-sys",
  "miniz_oxide",
 ]
 
@@ -2259,6 +2266,17 @@ dependencies = [
  "uuid 0.8.2",
 ]
 
+[[package]]
+name = "libz-sys"
+version = "1.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b70e7a7df205e92a1a4cd9aaae7898dac0aa555503cc0a649494d0d60e7651d"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.3.8"
@@ -3701,7 +3719,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "awaitgroup",
- "bit-vec",
+ "bit-vec 0.6.3",
  "capctl",
  "caps",
  "cfg-if",
@@ -4803,6 +4821,12 @@ version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "943ce29a8a743eb10d6082545d861b24f9d1b160b7d741e0f2cdf726bec909c5"
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"

src/agent/Cargo.toml

@@ -206,7 +206,6 @@ lto = true
 seccomp = ["rustjail/seccomp"]
 standard-oci-runtime = ["rustjail/standard-oci-runtime"]
 agent-policy = ["kata-agent-policy"]
-init-data = []
 
 [[bin]]
 name = "kata-agent"

src/agent/Makefile

@@ -41,14 +41,6 @@ ifeq ($(AGENT_POLICY),yes)
     override EXTRA_RUSTFEATURES += agent-policy
 endif
 
-##VAR INIT_DATA=yes|no define if agent enables the init data feature
-INIT_DATA ?= yes
-
-# Enable the init data fature of rust build
-ifeq ($(INIT_DATA),yes)
-    override EXTRA_RUSTFEATURES += init-data
-endif
-
 include ../../utils.mk
 
 ##VAR STANDARD_OCI_RUNTIME=yes|no define if agent enables standard oci runtime feature
@@ -130,7 +122,7 @@ $(TARGET): $(GENERATED_CODE) $(TARGET_PATH)
 $(TARGET_PATH): show-summary
 	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
 
-$(GENERATED_FILES): %: %.in $(VERSION_FILE)
+$(GENERATED_FILES): %: %.in
 	@sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@"
 
 ##TARGET optimize: optimized  build

src/agent/policy/src/policy.rs

@@ -10,7 +10,7 @@ use anyhow::{bail, Result};
 use slog::{debug, error, info, warn};
 use tokio::io::AsyncWriteExt;
 
-static POLICY_LOG_FILE: &str = "/tmp/policy.jsonl";
+static POLICY_LOG_FILE: &str = "/tmp/policy.txt";
 static POLICY_DEFAULT_FILE: &str = "/etc/kata-opa/default-policy.rego";
 
 /// Convenience macro to obtain the scope logger
@@ -26,7 +26,7 @@ pub struct AgentPolicy {
     /// When true policy errors are ignored, for debug purposes.
     allow_failures: bool,
 
-    /// "/tmp/policy.jsonl" log file for policy activity.
+    /// "/tmp/policy.txt" log file for policy activity.
     log_file: Option<tokio::fs::File>,
 
     /// Regorus engine
@@ -213,7 +213,7 @@ impl AgentPolicy {
                     //   The Policy text can be obtained directly from the pod YAML.
                 }
                 _ => {
-                    let log_entry = format!("{{\"kind\":\"{ep}\",\"request\":{input}}}\n");
+                    let log_entry = format!("[\"ep\":\"{ep}\",{input}],\n\n");
 
                     if let Err(e) = log_file.write_all(log_entry.as_bytes()).await {
                         warn!(sl!(), "policy: log_eval_input: write_all failed: {}", e);

src/agent/rustjail/Cargo.toml

@@ -44,7 +44,7 @@ async-trait.workspace = true
 inotify = "0.9.2"
 libseccomp = { version = "0.3.0", optional = true }
 zbus = "3.12.0"
-bit-vec = "0.8.0"
+bit-vec = "0.6.3"
 xattr = "0.2.3"
 
 # Local dependencies

src/agent/src/initdata.rs

@@ -9,7 +9,6 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 
-#[cfg(feature = "init-data")]
 use std::{os::unix::fs::FileTypeExt, path::Path};
 
 use anyhow::{bail, Context, Result};
@@ -38,24 +37,8 @@ pub const AA_CONFIG_PATH: &str = concatcp!(INITDATA_PATH, "/aa.toml");
 pub const CDH_CONFIG_PATH: &str = concatcp!(INITDATA_PATH, "/cdh.toml");
 
 /// Magic number of initdata device
-#[cfg(feature = "init-data")]
 pub const INITDATA_MAGIC_NUMBER: &[u8] = b"initdata";
 
-/// initdata device with disk type 'vd*'
-#[cfg(feature = "init-data")]
-const INITDATA_PREFIX_DISK_VDX: &str = "vd";
-
-/// initdata device with disk type 'sd*'
-#[cfg(feature = "init-data")]
-const INITDATA_PREFIX_DISK_SDX: &str = "sd";
-
-#[cfg(not(feature = "init-data"))]
-async fn detect_initdata_device(logger: &Logger) -> Result<Option<String>> {
-    debug!(logger, "Initdata is disabled");
-    Ok(None)
-}
-
-#[cfg(feature = "init-data")]
 async fn detect_initdata_device(logger: &Logger) -> Result<Option<String>> {
     let dev_dir = Path::new("/dev");
     let mut read_dir = tokio::fs::read_dir(dev_dir).await?;
@@ -63,15 +46,9 @@ async fn detect_initdata_device(logger: &Logger) -> Result<Option<String>> {
         let filename = entry.file_name();
         let filename = filename.to_string_lossy();
         debug!(logger, "Initdata check device `{filename}`");
-
-        // Currently there're two disk types supported:
-        // virtio-blk (vd*) and virtio-scsi (sd*)
-        if !filename.starts_with(INITDATA_PREFIX_DISK_VDX)
-            && !filename.starts_with(INITDATA_PREFIX_DISK_SDX)
-        {
+        if !filename.starts_with("vd") {
             continue;
         }
-
         let path = entry.path();
 
         debug!(logger, "Initdata find potential device: `{path:?}`");

src/dragonball/Cargo.lock

@@ -4,18 +4,18 @@ version = 4
 
 [[package]]
 name = "addr2line"
-version = "0.25.1"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
 dependencies = [
  "gimli",
 ]
 
 [[package]]
-name = "adler2"
-version = "2.0.1"
+name = "adler"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "android-tzdata"
@@ -64,17 +64,17 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "backtrace"
-version = "0.3.76"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
+checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
 dependencies = [
  "addr2line",
+ "cc",
  "cfg-if",
  "libc",
  "miniz_oxide",
  "object",
  "rustc-demangle",
- "windows-link",
 ]
 
 [[package]]
@@ -638,9 +638,9 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.1.5"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
+checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
 dependencies = [
  "crc32fast",
  "libz-sys",
@@ -780,9 +780,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.32.3"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
+checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
 
 [[package]]
 name = "h2"
@@ -1250,12 +1250,11 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.9"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
 dependencies = [
- "adler2",
- "simd-adler32",
+ "adler",
 ]
 
 [[package]]
@@ -1453,9 +1452,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.37.3"
+version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
 dependencies = [
  "memchr",
 ]
@@ -1757,9 +1756,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.26"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustix"
@@ -1927,12 +1926,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
-[[package]]
-name = "simd-adler32"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
-
 [[package]]
 name = "slab"
 version = "0.4.11"
@@ -2560,12 +2553,6 @@ dependencies = [
  "windows-targets 0.48.5",
 ]
 
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
 [[package]]
 name = "windows-sys"
 version = "0.48.0"

src/dragonball/Cargo.toml

@@ -9,6 +9,58 @@ repository = "https://github.com/kata-containers/kata-containers.git"
 license = "Apache-2.0"
 edition = "2018"
 
+[workspace]
+members = [
+  "dbs_acpi",
+  "dbs_address_space",
+  "dbs_allocator",
+  "dbs_arch",
+  "dbs_boot",
+  "dbs_device",
+  "dbs_interrupt",
+  "dbs_legacy_devices",
+  "dbs_pci",
+  "dbs_tdx",
+  "dbs_upcall",
+  "dbs_utils",
+  "dbs_virtio_devices",
+]
+resolver = "2"
+
+[workspace.dependencies]
+# Rust-VMM crates
+event-manager = "0.2.1"
+kvm-bindings = "0.6.0"
+kvm-ioctls = "=0.12.1"
+linux-loader = "0.8.0"
+seccompiler = "0.5.0"
+vfio-bindings = "0.3.0"
+vfio-ioctls = "0.1.0"
+virtio-bindings = "0.1.0"
+virtio-queue = "0.7.0"
+vm-fdt = "0.2.0"
+vm-memory = "0.10.0"
+vm-superio = "0.5.0"
+vmm-sys-util = "0.11.0"
+
+# Local dependencies from Dragonball Sandbox crates
+dbs-acpi = { path = "dbs_acpi" }
+dbs-address-space = { path = "dbs_address_space" }
+dbs-allocator = { path = "dbs_allocator" }
+dbs-arch = { path = "dbs_arch" }
+dbs-boot = { path = "dbs_boot" }
+dbs-device = { path = "dbs_device" }
+dbs-interrupt = { path = "dbs_interrupt" }
+dbs-legacy-devices = { path = "dbs_legacy_devices" }
+dbs-pci = { path = "dbs_pci" }
+dbs-tdx = { path = "dbs_tdx" }
+dbs-upcall = { path = "dbs_upcall" }
+dbs-utils = { path = "dbs_utils" }
+dbs-virtio-devices = { path = "dbs_virtio_devices" }
+
+# Local dependencies from `src/lib`
+test-utils = { path = "../libs/test-utils" }
+
 [dependencies]
 anyhow = "1.0.32"
 arc-swap = "1.5.0"
@@ -31,12 +83,12 @@ kvm-bindings = { workspace = true }
 kvm-ioctls = { workspace = true }
 lazy_static = "1.2"
 libc = "0.2.39"
-linux-loader = { workspace = true }
+linux-loader = {workspace = true}
 log = "0.4.14"
 nix = "0.24.2"
 procfs = "0.12.0"
 prometheus = { version = "0.14.0", features = ["process"] }
-seccompiler = { workspace = true }
+seccompiler = {workspace = true}
 serde = "1.0.27"
 serde_derive = "1.0.27"
 serde_json = "1.0.9"
@@ -44,7 +96,7 @@ slog = "2.5.2"
 slog-scope = "4.4.0"
 thiserror = "1"
 tracing = "0.1.41"
-vmm-sys-util = { workspace = true }
+vmm-sys-util = {workspace = true}
 virtio-queue = { workspace = true, optional = true }
 vm-memory = { workspace = true, features = ["backend-mmap"] }
 crossbeam-channel = "0.5.6"
@@ -66,14 +118,14 @@ virtio-blk = ["dbs-virtio-devices/virtio-blk", "virtio-queue"]
 virtio-net = ["dbs-virtio-devices/virtio-net", "virtio-queue"]
 # virtio-fs only work on atomic-guest-memory
 virtio-fs = [
-  "dbs-virtio-devices/virtio-fs-pro",
-  "virtio-queue",
-  "atomic-guest-memory",
+    "dbs-virtio-devices/virtio-fs-pro",
+    "virtio-queue",
+    "atomic-guest-memory",
 ]
 virtio-mem = [
-  "dbs-virtio-devices/virtio-mem",
-  "virtio-queue",
-  "atomic-guest-memory",
+    "dbs-virtio-devices/virtio-mem",
+    "virtio-queue",
+    "atomic-guest-memory",
 ]
 virtio-balloon = ["dbs-virtio-devices/virtio-balloon", "virtio-queue"]
 vhost-net = ["dbs-virtio-devices/vhost-net"]
@@ -84,5 +136,5 @@ host-device = ["dep:vfio-bindings", "dep:vfio-ioctls", "dep:dbs-pci"]
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = [
-  'cfg(feature, values("test-mock"))',
+    'cfg(feature, values("test-mock"))',
 ] }

src/libs/kata-sys-util/src/k8s.rs

@@ -42,15 +42,15 @@ pub fn is_ephemeral_volume(mount: &Mount) -> bool {
 /// K8s `EmptyDir` volumes are directories on the host. If the fs type is tmpfs, it's a ephemeral
 /// volume instead of a `EmptyDir` volume.
 pub fn is_host_empty_dir(path: &str) -> bool {
-    if !is_empty_dir(path) {
-        return false;
+    if is_empty_dir(path) {
+        if let Ok(info) = get_linux_mount_info(path) {
+            if info.fs_type != "tmpfs" {
+                return true;
+            }
+        }
     }
 
-    match get_linux_mount_info(path) {
-        Ok(info) => info.fs_type != "tmpfs",
-        Err(crate::mount::Error::NoMountEntry(_)) => true,
-        Err(_) => false,
-    }
+    false
 }
 
 // update_ephemeral_storage_type sets the mount type to 'ephemeral'
@@ -58,7 +58,7 @@ pub fn is_host_empty_dir(path: &str) -> bool {
 // For the given pod ephemeral volume is created only once
 // backed by tmpfs inside the VM. For successive containers
 // of the same pod the already existing volume is reused.
-pub fn update_ephemeral_storage_type(oci_spec: &mut Spec, disable_guest_empty_dir: bool) {
+pub fn update_ephemeral_storage_type(oci_spec: &mut Spec) {
     if let Some(mounts) = oci_spec.mounts_mut() {
         for m in mounts.iter_mut() {
             if let Some(typ) = &m.typ() {
@@ -69,12 +69,13 @@ pub fn update_ephemeral_storage_type(oci_spec: &mut Spec, disable_guest_empty_di
 
             if let Some(source) = &m.source() {
                 let mnt_src = &source.display().to_string();
-                // We only care about the "bind" mount volume here.
+                //here we only care about the "bind" mount volume.
                 if is_ephemeral_volume(m) {
                     m.set_typ(Some(String::from(mount::KATA_EPHEMERAL_VOLUME_TYPE)));
-                }
-                if is_host_empty_dir(mnt_src) && !disable_guest_empty_dir {
-                    m.set_typ(Some(mount::KATA_K8S_LOCAL_STORAGE_TYPE.to_string()));
+                } else if is_host_empty_dir(mnt_src) {
+                    // FIXME support disable_guest_empty_dir
+                    // https://github.com/kata-containers/kata-containers/blob/02a51e75a7e0c6fce5e8abe3b991eeac87e09645/src/runtime/pkg/katautils/create.go#L105
+                    m.set_typ(Some(String::from(mount::KATA_HOST_DIR_VOLUME_TYPE)));
                 }
             }
         }

src/libs/kata-sys-util/src/protection.rs

@@ -6,8 +6,6 @@
 #[cfg(any(target_arch = "s390x", target_arch = "x86_64", target_arch = "aarch64"))]
 use anyhow::Result;
 use serde::{Deserialize, Serialize};
-#[cfg(target_arch = "x86_64")]
-use std::arch::x86_64;
 use std::fmt;
 #[cfg(all(target_arch = "powerpc64", target_endian = "little"))]
 use std::fs;
@@ -28,7 +26,6 @@ use std::fs;
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct SevSnpDetails {
     pub cbitpos: u32,
-    pub phys_addr_reduction: u32,
 }
 
 #[allow(dead_code)]
@@ -120,44 +117,17 @@ pub fn arch_guest_protection(
         Ok(false)
     };
 
-    let retrieve_sev_params = || -> Result<(u32, u32), ProtectionError> {
-        // The initial checks for AMD and SEV shouldn't be necessary due to
-        // the context this function is currently called from, however it
-        // shouldn't hurt to double-check and have better logging if anything
-        // goes wrong.
-
-        let fn0 = unsafe { x86_64::__cpuid(0) };
-        // The values in [ ebx, edx, ecx ] spell out "AuthenticAMD" when
-        // interpreted byte-wise as ASCII.  No need to bother here with an
-        // actual conversion to string though.
-        // See also AMD64 Architecture Programmer's Manual pg. 600
-        // https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24594.pdf
-        if fn0.ebx != 0x68747541 || fn0.edx != 0x69746e65 || fn0.ecx != 0x444d4163 {
-            return Err(ProtectionError::CheckFailed(
-                "Not an AMD processor".to_owned(),
-            ));
-        }
-
-        // AMD64 Architecture Prgrammer's Manual Fn8000_001f docs on pg. 640
-        let fn8000_001f = unsafe { x86_64::__cpuid(0x8000_001f) };
-        if fn8000_001f.eax & 0x10 == 0 {
-            return Err(ProtectionError::CheckFailed("SEV not supported".to_owned()));
-        }
-
-        let cbitpos = fn8000_001f.ebx & 0b11_1111;
-        let phys_addr_reduction = (fn8000_001f.ebx & 0b1111_1100_0000) >> 6;
-
-        Ok((cbitpos, phys_addr_reduction))
+    let retrieve_sev_cbitpos = || -> Result<u32, ProtectionError> {
+        Err(ProtectionError::CheckFailed(
+            "cbitpos retrieval NOT IMPLEMENTED YET".to_owned(),
+        ))
     };
 
     let is_snp_available = check_contents(snp_path)?;
     let is_sev_available = is_snp_available || check_contents(sev_path)?;
     if is_snp_available || is_sev_available {
-        let (cbitpos, phys_addr_reduction) = retrieve_sev_params()?;
-        let sev_snp_details = SevSnpDetails {
-            cbitpos,
-            phys_addr_reduction,
-        };
+        let cbitpos = retrieve_sev_cbitpos()?;
+        let sev_snp_details = SevSnpDetails { cbitpos };
         return Ok(if is_snp_available {
             GuestProtection::Snp(sev_snp_details)
         } else {

src/libs/kata-types/Cargo.toml

@@ -28,7 +28,7 @@ toml = "0.5.8"
 serde-enum-str = "0.4"
 sysinfo = "0.34.2"
 sha2 = "0.10.8"
-flate2 = "1.1"
+flate2 = { version = "1.0", features = ["zlib"] }
 hex = "0.4"
 
 oci-spec = { version = "0.8.1", features = ["runtime"] }

src/libs/kata-types/src/annotations/mod.rs

@@ -296,10 +296,6 @@ pub const KATA_ANNO_CFG_RUNTIME_AGENT: &str = "io.katacontainers.config.runtime.
 /// A sandbox annotation that determines if seccomp should be applied inside guest.
 pub const KATA_ANNO_CFG_DISABLE_GUEST_SECCOMP: &str =
     "io.katacontainers.config.runtime.disable_guest_seccomp";
-/// A sandbox annotation that determines if it should create Kubernetes emptyDir mounts on the guest filesystem.
-pub const KATA_ANNO_CFG_DISABLE_GUEST_EMPTY_DIR: &str =
-    "io.katacontainers.config.runtime.disable_guest_empty_dir";
-
 /// A sandbox annotation that determines if pprof enabled.
 pub const KATA_ANNO_CFG_ENABLE_PPROF: &str = "io.katacontainers.config.runtime.enable_pprof";
 /// A sandbox annotation that determines if experimental features enabled.
@@ -620,7 +616,7 @@ impl Annotation {
                         hv.boot_info.kernel = value.to_string();
                     }
                     KATA_ANNO_CFG_HYPERVISOR_KERNEL_PARAMS => {
-                        hv.boot_info.replace_kernel_params(value);
+                        hv.boot_info.kernel_params = value.to_string();
                     }
                     KATA_ANNO_CFG_HYPERVISOR_IMAGE_PATH => {
                         hv.boot_info.validate_boot_path(value)?;
@@ -1027,14 +1023,6 @@ impl Annotation {
                             return Err(bool_err);
                         }
                     },
-                    KATA_ANNO_CFG_DISABLE_GUEST_EMPTY_DIR => match self.get_value::<bool>(key) {
-                        Ok(r) => {
-                            config.runtime.disable_guest_empty_dir = r.unwrap_or_default();
-                        }
-                        Err(_e) => {
-                            return Err(bool_err);
-                        }
-                    },
                     KATA_ANNO_CFG_ENABLE_PPROF => match self.get_value::<bool>(key) {
                         Ok(r) => {
                             config.runtime.enable_pprof = r.unwrap_or_default();

src/libs/kata-types/src/config/agent.rs

@@ -148,10 +148,6 @@ pub struct Agent {
     /// Memory agent configuration
     #[serde(default)]
     pub mem_agent: MemAgent,
-
-    /// Agent policy
-    #[serde(default)]
-    pub policy: String,
 }
 
 fn deserialize_secs_to_millis<'de, D>(deserializer: D) -> std::result::Result<u32, D::Error>
@@ -180,7 +176,6 @@ impl std::default::Default for Agent {
             kernel_modules: Default::default(),
             container_pipe_size: 0,
             mem_agent: MemAgent::default(),
-            policy: Default::default(),
         }
     }
 }

src/libs/kata-types/src/config/default.rs

@@ -41,13 +41,11 @@ pub const DEFAULT_BLOCK_NVDIMM_MEM_OFFSET: u64 = 0;
 pub const DEFAULT_BLOCK_DEVICE_AIO_THREADS: &str = "threads";
 pub const DEFAULT_BLOCK_DEVICE_AIO_NATIVE: &str = "native";
 pub const DEFAULT_BLOCK_DEVICE_AIO: &str = "io_uring";
-pub const DEFAULT_BLOCK_DEVICE_NUM_QUEUES: u32 = 1;
-pub const DEFAULT_BLOCK_DEVICE_QUEUE_SIZE: u32 = 128;
 
 pub const DEFAULT_SHARED_FS_TYPE: &str = "virtio-fs";
 pub const DEFAULT_VIRTIO_FS_CACHE_MODE: &str = "never";
 pub const DEFAULT_VIRTIO_FS_DAX_SIZE_MB: u32 = 1024;
-pub const DEFAULT_SHARED_9PFS_SIZE_MB: u32 = 8 * 1024;
+pub const DEFAULT_SHARED_9PFS_SIZE_MB: u32 = 128 * 1024;
 pub const MIN_SHARED_9PFS_SIZE_MB: u32 = 4 * 1024;
 pub const MAX_SHARED_9PFS_SIZE_MB: u32 = 8 * 1024 * 1024;
 
@@ -112,6 +110,3 @@ pub const MAX_REMOTE_VCPUS: u32 = 32;
 pub const MIN_REMOTE_MEMORY_SIZE_MB: u32 = 64;
 pub const DEFAULT_REMOTE_MEMORY_SIZE_MB: u32 = 128;
 pub const DEFAULT_REMOTE_MEMORY_SLOTS: u32 = 128;
-
-// Default configuration for factory/templating
-pub const DEFAULT_TEMPLATE_PATH: &str = "/run/vc/vm/template";

src/libs/kata-types/src/config/hypervisor/ch.rs

@@ -85,11 +85,6 @@ impl ConfigPlugin for CloudHypervisorConfig {
             if ch.memory_info.memory_slots == 0 {
                 ch.memory_info.memory_slots = default::DEFAULT_CH_MEMORY_SLOTS;
             }
-
-            // Apply factory defaults
-            if ch.factory.template_path.is_empty() {
-                ch.factory.template_path = default::DEFAULT_TEMPLATE_PATH.to_string();
-            }
         }
 
         Ok(())

src/libs/kata-types/src/config/hypervisor/dragonball.rs

@@ -79,11 +79,6 @@ impl ConfigPlugin for DragonballConfig {
             if db.memory_info.memory_slots == 0 {
                 db.memory_info.memory_slots = default::DEFAULT_DRAGONBALL_MEMORY_SLOTS;
             }
-
-            // Apply factory defaults
-            if db.factory.template_path.is_empty() {
-                db.factory.template_path = default::DEFAULT_TEMPLATE_PATH.to_string();
-            }
         }
         Ok(())
     }

src/libs/kata-types/src/config/hypervisor/firecracker.rs

@@ -69,11 +69,6 @@ impl ConfigPlugin for FirecrackerConfig {
                 firecracker.memory_info.default_memory =
                     default::DEFAULT_FIRECRACKER_MEMORY_SIZE_MB;
             }
-
-            // Apply factory defaults
-            if firecracker.factory.template_path.is_empty() {
-                firecracker.factory.template_path = default::DEFAULT_TEMPLATE_PATH.to_string();
-            }
         }
 
         Ok(())

src/libs/kata-types/src/config/hypervisor/mod.rs

@@ -189,13 +189,6 @@ pub struct BlockDeviceInfo {
     /// increases the initial max rate
     #[serde(default)]
     pub disk_rate_limiter_ops_one_time_burst: Option<u64>,
-
-    /// virtio queue size. Size: byte
-    #[serde(default)]
-    pub queue_size: u32,
-    /// block device multi-queue
-    #[serde(default)]
-    pub num_queues: usize,
 }
 
 impl BlockDeviceInfo {
@@ -226,15 +219,6 @@ impl BlockDeviceInfo {
                 ));
             }
         }
-
-        if self.num_queues == 0 {
-            self.num_queues = default::DEFAULT_BLOCK_DEVICE_NUM_QUEUES as usize;
-        }
-
-        if self.queue_size == 0 {
-            self.queue_size = default::DEFAULT_BLOCK_DEVICE_QUEUE_SIZE;
-        }
-
         if self.memory_offset == 0 {
             self.memory_offset = default::DEFAULT_BLOCK_NVDIMM_MEM_OFFSET;
         }
@@ -374,71 +358,6 @@ impl BootInfo {
         self.kernel_params = p.join(KERNEL_PARAM_DELIMITER);
     }
 
-    /// Replace kernel parameters with the same key.
-    ///
-    /// For each parameter in the new_params string, if a parameter with the same key
-    /// already exists in kernel_params, it will be removed before adding the new one.
-    /// This allows selective parameter override from annotations without replacing
-    /// the entire kernel command line.
-    pub fn replace_kernel_params(&mut self, new_params: &str) {
-        if new_params.is_empty() {
-            return;
-        }
-
-        // Parse existing kernel parameters into a map
-        let mut existing_params: Vec<(String, String)> = Vec::new();
-        for param in self.kernel_params.split(KERNEL_PARAM_DELIMITER) {
-            let param = param.trim();
-            if param.is_empty() {
-                continue;
-            }
-            // Split by '=' to get key and value
-            if let Some(eq_pos) = param.find('=') {
-                let key = param[..eq_pos].to_string();
-                let value = param[eq_pos + 1..].to_string();
-                existing_params.push((key, value));
-            } else {
-                // Parameter without value (like "quiet")
-                existing_params.push((param.to_string(), String::new()));
-            }
-        }
-
-        // Parse new parameters and collect keys to replace
-        let mut new_param_keys: Vec<String> = Vec::new();
-        let mut new_param_list: Vec<String> = Vec::new();
-        for param in new_params.split(KERNEL_PARAM_DELIMITER) {
-            let param = param.trim();
-            if param.is_empty() {
-                continue;
-            }
-            if let Some(eq_pos) = param.find('=') {
-                let key = param[..eq_pos].to_string();
-                new_param_keys.push(key);
-            } else {
-                new_param_keys.push(param.to_string());
-            }
-            new_param_list.push(param.to_string());
-        }
-
-        // Remove existing parameters that will be replaced
-        existing_params.retain(|(key, _)| !new_param_keys.contains(key));
-
-        // Reconstruct kernel_params: existing params + new params
-        let mut all_params: Vec<String> = existing_params
-            .iter()
-            .map(|(key, value)| {
-                if value.is_empty() {
-                    key.clone()
-                } else {
-                    format!("{}={}", key, value)
-                }
-            })
-            .collect();
-        all_params.extend(new_param_list);
-
-        self.kernel_params = all_params.join(KERNEL_PARAM_DELIMITER);
-    }
-
     /// Validate guest kernel image annotation.
     pub fn validate_boot_path(&self, path: &str) -> Result<()> {
         validate_path!(path, "path {} is invalid{}")?;

src/libs/kata-types/src/config/hypervisor/qemu.rs

@@ -91,11 +91,6 @@ impl ConfigPlugin for QemuConfig {
             if qemu.memory_info.memory_slots == 0 {
                 qemu.memory_info.memory_slots = default::DEFAULT_QEMU_MEMORY_SLOTS;
             }
-
-            // Apply factory defaults
-            if qemu.factory.template_path.is_empty() {
-                qemu.factory.template_path = default::DEFAULT_TEMPLATE_PATH.to_string();
-            }
         }
 
         Ok(())

src/libs/kata-types/src/config/hypervisor/remote.rs

@@ -65,11 +65,6 @@ impl ConfigPlugin for RemoteConfig {
             if remote.memory_info.memory_slots == 0 {
                 remote.memory_info.memory_slots = default::DEFAULT_REMOTE_MEMORY_SLOTS
             }
-
-            // Apply factory defaults
-            if remote.factory.template_path.is_empty() {
-                remote.factory.template_path = default::DEFAULT_TEMPLATE_PATH.to_string();
-            }
         }
 
         Ok(())

src/libs/kata-types/src/config/runtime.rs

@@ -128,12 +128,6 @@ pub struct Runtime {
     #[serde(default)]
     pub disable_guest_seccomp: bool,
 
-    /// If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem.
-    /// Instead, emptyDir mounts will be created on the host and shared via virtio-fs.
-    /// This is potentially slower, but allows sharing of files from host to guest.
-    #[serde(default)]
-    pub disable_guest_empty_dir: bool,
-
     /// Determines how VFIO devices should be be presented to the container.
     ///
     /// Options:

src/libs/kata-types/src/mount.rs

@@ -23,9 +23,8 @@ pub const KATA_SHAREDFS_GUEST_PREMOUNT_TAG: &str = "kataShared";
 /// KATA_EPHEMERAL_VOLUME_TYPE creates a tmpfs backed volume for sharing files between containers.
 pub const KATA_EPHEMERAL_VOLUME_TYPE: &str = "ephemeral";
 
-/// KATA_K8S_LOCAL_STORAGE_TYPE is used for k8s empty dir (a disk-backed volume),
-/// to create a local directory inside the VM for sharing files between containers.
-pub const KATA_K8S_LOCAL_STORAGE_TYPE: &str = "local";
+/// KATA_HOST_DIR_TYPE use for host empty dir
+pub const KATA_HOST_DIR_VOLUME_TYPE: &str = "kata:hostdir";
 
 /// KATA_MOUNT_INFO_FILE_NAME is used for the file that holds direct-volume mount info
 pub const KATA_MOUNT_INFO_FILE_NAME: &str = "mountInfo.json";
@@ -522,6 +521,11 @@ pub fn is_kata_ephemeral_volume(ty: &str) -> bool {
     ty == KATA_EPHEMERAL_VOLUME_TYPE
 }
 
+/// Checks whether a mount type is a marker for a Kata hostdir volume.
+pub fn is_kata_host_dir_volume(ty: &str) -> bool {
+    ty == KATA_HOST_DIR_VOLUME_TYPE
+}
+
 /// Splits a sandbox bindmount string into its real path and mode.
 ///
 /// The `bindmount` format is typically `/path/to/dir` or `/path/to/dir:ro[:rw]`.

src/libs/mem-agent/src/compact.rs

@@ -52,8 +52,7 @@ pub struct Config {
     // the next compact_force_times times, a compaction will be forced
     // regardless of the system's memory situation.
     // If compact_force_times is set to 0, will do force compaction each time.
-    // If compact_force_times is set to std::u64::MAX, u64::MAX - 1, or i64::MAX, will never do force compaction.
-    // Note: Using i64::MAX (9223372036854775807) instead of u64::MAX to avoid TOML parser issues.
+    // If compact_force_times is set to std::u64::MAX, will never do force compaction.
     pub compact_force_times: u64,
 }
 
@@ -68,7 +67,7 @@ impl Default for Config {
             compact_sec_max: 5 * 60,
             compact_order: PAGE_REPORTING_MIN_ORDER,
             compact_threshold: 2 << PAGE_REPORTING_MIN_ORDER,
-            compact_force_times: i64::MAX as u64,
+            compact_force_times: u64::MAX,
         }
     }
 }
@@ -134,7 +133,7 @@ impl CompactCore {
     }
 
     fn need_force_compact(&self) -> bool {
-        if self.config.compact_force_times >= i64::MAX as u64 {
+        if self.config.compact_force_times == u64::MAX {
             return false;
         }
 

src/libs/protocols/protos/remote.proto

@@ -5,7 +5,7 @@
 
 syntax = "proto3";
 
-package hypervisor;
+package remote;
 
 service Hypervisor {
 	rpc CreateVM(CreateVMRequest) returns (CreateVMResponse) {}

src/libs/shim-interface/src/shim_mgmt/mod.rs

@@ -20,7 +20,5 @@ pub const IP_TABLE_URL: &str = "/iptables";
 pub const IP6_TABLE_URL: &str = "/ip6tables";
 /// URL for querying metrics inside shim
 pub const METRICS_URL: &str = "/metrics";
-/// URL for setting agent policy
-pub const AGENT_POLICY_URL: &str = "/policy";
 
 pub const ERR_NO_SHIM_SERVER: &str = "Failed to create shim management server";

src/runtime-rs/Cargo.lock

@@ -25,18 +25,18 @@ dependencies = [
 
 [[package]]
 name = "addr2line"
-version = "0.25.1"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
+checksum = "f4fa78e18c64fce05e902adecd7a5eed15a5e0a3439f7b0e169f0252214865e3"
 dependencies = [
  "gimli",
 ]
 
 [[package]]
-name = "adler2"
-version = "2.0.1"
+name = "adler"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "agent"
@@ -338,17 +338,17 @@ checksum = "cc17ab023b4091c10ff099f9deebaeeb59b5189df07e554c4fef042b70745d68"
 
 [[package]]
 name = "backtrace"
-version = "0.3.76"
+version = "0.3.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
+checksum = "4319208da049c43661739c5fade2ba182f09d1dc2299b32298d3a31692b17e12"
 dependencies = [
  "addr2line",
+ "cc",
  "cfg-if 1.0.0",
  "libc",
  "miniz_oxide",
  "object",
  "rustc-demangle",
- "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -576,9 +576,9 @@ dependencies = [
 
 [[package]]
 name = "cgroups-rs"
-version = "0.5.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efc46cf39fc5922b840030e0e5b378ce5caa9a824a675a95c6dec2c2c9ce9468"
+checksum = "879433e90a9bf3c38e4e854ad36bd14507751dbd3a0df15429283ff5c10ff0e4"
 dependencies = [
  "bit-vec",
  "libc",
@@ -615,7 +615,7 @@ dependencies = [
  "js-sys",
  "num-traits",
  "wasm-bindgen",
- "windows-link 0.1.3",
+ "windows-link",
 ]
 
 [[package]]
@@ -1436,9 +1436,9 @@ checksum = "37ab347416e802de484e4d03c7316c48f1ecb56574dfd4a46a80f173ce1de04d"
 
 [[package]]
 name = "flate2"
-version = "1.1.5"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
+checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
 dependencies = [
  "crc32fast",
  "libz-sys",
@@ -1668,9 +1668,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.32.3"
+version = "0.27.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
+checksum = "b6c80984affa11d98d1b88b66ac8853f143217b399d3c74116778ff8fdb4ed2e"
 
 [[package]]
 name = "glob"
@@ -2506,12 +2506,11 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.9"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
 dependencies = [
- "adler2",
- "simd-adler32",
+ "adler",
 ]
 
 [[package]]
@@ -2895,9 +2894,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.37.3"
+version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+checksum = "8bda667d9f2b5051b8833f59f3bf748b28ef54f850f4fcb389a252aa383866d1"
 dependencies = [
  "memchr",
 ]
@@ -3875,7 +3874,7 @@ dependencies = [
  "async-trait",
  "bitflags 2.9.0",
  "byte-unit",
- "cgroups-rs 0.5.0",
+ "cgroups-rs 0.4.0",
  "flate2",
  "futures 0.3.28",
  "hex",
@@ -4040,9 +4039,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.26"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustix"
@@ -4467,12 +4466,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "simd-adler32"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
-
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -5275,9 +5268,6 @@ name = "uuid"
 version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
-dependencies = [
- "getrandom 0.3.2",
-]
 
 [[package]]
 name = "valuable"
@@ -5372,7 +5362,6 @@ dependencies = [
  "toml 0.4.10",
  "tracing",
  "url",
- "uuid 1.16.0",
 ]
 
 [[package]]
@@ -5681,12 +5670,6 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
 
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
 [[package]]
 name = "windows-result"
 version = "0.1.2"

src/runtime-rs/Makefile

@@ -77,9 +77,7 @@ CLHBINDIR := $(PREFIXDEPS)/bin
 QEMUBINDIR := $(PREFIXDEPS)/bin
 PROJECT_DIR = $(PROJECT_TAG)
 IMAGENAME = $(PROJECT_TAG).img
-IMAGECONFIDENTIALNAME = $(PROJECT_TAG)-confidential.img
 INITRDNAME = $(PROJECT_TAG)-initrd.img
-INITRDCONFIDENTIALNAME = $(PROJECT_TAG)-initrd-confidential.img
 TARGET = $(PROJECT_COMPONENT)
 SYSCONFDIR := /etc
 LOCALSTATEDIR := /var
@@ -114,9 +112,7 @@ PKGDATADIR := $(PREFIXDEPS)/share/$(PROJECT_DIR)
 PKGRUNDIR := $(LOCALSTATEDIR)/run/$(PROJECT_DIR)
 KERNELDIR := $(PKGDATADIR)
 IMAGEPATH := $(PKGDATADIR)/$(IMAGENAME)
-IMAGECONFIDENTIALPATH := $(PKGDATADIR)/$(IMAGECONFIDENTIALNAME)
 INITRDPATH := $(PKGDATADIR)/$(INITRDNAME)
-INITRDCONFIDENTIALPATH := $(PKGDATADIR)/$(INITRDCONFIDENTIALNAME)
 
 ROOTFSTYPE_EXT4 := \"ext4\"
 ROOTFSTYPE_XFS := \"xfs\"
@@ -190,8 +186,6 @@ QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT := 4050
 
 # Create Container Timeout in seconds
 DEFCREATECONTAINERTIMEOUT ?= 30
-DEFCREATECONTAINERTIMEOUT_COCO ?= 60
-DEFSTATICRESOURCEMGMT_COCO = true
 
 SED = sed
 CLI_DIR = cmd
@@ -304,18 +298,6 @@ ifneq (,$(QEMUCMD))
 
     CONFIGS += $(CONFIG_QEMU_SE)
 
-    CONFIG_FILE_QEMU_COCO_DEV = configuration-qemu-coco-dev-runtime-rs.toml
-    CONFIG_QEMU_COCO_DEV = config/$(CONFIG_FILE_QEMU_COCO_DEV)
-    CONFIG_QEMU_COCO_DEV_IN = $(CONFIG_QEMU_COCO_DEV).in
-
-    CONFIG_PATH_QEMU_COCO_DEV = $(abspath $(CONFDIR)/$(CONFIG_FILE_QEMU_COCO_DEV))
-    CONFIG_PATHS += $(CONFIG_PATH_QEMU_COCO_DEV)
-
-    SYSCONFIG_QEMU_COCO_DEV = $(abspath $(SYSCONFDIR)/$(CONFIG_FILE_QEMU_COCO_DEV))
-    SYSCONFIG_PATHS += $(SYSCONFIG_QEMU_COCO_DEV)
-
-    CONFIGS += $(CONFIG_QEMU_COCO_DEV)
-
     KERNELTYPE_QEMU = uncompressed
     KERNEL_NAME_QEMU = $(call MAKE_KERNEL_NAME,$(KERNELTYPE_QEMU))
     KERNELPATH_QEMU = $(KERNELDIR)/$(KERNEL_NAME_QEMU)
@@ -323,12 +305,8 @@ ifneq (,$(QEMUCMD))
     KERNEL_NAME_QEMU_SE = kata-containers-se.img
     KERNELPATH_QEMU_SE = $(KERNELDIR)/$(KERNEL_NAME_QEMU_SE)
 
-    KERNEL_TYPE_COCO = compressed
-    KERNEL_NAME_COCO = $(call MAKE_KERNEL_NAME_COCO,$(KERNEL_TYPE_COCO))
-    KERNELPATH_COCO = $(KERNELDIR)/$(KERNEL_NAME_COCO)
-
     # overriding options
-    DEFSTATICRESOURCEMGMT_QEMU := true
+    DEFSTATICRESOURCEMGMT_QEMU := false
 
     # qemu-specific options
     DEFSANDBOXCGROUPONLY_QEMU := false
@@ -343,17 +321,11 @@ endif
     DEFMAXVCPUS_QEMU := 0
     DEFSHAREDFS_QEMU_VIRTIOFS := virtio-fs
     DEFSHAREDFS_QEMU_SEL_VIRTIOFS := none
-    DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS := none
     DEFBLOCKDEVICEAIO_QEMU := io_uring
     DEFNETWORKMODEL_QEMU := tcfilter
     DEFDISABLEGUESTSELINUX := true
-    # Default is empty string "" to match Rust default None (when commented out in config).
-    # Most users will want to set this to "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-    # for better security. Note: "elevateprivileges=deny" doesn't work with daemonize option.
-    DEFSECCOMPSANDBOXPARAM := ""
-    # Default is empty string "" to match Rust default None (when commented out in config).
-    # Most users will want to set this to "system_u:system_r:container_t" for SELinux support.
-    DEFGUESTSELINUXLABEL := ""
+    DEFSECCOMPSANDBOXPARAM := on,obsolete=deny,spawn=deny,resourcecontrol=deny
+    DEFGUESTSELINUXLABEL := system_u:system_r:container_t
 endif
 
 ifneq (,$(FCCMD))
@@ -415,7 +387,6 @@ USER_VARS += CONFIG_PATH
 USER_VARS += CONFIG_QEMU_IN
 USER_VARS += CONFIG_QEMU_SE_IN
 USER_VARS += CONFIG_REMOTE_IN
-USER_VARS += CONFIG_QEMU_COCO_DEV_IN
 USER_VARS += DESTDIR
 USER_VARS += HYPERVISOR
 USER_VARS += USE_BUILDIN_DB
@@ -441,13 +412,8 @@ USER_VARS += FCVALIDJAILERPATHS
 USER_VARS += DEFMAXMEMSZ_FC
 USER_VARS += SYSCONFIG
 USER_VARS += IMAGENAME
-USER_VARS += IMAGECONFIDENTIALNAME
 USER_VARS += IMAGEPATH
-USER_VARS += IMAGECONFIDENTIALPATH
-USER_VARS += INITRDNAME
-USER_VARS += INITRDCONFIDENTIALNAME
 USER_VARS += INITRDPATH
-USER_VARS += INITRDCONFIDENTIALPATH
 USER_VARS += DEFROOTFSTYPE
 USER_VARS += VMROOTFSDRIVER_DB
 USER_VARS += VMROOTFSDRIVER_CLH
@@ -459,7 +425,6 @@ USER_VARS += KERNELPATH_DB
 USER_VARS += KERNELPATH_QEMU
 USER_VARS += KERNELPATH_QEMU_SE
 USER_VARS += KERNELPATH_FC
-USER_VARS += KERNELPATH_COCO
 USER_VARS += KERNELPATH
 USER_VARS += KERNELVIRTIOFSPATH
 USER_VARS += FIRMWAREPATH
@@ -511,7 +476,6 @@ USER_VARS += DEFBLOCKSTORAGEDRIVER_FC
 USER_VARS += DEFSHAREDFS_CLH_VIRTIOFS
 USER_VARS += DEFSHAREDFS_QEMU_VIRTIOFS
 USER_VARS += DEFSHAREDFS_QEMU_SEL_VIRTIOFS
-USER_VARS += DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS
 USER_VARS += DEFVIRTIOFSDAEMON
 USER_VARS += DEFVALIDVIRTIOFSDAEMONPATHS
 USER_VARS += DEFVIRTIOFSCACHESIZE
@@ -540,7 +504,6 @@ USER_VARS += DEFSTATICRESOURCEMGMT_DB
 USER_VARS += DEFSTATICRESOURCEMGMT_FC
 USER_VARS += DEFSTATICRESOURCEMGMT_CLH
 USER_VARS += DEFSTATICRESOURCEMGMT_QEMU
-USER_VARS += DEFSTATICRESOURCEMGMT_COCO
 USER_VARS += DEFBINDMOUNTS
 USER_VARS += DEFVFIOMODE
 USER_VARS += DEFVFIOMODE_SE
@@ -559,7 +522,6 @@ USER_VARS += DEFDANCONF
 USER_VARS += DEFFORCEGUESTPULL
 USER_VARS += QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT
 USER_VARS += DEFCREATECONTAINERTIMEOUT
-USER_VARS += DEFCREATECONTAINERTIMEOUT_COCO
 
 SOURCES := \
   $(shell find . 2>&1 | grep -E '.*\.rs$$') \
@@ -648,10 +610,6 @@ define MAKE_KERNEL_NAME
 $(if $(findstring uncompressed,$1),vmlinux.container,vmlinuz.container)
 endef
 
-define MAKE_KERNEL_NAME_COCO
-$(if $(findstring uncompressed,$1),vmlinux-confidential.container,vmlinuz-confidential.container)
-endef
-
 .DEFAULT_GOAL := default
 
 GENERATED_FILES += $(CONFIGS)

src/runtime-rs/config/configuration-cloud-hypervisor.toml.in

@@ -18,15 +18,41 @@ image = "@IMAGEPATH@"
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
  
 # Block storage driver to be used for the VM rootfs is backed
 # by a block device.
 vm_rootfs_driver = "@VMROOTFSDRIVER_CLH@"
 
+# Enable confidential guest support.
+# Toggling that setting may trigger different hardware features, ranging
+# from memory encryption to both memory and CPU-state encryption and integrity.
+# The Kata Containers runtime dynamically detects the available feature set and
+# aims at enabling the largest possible one, returning an error if none is
+# available, or none is supported by the hypervisor.
+#
+# Known limitations:
+# * Does not work by design:
+#   - CPU Hotplug 
+#   - Memory Hotplug
+#   - NVDIMM devices
+#
+# Supported TEEs:
+# * Intel TDX
+#
+# Default false
+# confidential_guest = true
+
 # Path to the firmware.
 # If you want Cloud Hypervisor to use a specific firmware, set its path below.
-firmware = "@FIRMWAREPATH@"
+# This is option is only used when confidential_guest is enabled.
+#
+# For more information about firmwared that can be used with specific TEEs,
+# please, refer to:
+# * Intel TDX:
+#   - td-shim: https://github.com/confidential-containers/td-shim
+#
+# firmware = "@FIRMWAREPATH@"
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -42,7 +68,7 @@ valid_hypervisor_paths = @CLHVALIDHYPERVISORPATHS@
 # List of valid annotations values for ctlpath
 # The default if not set is empty (all annotations rejected.)
 # Your distribution recommends: 
-valid_ctlpaths = []
+# valid_ctlpaths = 
 
 # Optional space-separated list of options to pass to the guest kernel.
 # For example, use `kernel_params = "vsyscall=emulate"` if you are having
@@ -140,7 +166,7 @@ default_bridges = @DEFBRIDGES@
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Block device driver to be used by the hypervisor when a container's storage
 # is backed by a block device or a file. This driver facilitates attaching the
@@ -150,7 +176,7 @@ block_device_driver = "virtio-blk-pci"
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Bandwidth rate limiter options
 #
@@ -158,35 +184,29 @@ block_device_cache_direct = false
 # for SB/VM).
 # The same value is used for inbound and outbound bandwidth.
 # Default 0-sized value means unlimited rate.
-disk_rate_limiter_bw_max_rate = 0
-
+#disk_rate_limiter_bw_max_rate = 0
+#
 # disk_rate_limiter_bw_one_time_burst increases the initial max rate and this
 # initial extra credit does *NOT* affect the overall limit and can be used for
 # an *initial* burst of data.
 # This is *optional* and only takes effect if disk_rate_limiter_bw_max_rate is
 # set to a non zero value.
-disk_rate_limiter_bw_one_time_burst = 0
-
+#disk_rate_limiter_bw_one_time_burst = 0
+#
 # Operation rate limiter options
 #
 # disk_rate_limiter_ops_max_rate controls disk I/O bandwidth (size in ops/sec
 # for SB/VM).
 # The same value is used for inbound and outbound bandwidth.
 # Default 0-sized value means unlimited rate.
-disk_rate_limiter_ops_max_rate = 0
-
+#disk_rate_limiter_ops_max_rate = 0
+#
 # disk_rate_limiter_ops_one_time_burst increases the initial max rate and this
 # initial extra credit does *NOT* affect the overall limit and can be used for
 # an *initial* burst of data.
 # This is *optional* and only takes effect if disk_rate_limiter_bw_max_rate is
 # set to a non zero value.
-disk_rate_limiter_ops_one_time_burst = 0
-
-# Virtio queue size. Size: byte. default 128
-queue_size = 128
-
-# Block device multi-queue, default 1
-num_queues = 1
+#disk_rate_limiter_ops_one_time_burst = 0
 
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
@@ -195,7 +215,7 @@ num_queues = 1
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -203,27 +223,27 @@ enable_mem_prealloc = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable running clh VMM as a non-root user.
 # By default clh VMM run as root. When this is set to true, clh VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+#rootless = true
 
 # Disable the 'seccomp' feature from Cloud Hypervisor, firecracker or dragonball, default false
-disable_seccomp = false
+# disable_seccomp = true
 
 # This option changes the default hypervisor and kernel parameters
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # Path to OCI hook binaries in the *guest rootfs*.
 # This does not affect host-side hooks which must instead be added to
@@ -240,31 +260,30 @@ disable_nesting_checks = false
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # If enable_guest_swap is enabled, the swap device will be created in the guest
 # at this path. Default "/run/kata-containers/swap".
-guest_swap_path = "/run/kata-containers/swap"
+#guest_swap_path = "/run/kata-containers/swap"
 
 # The percentage of the total memory to be used as swap device.
 # Default 100.
-guest_swap_size_percent = 100
+#guest_swap_size_percent = 100
 
 # The threshold in seconds to create swap device in the guest.
 # Kata will wait guest_swap_create_threshold_secs seconds before creating swap device.
 # Default 60.
-guest_swap_create_threshold_secs = 60
+#guest_swap_create_threshold_secs = 60
 
 [agent.@PROJECT_TYPE@]
-container_pipe_size = @PIPESIZE@
+container_pipe_size=@PIPESIZE@
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -278,18 +297,18 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent dial timeout in millisecond.
 # (default: 10)
-dial_timeout_ms = 10
+#dial_timeout_ms = 10
 
 # Agent reconnect timeout in millisecond.
 # Retry times = reconnect_timeout_ms / dial_timeout_ms (default: 300)
@@ -298,28 +317,28 @@ dial_timeout_ms = 10
 # You'd better not change the value of dial_timeout_ms, unless you have an
 # idea of what you are doing.
 # (default: 3000)
-reconnect_timeout_ms = 3000
+#reconnect_timeout_ms = 3000
 
 [agent.@PROJECT_TYPE@.mem_agent]
 # Control the mem-agent function enable or disable.
 # Default to false
-mem_agent_enable = false
+#mem_agent_enable = true
 
 # Control the mem-agent memcg function disable or enable
 # Default to false
-memcg_disable = false
+#memcg_disable = false
 
 # Control the mem-agent function swap enable or disable.
 # Default to false
-memcg_swap = false
+#memcg_swap = false
 
 # Control the mem-agent function swappiness max number.
 # Default to 50
-memcg_swappiness_max = 50
+#memcg_swappiness_max = 50
 
 # Control the mem-agent memcg function wait period seconds
 # Default to 600
-memcg_period_secs = 600
+#memcg_period_secs = 600
 
 # Control the mem-agent memcg wait period PSI percent limit.
 # If the percentage of memory and IO PSI stall time within
@@ -327,7 +346,7 @@ memcg_period_secs = 600
 # then the aging and eviction for this cgroup will not be
 # executed after this waiting period.
 # Default to 1
-memcg_period_psi_percent_limit = 1
+#memcg_period_psi_percent_limit = 1
 
 # Control the mem-agent memcg eviction PSI percent limit.
 # If the percentage of memory and IO PSI stall time for a cgroup
@@ -335,44 +354,44 @@ memcg_period_psi_percent_limit = 1
 # this cgroup will immediately stop and will not resume until
 # the next memcg waiting period.
 # Default to 1
-memcg_eviction_psi_percent_limit = 1
+#memcg_eviction_psi_percent_limit = 1
 
 # Control the mem-agent memcg eviction run aging count min.
 # A cgroup will only perform eviction when the number of aging cycles
 # in memcg is greater than or equal to memcg_eviction_run_aging_count_min.
 # Default to 3
-memcg_eviction_run_aging_count_min = 3
+#memcg_eviction_run_aging_count_min = 3
 
 # Control the mem-agent compact function disable or enable
 # Default to false
-compact_disable = false
+#compact_disable = false
 
 # Control the mem-agent compaction function wait period seconds
 # Default to 600
-compact_period_secs = 600
+#compact_period_secs = 600
 
 # Control the mem-agent compaction function wait period PSI percent limit.
 # If the percentage of memory and IO PSI stall time within
 # the compaction waiting period exceeds this value,
 # then the compaction will not be executed after this waiting period.
 # Default to 1
-compact_period_psi_percent_limit = 1
+#compact_period_psi_percent_limit = 1
 
 # Control the mem-agent compaction function compact PSI percent limit.
 # During compaction, the percentage of memory and IO PSI stall time
 # is checked every second. If this percentage exceeds
 # compact_psi_percent_limit, the compaction process will stop.
 # Default to 5
-compact_psi_percent_limit = 5
+#compact_psi_percent_limit = 5
 
 # Control the maximum number of seconds for each compaction of mem-agent compact function.
-# Default to 300
-compact_sec_max = 300
+# Default to 180
+#compact_sec_max = 180
 
 # Control the mem-agent compaction function compact order.
 # compact_order is use with compact_threshold.
 # Default to 9
-compact_order = 9
+#compact_order = 9
 
 # Control the mem-agent compaction function compact threshold.
 # compact_threshold is the pages number.
@@ -385,7 +404,7 @@ compact_order = 9
 # since the previous compaction.
 # then the system should initiate another round of memory compaction.
 # Default to 1024
-compact_threshold = 1024
+#compact_threshold = 1024
 
 # Control the mem-agent compaction function force compact times.
 # After one compaction, if there has not been a compaction within
@@ -394,9 +413,7 @@ compact_threshold = 1024
 # If compact_force_times is set to 0, will do force compaction each time.
 # If compact_force_times is set to 18446744073709551615, will never do force compaction.
 # Default to 18446744073709551615
-# Note: Using a large but valid u64 value (within i64::MAX range) instead of u64::MAX to avoid TOML parser issues
-# Using 9223372036854775807 (i64::MAX) which is effectively "never" for practical purposes
-compact_force_times = 9223372036854775807
+#compact_force_times = 18446744073709551615
 
 # Create Container Request Timeout
 # This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
@@ -409,20 +426,20 @@ compact_force_times = 9223372036854775807
 # - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
 # (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
 # Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
+# create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # If enabled, enabled, it means that 1) if the runtime exits abnormally,
 # the cleanup process will be skipped, and 2) the runtime will not exit
 # even if the health check fails.
 # This option is typically used to retain abnormal information for debugging.
 # (default: false)
-keep_abnormal = false
+#keep_abnormal = true
 
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -447,33 +464,33 @@ keep_abnormal = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_CLH@"
+internetworking_model="@DEFNETWORKMODEL_CLH@"
 
-name = "@RUNTIMENAME@"
-hypervisor_name = "@HYPERVISOR_CLH@"
-agent_name = "@PROJECT_TYPE@"
+name="@RUNTIMENAME@"
+hypervisor_name="@HYPERVISOR_CLH@"
+agent_name="@PROJECT_TYPE@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -481,7 +498,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -489,18 +506,18 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_CLH@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_CLH@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -509,7 +526,7 @@ enable_pprof = false
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_CLH@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_CLH@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted(ro, rw) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
@@ -519,7 +536,7 @@ static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_CLH@
 # - "/path/to", default readonly mode.
 # - "/path/to:ro", readonly mode.
 # - "/path/to:rw", readwrite mode.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # Base directory of directly attachable network config.
 # Network devices for VM-based containers are allowed to be placed in the

src/runtime-rs/config/configuration-dragonball.toml.in

@@ -16,12 +16,13 @@ path = "@DBPATH@"
 ctlpath = "@DBCTLPATH@"
 kernel = "@KERNELPATH_DB@"
 image = "@IMAGEPATH@"
+# initrd = "@INITRDPATH@"
 
 # rootfs filesystem type:
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 
  
 # Block storage driver to be used for the VM rootfs is backed
@@ -42,7 +43,7 @@ valid_hypervisor_paths = @DBVALIDHYPERVISORPATHS@
 # List of valid annotations values for ctlpath
 # The default if not set is empty (all annotations rejected.)
 # Your distribution recommends: 
-valid_ctlpaths = []
+# valid_ctlpaths = 
 
 # Optional space-separated list of options to pass to the guest kernel.
 # For example, use `kernel_params = "vsyscall=emulate"` if you are having
@@ -105,7 +106,7 @@ default_bridges = @DEFBRIDGES@
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Default memory size in MiB for SB/VM.
 # If unspecified then it will be set @DEFMEMSZ@ MiB.
@@ -128,7 +129,7 @@ block_device_driver = "@DEFBLOCKSTORAGEDRIVER_DB@"
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # The log level will be applied to hypervisor.
 # Possible values are:
@@ -139,18 +140,17 @@ enable_debug = false
 # - error
 # - critical
 # Default: info
-log_level = "info"
+#log_level = "info"
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-# Default false
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # If host doesn't support vhost_net, set to true. Thus we won't create vhost fds for nics.
 # Default false
-disable_vhost_net = false
+#disable_vhost_net = true
 
 # Path to OCI hook binaries in the *guest rootfs*.
 # This does not affect host-side hooks which must instead be added to
@@ -167,8 +167,7 @@ disable_vhost_net = false
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 
 # Shared file system type:
 #   - inline-virtio-fs (default)
@@ -210,13 +209,7 @@ virtio_fs_cache = "@DEFVIRTIOFSCACHE@"
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
-
-# Virtio queue size. Size: byte. default 128
-queue_size = 128
-
-# Block device multi-queue, default 1
-num_queues = 1
+#block_device_cache_direct = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -224,33 +217,33 @@ num_queues = 1
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Disable the 'seccomp' feature from Cloud Hypervisor, firecracker or dragonball, default false
-disable_seccomp = false
+# disable_seccomp = true
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # If enable_guest_swap is enabled, the swap device will be created in the guest
 # at this path. Default "/run/kata-containers/swap".
-guest_swap_path = "/run/kata-containers/swap"
+#guest_swap_path = "/run/kata-containers/swap"
 
 # The percentage of the total memory to be used as swap device.
 # Default 100.
-guest_swap_size_percent = 100
+#guest_swap_size_percent = 100
 
 # The threshold in seconds to create swap device in the guest.
 # Kata will wait guest_swap_create_threshold_secs seconds before creating swap device.
 # Default 60.
-guest_swap_create_threshold_secs = 60
+#guest_swap_create_threshold_secs = 60
 
 [agent.@PROJECT_TYPE@]
-container_pipe_size = @PIPESIZE@
+container_pipe_size=@PIPESIZE@
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # The log level will be applied to agent.
 # Possible values are:
@@ -261,7 +254,7 @@ enable_debug = false
 # - error
 # - critical
 # (default: info)
-log_level = "info"
+#log_level = "info"
 
 # Enable agent tracing.
 #
@@ -275,18 +268,18 @@ log_level = "info"
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent dial timeout in millisecond.
 # (default: 10)
-dial_timeout_ms = 10
+#dial_timeout_ms = 10
 
 # Agent reconnect timeout in millisecond.
 # Retry times = reconnect_timeout_ms / dial_timeout_ms (default: 300)
@@ -295,7 +288,7 @@ dial_timeout_ms = 10
 # You'd better not change the value of dial_timeout_ms, unless you have an
 # idea of what you are doing.
 # (default: 3000)
-reconnect_timeout_ms = 3000
+#reconnect_timeout_ms = 3000
 
 # Create Container Request Timeout
 # This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
@@ -308,28 +301,28 @@ reconnect_timeout_ms = 3000
 # - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
 # (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
 # Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
+# create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 
 [agent.@PROJECT_TYPE@.mem_agent]
 # Control the mem-agent function enable or disable.
 # Default to false
-mem_agent_enable = false
+#mem_agent_enable = true
 
 # Control the mem-agent memcg function disable or enable
 # Default to false
-memcg_disable = false
+#memcg_disable = false
 
 # Control the mem-agent function swap enable or disable.
 # Default to false
-memcg_swap = false
+#memcg_swap = false
 
 # Control the mem-agent function swappiness max number.
 # Default to 50
-memcg_swappiness_max = 50
+#memcg_swappiness_max = 50
 
 # Control the mem-agent memcg function wait period seconds
 # Default to 600
-memcg_period_secs = 600
+#memcg_period_secs = 600
 
 # Control the mem-agent memcg wait period PSI percent limit.
 # If the percentage of memory and IO PSI stall time within
@@ -337,7 +330,7 @@ memcg_period_secs = 600
 # then the aging and eviction for this cgroup will not be
 # executed after this waiting period.
 # Default to 1
-memcg_period_psi_percent_limit = 1
+#memcg_period_psi_percent_limit = 1
 
 # Control the mem-agent memcg eviction PSI percent limit.
 # If the percentage of memory and IO PSI stall time for a cgroup
@@ -345,44 +338,44 @@ memcg_period_psi_percent_limit = 1
 # this cgroup will immediately stop and will not resume until
 # the next memcg waiting period.
 # Default to 1
-memcg_eviction_psi_percent_limit = 1
+#memcg_eviction_psi_percent_limit = 1
 
 # Control the mem-agent memcg eviction run aging count min.
 # A cgroup will only perform eviction when the number of aging cycles
 # in memcg is greater than or equal to memcg_eviction_run_aging_count_min.
 # Default to 3
-memcg_eviction_run_aging_count_min = 3
+#memcg_eviction_run_aging_count_min = 3
 
 # Control the mem-agent compact function disable or enable
 # Default to false
-compact_disable = false
+#compact_disable = false
 
 # Control the mem-agent compaction function wait period seconds
 # Default to 600
-compact_period_secs = 600
+#compact_period_secs = 600
 
 # Control the mem-agent compaction function wait period PSI percent limit.
 # If the percentage of memory and IO PSI stall time within
 # the compaction waiting period exceeds this value,
 # then the compaction will not be executed after this waiting period.
 # Default to 1
-compact_period_psi_percent_limit = 1
+#compact_period_psi_percent_limit = 1
 
 # Control the mem-agent compaction function compact PSI percent limit.
 # During compaction, the percentage of memory and IO PSI stall time
 # is checked every second. If this percentage exceeds
 # compact_psi_percent_limit, the compaction process will stop.
 # Default to 5
-compact_psi_percent_limit = 5
+#compact_psi_percent_limit = 5
 
 # Control the maximum number of seconds for each compaction of mem-agent compact function.
 # Default to 180
-compact_sec_max = 180
+#compact_sec_max = 180
 
 # Control the mem-agent compaction function compact order.
 # compact_order is use with compact_threshold.
 # Default to 9
-compact_order = 9
+#compact_order = 9
 
 # Control the mem-agent compaction function compact threshold.
 # compact_threshold is the pages number.
@@ -395,22 +388,22 @@ compact_order = 9
 # since the previous compaction.
 # then the system should initiate another round of memory compaction.
 # Default to 1024
-compact_threshold = 1024
+#compact_threshold = 1024
 
 # Control the mem-agent compaction function force compact times.
 # After one compaction, if there has not been a compaction within
 # the next compact_force_times times, a compaction will be forced
 # regardless of the system's memory situation.
 # If compact_force_times is set to 0, will do force compaction each time.
-# If compact_force_times is set to 9223372036854775807, will never do force compaction.
-# Default to 9223372036854775807
-compact_force_times = 9223372036854775807
+# If compact_force_times is set to 18446744073709551615, will never do force compaction.
+# Default to 18446744073709551615
+#compact_force_times = 18446744073709551615
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # The log level will be applied to runtimes.
 # Possible values are:
@@ -421,14 +414,14 @@ enable_debug = false
 # - error
 # - critical
 # (default: info)
-log_level = "info"
+#log_level = "info"
 
 # If enabled, enabled, it means that 1) if the runtime exits abnormally,
 # the cleanup process will be skipped, and 2) the runtime will not exit
 # even if the health check fails.
 # This option is typically used to retain abnormal information for debugging.
 # (default: false)
-keep_abnormal = false
+#keep_abnormal = true
 
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -453,33 +446,33 @@ keep_abnormal = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_DB@"
+internetworking_model="@DEFNETWORKMODEL_DB@"
 
-name = "@RUNTIMENAME@"
-hypervisor_name = "@HYPERVISOR_DB@"
-agent_name = "@PROJECT_TYPE@"
+name="@RUNTIMENAME@"
+hypervisor_name="@HYPERVISOR_DB@"
+agent_name="@PROJECT_TYPE@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -487,7 +480,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -495,18 +488,18 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_DB@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_DB@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -515,7 +508,7 @@ enable_pprof = false
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_DB@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_DB@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted(ro, rw) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
@@ -525,7 +518,7 @@ static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_DB@
 # - "/path/to", default readonly mode.
 # - "/path/to:ro", readonly mode.
 # - "/path/to:rw", readwrite mode.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # Base directory of directly attachable network config.
 # Network devices for VM-based containers are allowed to be placed in the
@@ -541,4 +534,4 @@ dan_conf = "@DEFDANCONF@"
 use_passfd_io = true
 
 # If fd passthrough io is enabled, the runtime will attempt to use the specified port instead of the default port.
-passfd_listener_port = 1027
+# passfd_listener_port = 1027

src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in

@@ -1,815 +0,0 @@
-# Copyright (c) 2017-2019 Intel Corporation
-# Copyright (c) 2021 Adobe Inc.
-# Copyright (c) 2024-2025 IBM Corp.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-# XXX: WARNING: this file is auto-generated.
-# XXX:
-# XXX: Source file: "@CONFIG_QEMU_IN@"
-# XXX: Project:
-# XXX:   Name: @PROJECT_NAME@
-# XXX:   Type: @PROJECT_TYPE@
-
-[hypervisor.qemu]
-path = "@QEMUPATH@"
-kernel = "@KERNELPATH_COCO@"
-image = "@IMAGECONFIDENTIALPATH@"
-machine_type = "@MACHINETYPE@"
-
-# rootfs filesystem type:
-#   - ext4 (default)
-#   - xfs
-#   - erofs
-rootfs_type = @DEFROOTFSTYPE@
-
-# Block storage driver to be used for the VM rootfs is backed
-# by a block device. This is virtio-blk-pci, virtio-blk-mmio or nvdimm
-vm_rootfs_driver = "@VMROOTFSDRIVER_QEMU@"
-
-# Enable confidential guest support.
-# Toggling that setting may trigger different hardware features, ranging
-# from memory encryption to both memory and CPU-state encryption and integrity.
-# The Kata Containers runtime dynamically detects the available feature set and
-# aims at enabling the largest possible one, returning an error if none is
-# available, or none is supported by the hypervisor.
-#
-# Known limitations:
-# * Does not work by design:
-#   - CPU Hotplug
-#   - Memory Hotplug
-#   - NVDIMM devices
-#
-# Default false
-confidential_guest = false
-
-# Enable running QEMU VMM as a non-root user.
-# By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
-# a non-root random user. See documentation for the limitations of this mode.
-rootless = false
-
-# List of valid annotation names for the hypervisor
-# Each member of the list is a regular expression, which is the base name
-# of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
-enable_annotations = @DEFENABLEANNOTATIONS_COCO@
-
-# List of valid annotations values for the hypervisor
-# Each member of the list is a path pattern as described by glob(3).
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @QEMUVALIDHYPERVISORPATHS@
-valid_hypervisor_paths = @QEMUVALIDHYPERVISORPATHS@
-
-# Optional space-separated list of options to pass to the guest kernel.
-# For example, use `kernel_params = "vsyscall=emulate"` if you are having
-# trouble running pre-2.15 glibc.
-#
-# WARNING: - any parameter specified here will take priority over the default
-# parameter value of the same name used to start the virtual machine.
-# Do not set values here unless you understand the impact of doing so as you
-# may stop the virtual machine from booting.
-# To see the list of default parameters, enable hypervisor debug, create a
-# container and look for 'default-kernel-parameters' log entries.
-kernel_params = "@KERNELPARAMS@"
-
-# Path to the firmware.
-# If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWAREPATH@"
-
-# Path to the firmware volume.
-# firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
-# as configuration) and FIRMWARE_CODE.fd (UEFI program image). UEFI variables
-# can be customized per each user while UEFI code is kept same.
-firmware_volume = "@FIRMWAREVOLUMEPATH@"
-
-# Machine accelerators
-# comma-separated list of machine accelerators to pass to the hypervisor.
-# For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
-
-# Qemu seccomp sandbox feature
-# comma-separated list of seccomp sandbox features to control the syscall access.
-# For example, `seccompsandbox= "on,obsolete=deny,spawn=deny,resourcecontrol=deny"`
-# Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
-# Another note: enabling this feature may reduce performance, you may enable
-# /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
-
-# CPU features
-# comma-separated list of cpu features to pass to the cpu
-# For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
-
-# Default number of vCPUs per SB/VM:
-# unspecified or 0                --> will be set to @DEFVCPUS@
-# < 0                             --> will be set to the actual number of physical cores
-# > 0 <= number of physical cores --> will be set to the specified number
-# > number of physical cores      --> will be set to the actual number of physical cores
-default_vcpus = @DEFVCPUS_QEMU@
-
-# Default maximum number of vCPUs per SB/VM:
-# unspecified or == 0             --> will be set to the actual number of physical cores or to the maximum number
-#                                     of vCPUs supported by KVM if that number is exceeded
-# > 0 <= number of physical cores --> will be set to the specified number
-# > number of physical cores      --> will be set to the actual number of physical cores or to the maximum number
-#                                     of vCPUs supported by KVM if that number is exceeded
-# WARNING: Depending of the architecture, the maximum number of vCPUs supported by KVM is used when
-# the actual number of physical cores is greater than it.
-# WARNING: Be aware that this value impacts the virtual machine's memory footprint and CPU
-# the hotplug functionality. For example, `default_maxvcpus = 240` specifies that until 240 vCPUs
-# can be added to a SB/VM, but the memory footprint will be big. Another example, with
-# `default_maxvcpus = 8` the memory footprint will be small, but 8 will be the maximum number of
-# vCPUs supported by the SB/VM. In general, we recommend that you do not edit this variable,
-# unless you know what are you doing.
-# NOTICE: on arm platform with gicv2 interrupt controller, set it to 8.
-default_maxvcpus = @DEFMAXVCPUS_QEMU@
-
-# Bridges can be used to hot plug devices.
-# Limitations:
-# * Currently only pci bridges are supported
-# * Until 30 devices per bridge can be hot plugged.
-# * Until 5 PCI bridges can be cold plugged per VM.
-#   This limitation could be a bug in qemu or in the kernel
-# Default number of bridges per SB/VM:
-# unspecified or 0   --> will be set to @DEFBRIDGES@
-# > 1 <= 5           --> will be set to the specified number
-# > 5                --> will be set to 5
-default_bridges = @DEFBRIDGES@
-
-# Reclaim guest freed memory.
-# Enabling this will result in the VM balloon device having f_reporting=on set.
-# Then the hypervisor will use it to reclaim guest freed memory.
-# This is useful for reducing the amount of memory used by a VM.
-# Enabling this feature may sometimes reduce the speed of memory access in
-# the VM.
-#
-# Default false
-reclaim_guest_freed_memory = false
-
-# Default memory size in MiB for SB/VM.
-# If unspecified then it will be set @DEFMEMSZ@ MiB.
-default_memory = @DEFMEMSZ@
-#
-# Default memory slots per SB/VM.
-# If unspecified then it will be set @DEFMEMSLOTS@.
-# This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
-
-# Default maximum memory in MiB per SB / VM
-# unspecified or == 0           --> will be set to the actual amount of physical RAM
-# > 0 <= amount of physical RAM --> will be set to the specified number
-# > amount of physical RAM      --> will be set to the actual amount of physical RAM
-default_maxmemory = @DEFMAXMEMSZ@
-
-# The size in MiB will be plused to max memory of hypervisor.
-# It is the memory address space for the NVDIMM devie.
-# If set block storage driver (block_device_driver) to "nvdimm",
-# should set memory_offset to the size of block device.
-# Default 0
-memory_offset = 0
-
-# Specifies virtio-mem will be enabled or not.
-# Please note that this option should be used with the command
-# "echo 1 > /proc/sys/vm/overcommit_memory".
-# Default false
-enable_virtio_mem = false
-
-# Disable block device from being used for a container's rootfs.
-# In case of a storage driver like devicemapper where a container's
-# root file system is backed by a block device, the block device is passed
-# directly to the hypervisor for performance reasons.
-# This flag prevents the block device from being passed to the hypervisor,
-# virtio-fs is used instead to pass the rootfs.
-disable_block_device_use = @DEFDISABLEBLOCK@
-
-# Shared file system type:
-#   - virtio-fs (default)
-#   - virtio-9p
-#   - virtio-fs-nydus
-#   - none
-shared_fs = "@DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS@"
-
-# Path to vhost-user-fs daemon.
-virtio_fs_daemon = "@DEFVIRTIOFSDAEMON@"
-
-# List of valid annotations values for the virtiofs daemon
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDVIRTIOFSDAEMONPATHS@
-valid_virtio_fs_daemon_paths = @DEFVALIDVIRTIOFSDAEMONPATHS@
-
-# Default size of DAX cache in MiB
-virtio_fs_cache_size = @DEFVIRTIOFSCACHESIZE@
-
-# Default size of virtqueues
-virtio_fs_queue_size = @DEFVIRTIOFSQUEUESIZE@
-
-# Extra args for virtiofsd daemon
-#
-# Format example:
-#   ["--arg1=xxx", "--arg2=yyy"]
-# Examples:
-#   Set virtiofsd log level to debug : ["--log-level=debug"]
-#
-# see `virtiofsd -h` for possible options.
-virtio_fs_extra_args = @DEFVIRTIOFSEXTRAARGS@
-
-# Cache mode:
-#
-#  - never
-#    Metadata, data, and pathname lookup are not cached in guest. They are
-#    always fetched from host and any changes are immediately pushed to host.
-#
-#  - auto
-#    Metadata and pathname lookup cache expires after a configured amount of
-#    time (default is 1 second). Data is cached while the file is open (close
-#    to open consistency).
-#
-#  - always
-#    Metadata, data, and pathname lookup are cached in guest and never expire.
-virtio_fs_cache = "@DEFVIRTIOFSCACHE@"
-
-# Block storage driver to be used for the hypervisor in case the container
-# rootfs is backed by a block device. This is virtio-scsi, virtio-blk
-# or nvdimm.
-block_device_driver = "@DEFBLOCKSTORAGEDRIVER_QEMU@"
-
-# aio is the I/O mechanism used by qemu
-# Options:
-#
-#   - threads
-#     Pthread based disk I/O.
-#
-#   - native
-#     Native Linux I/O.
-#
-#   - io_uring
-#     Linux io_uring API. This provides the fastest I/O operations on Linux, requires kernel>5.1 and
-#     qemu >=5.0.
-block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
-
-# Specifies cache-related options will be set to block devices or not.
-# Default false
-block_device_cache_set = false
-
-# Specifies cache-related options for block devices.
-# Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
-# Default false
-block_device_cache_direct = false
-
-# Specifies cache-related options for block devices.
-# Denotes whether flush requests for the device are ignored.
-# Default false
-block_device_cache_noflush = false
-
-# Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently only implemented
-# for SCSI.
-#
-enable_iothreads = @DEFENABLEIOTHREADS@
-
-# Enable pre allocation of VM RAM, default false
-# Enabling this will result in lower container density
-# as all of the memory will be allocated and locked
-# This is useful when you want to reserve all the memory
-# upfront or in the cases where you want memory latencies
-# to be very predictable
-# Default false
-enable_mem_prealloc = false
-
-# Enable huge pages for VM RAM, default false
-# Enabling this will result in the VM memory
-# being allocated using huge pages.
-# This is useful when you want to use vhost-user network
-# stacks within the container. This will automatically
-# result in memory pre allocation
-enable_hugepages = false
-
-# Enable vhost-user storage device, default false
-# Enabling this will result in some Linux reserved block type
-# major range 240-254 being chosen to represent vhost-user devices.
-enable_vhost_user_store = @DEFENABLEVHOSTUSERSTORE@
-
-# The base directory specifically used for vhost-user devices.
-# Its sub-path "block" is used for block devices; "block/sockets" is
-# where we expect vhost-user sockets to live; "block/devices" is where
-# simulated block device nodes for vhost-user devices to live.
-vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
-
-# Enable vIOMMU, default false
-# Enabling this will result in the VM having a vIOMMU device
-# This will also add the following options to the kernel's
-# command line: intel_iommu=on,iommu=pt
-enable_iommu = false
-
-# Enable IOMMU_PLATFORM, default false
-# Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
-
-# List of valid annotations values for the vhost user store path
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDVHOSTUSERSTOREPATHS@
-valid_vhost_user_store_paths = @DEFVALIDVHOSTUSERSTOREPATHS@
-
-# The timeout for reconnecting on non-server spdk sockets when the remote end goes away.
-# qemu will delay this many seconds and then attempt to reconnect.
-# Zero disables reconnecting, and the default is zero.
-vhost_user_reconnect_timeout_sec = 0
-
-# Enable file based guest memory support. The default is an empty string which
-# will disable this feature. In the case of virtio-fs, this is enabled
-# automatically and '/dev/shm' is used as the backing folder.
-# This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
-
-# List of valid annotations values for the file_mem_backend annotation
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDFILEMEMBACKENDS@
-valid_file_mem_backends = @DEFVALIDFILEMEMBACKENDS@
-
-# -pflash can add image file to VM. The arguments of it should be in format
-# of ["/path/to/flash0.img", "/path/to/flash1.img"]
-pflashes = []
-
-# This option changes the default hypervisor and kernel parameters
-# to enable debug output where available.
-#
-# Default false
-enable_debug = false
-
-# This option allows to add an extra HMP or QMP socket when `enable_debug = true`
-#
-# WARNING: Anyone with access to the extra socket can take full control of
-# Qemu. This is for debugging purpose only and must *NEVER* be used in
-# production.
-#
-# Valid values are :
-# - "hmp"
-# - "qmp"
-# - "qmp-pretty" (same as "qmp" with pretty json formatting)
-#
-# If set to the empty string "", no extra monitor socket is added. This is
-# the default.
-extra_monitor_socket = ""
-
-# Disable the customizations done in the runtime when it detects
-# that it is running on top a VMM. This will result in the runtime
-# behaving as it would when running on bare metal.
-#
-# Default false
-disable_nesting_checks = false
-
-# This is the msize used for 9p shares. It is the number of bytes
-# used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
-
-# If false and nvdimm is supported, use nvdimm device to plug guest image.
-# Otherwise virtio-block device is used.
-#
-# nvdimm is not supported when `confidential_guest = true`.
-#
-# Default is false
-disable_image_nvdimm = false
-
-# VFIO devices are hotplugged on a bridge by default.
-# Enable hotplugging on root bus. This may be required for devices with
-# a large PCI bar, as this is a current limitation with hotplugging on
-# a bridge.
-# Default false
-hotplug_vfio_on_root_bus = false
-
-# Enable hot-plugging of VFIO devices to a bridge-port,
-# root-port or switch-port.
-# The default setting is  "no-port"
-hot_plug_vfio = "no-port"
-
-# In a confidential compute environment hot-plugging can compromise
-# security.
-# Enable cold-plugging of VFIO devices to a bridge-port,
-# root-port or switch-port.
-# The default setting is  "no-port", which means disabled.
-cold_plug_vfio = "no-port"
-
-# Before hot plugging a PCIe device, you need to add a pcie_root_port device.
-# Use this parameter when using some large PCI bar devices, such as Nvidia GPU
-# The value means the number of pcie_root_port
-# This value is valid when hotplug_vfio_on_root_bus is true and machine_type is "q35"
-# Default 0
-pcie_root_port = 0
-
-# Before hot plugging a PCIe device onto a switch port, you need add a pcie_switch_port device fist.
-# Use this parameter when using some large PCI bar devices, such as Nvidia GPU
-# The value means how many devices attached onto pcie_switch_port will be created.
-# This value is valid when hotplug_vfio_on_root_bus is true, and machine_type is "q35"
-# Default 0
-pcie_switch_port = 0
-
-# If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
-# security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
-
-#
-# Default entropy source.
-# The path to a host source of entropy (including a real hardware RNG)
-# /dev/urandom and /dev/random are two main options.
-# Be aware that /dev/random is a blocking source of entropy.  If the host
-# runs out of entropy, the VMs boot time will increase leading to get startup
-# timeouts.
-# The source of entropy /dev/urandom is non-blocking and provides a
-# generally acceptable source of entropy. It should work well for pretty much
-# all practical purposes.
-entropy_source =  "@DEFENTROPYSOURCE@"
-
-# List of valid annotations values for entropy_source
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDENTROPYSOURCES@
-valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
-
-# Path to OCI hook binaries in the *guest rootfs*.
-# This does not affect host-side hooks which must instead be added to
-# the OCI spec passed to the runtime.
-#
-# You can create a rootfs with hooks by customizing the osbuilder scripts:
-# https://github.com/kata-containers/kata-containers/tree/main/tools/osbuilder
-#
-# Hooks must be stored in a subdirectory of guest_hook_path according to their
-# hook type, i.e. "guest_hook_path/{prestart,poststart,poststop}".
-# The agent will scan these directories for executable files and add them, in
-# lexicographical order, to the lifecycle of the guest container.
-# Hooks are executed in the runtime namespace of the guest. See the official documentation:
-# https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
-# Warnings will be logged if any error is encountered while scanning for hooks,
-# but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
-
-#
-# Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
-# In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
-# Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
-# Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
-# In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
-# to discipline traffic.
-# Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
-
-# Set where to save the guest memory dump file.
-# If set, when GUEST_PANICKED event occurred,
-# guest memeory will be dumped to host filesystem under guest_memory_dump_path,
-# This directory will be created automatically if it does not exist.
-#
-# The dumped file(also called vmcore) can be processed with crash or gdb.
-#
-# WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
-#   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
-
-# If enable paging.
-# Basically, if you want to use "gdb" rather than "crash",
-# or need the guest-virtual addresses in the ELF vmcore,
-# then you should enable paging.
-#
-# See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-#guest_memory_dump_paging=false
-
-# use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
-
-# disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
-
-# disable applying SELinux on the container process
-# If set to false, the type `container_t` is applied to the container process by default.
-# Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
-# with `SELINUX=yes`.
-# (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
-
-
-[factory]
-# VM templating support. Once enabled, new VMs are created from template
-# using vm cloning. They will share the same initial kernel, initramfs and
-# agent memory by mapping it readonly. It helps speeding up new container
-# creation and saves a lot of memory if there are many kata containers running
-# on the same host.
-#
-# When disabled, new VMs are created from scratch.
-#
-# Note: Requires "initrd=" to be set ("image=" is not supported).
-#
-# Default false
-enable_template = false
-
-# Specifies the path of template.
-#
-# Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
-
-[agent.@PROJECT_TYPE@]
-# If enabled, make the agent display debug-level messages.
-# (default: disabled)
-enable_debug = false
-
-# Enable agent tracing.
-#
-# If enabled, the agent will generate OpenTelemetry trace spans.
-#
-# Notes:
-#
-# - If the runtime also has tracing enabled, the agent spans will be
-#   associated with the appropriate runtime parent span.
-# - If enabled, the runtime will wait for the container to shutdown,
-#   increasing the container shutdown time slightly.
-#
-# (default: disabled)
-enable_tracing = false
-
-# Comma separated list of kernel modules and their parameters.
-# These modules will be loaded in the guest kernel using modprobe(8).
-# The following example can be used to load two kernel modules with parameters
-#  - kernel_modules=["e1000e InterruptThrottleRate=3000,3000,3000 EEE=1", "i915 enable_ppgtt=0"]
-# The first word is considered as the module name and the rest as its parameters.
-# Container will not be started when:
-#  * A kernel module is specified and the modprobe command is not installed in the guest
-#    or it fails loading the module.
-#  * The module is not available in the guest or it doesn't met the guest kernel
-#    requirements, like architecture and version.
-#
-kernel_modules = []
-
-# Enable debug console.
-
-# If enabled, user can connect guest OS running inside hypervisor
-# through "kata-runtime exec <sandbox-id>" command
-
-debug_console_enabled = false
-
-# Agent dial timeout in millisecond.
-# (default: 10)
-dial_timeout_ms = 10
-
-# Agent reconnect timeout in millisecond.
-# Retry times = reconnect_timeout_ms / dial_timeout_ms (default: 300)
-# If you find pod cannot connect to the agent when starting, please
-# consider increasing this value to increase the retry times.
-# You'd better not change the value of dial_timeout_ms, unless you have an
-# idea of what you are doing.
-# (default: 3000)
-reconnect_timeout_ms = 3000
-
-# Create Container Request Timeout
-# This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
-# It's also used to ensure that workloads, especially those involving large image pulls within the guest,
-# have sufficient time to become ready.
-#
-# Effective Timeout Determination:
-# The effective timeout for a CreateContainerRequest is determined by taking the minimum of the following two values:
-# - create_container_timeout: The timeout value configured for creating containers (default: 30 seconds).
-# - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
-# (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
-# Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
-
-[agent.@PROJECT_TYPE@.mem_agent]
-# Control the mem-agent function enable or disable.
-# Default to false
-mem_agent_enable = false
-
-# Control the mem-agent memcg function disable or enable
-# Default to false
-memcg_disable = false
-
-# Control the mem-agent function swap enable or disable.
-# Default to false
-memcg_swap = false
-
-# Control the mem-agent function swappiness max number.
-# Default to 50
-memcg_swappiness_max = 50
-
-# Control the mem-agent memcg function wait period seconds
-# Default to 600
-memcg_period_secs = 600
-
-# Control the mem-agent memcg wait period PSI percent limit.
-# If the percentage of memory and IO PSI stall time within
-# the memcg waiting period for a cgroup exceeds this value,
-# then the aging and eviction for this cgroup will not be
-# executed after this waiting period.
-# Default to 1
-memcg_period_psi_percent_limit = 1
-
-# Control the mem-agent memcg eviction PSI percent limit.
-# If the percentage of memory and IO PSI stall time for a cgroup
-# exceeds this value during an eviction cycle, the eviction for
-# this cgroup will immediately stop and will not resume until
-# the next memcg waiting period.
-# Default to 1
-memcg_eviction_psi_percent_limit = 1
-
-# Control the mem-agent memcg eviction run aging count min.
-# A cgroup will only perform eviction when the number of aging cycles
-# in memcg is greater than or equal to memcg_eviction_run_aging_count_min.
-# Default to 3
-memcg_eviction_run_aging_count_min = 3
-
-# Control the mem-agent compact function disable or enable
-# Default to false
-compact_disable = false
-
-# Control the mem-agent compaction function wait period seconds
-# Default to 600
-compact_period_secs = 600
-
-# Control the mem-agent compaction function wait period PSI percent limit.
-# If the percentage of memory and IO PSI stall time within
-# the compaction waiting period exceeds this value,
-# then the compaction will not be executed after this waiting period.
-# Default to 1
-compact_period_psi_percent_limit = 1
-
-# Control the mem-agent compaction function compact PSI percent limit.
-# During compaction, the percentage of memory and IO PSI stall time
-# is checked every second. If this percentage exceeds
-# compact_psi_percent_limit, the compaction process will stop.
-# Default to 5
-compact_psi_percent_limit = 5
-
-# Control the maximum number of seconds for each compaction of mem-agent compact function.
-# Default to 180
-compact_sec_max = 180
-
-# Control the mem-agent compaction function compact order.
-# compact_order is use with compact_threshold.
-# Default to 9
-compact_order = 9
-
-# Control the mem-agent compaction function compact threshold.
-# compact_threshold is the pages number.
-# When examining the /proc/pagetypeinfo, if there's an increase in the
-# number of movable pages of orders smaller than the compact_order
-# compared to the amount following the previous compaction,
-# and this increase surpasses a certain threshold—specifically,
-# more than 'compact_threshold' number of pages.
-# Or the number of free pages has decreased by 'compact_threshold'
-# since the previous compaction.
-# then the system should initiate another round of memory compaction.
-# Default to 1024
-compact_threshold = 1024
-
-# Control the mem-agent compaction function force compact times.
-# After one compaction, if there has not been a compaction within
-# the next compact_force_times times, a compaction will be forced
-# regardless of the system's memory situation.
-# If compact_force_times is set to 0, will do force compaction each time.
-# If compact_force_times is set to 9223372036854775807, will never do force compaction.
-# Default to 9223372036854775807
-compact_force_times = 9223372036854775807
-
-# Create Container Request Timeout
-# This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
-# It's also used to ensure that workloads, especially those involving large image pulls within the guest,
-# have sufficient time to complete.
-#
-# Effective Timeout Determination:
-# The effective timeout for a CreateContainerRequest is determined by taking the minimum of the following two values:
-# - create_container_timeout: The timeout value configured for creating containers (default: @DEFCREATECONTAINERTIMEOUT_COCO@ seconds).
-# - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
-# (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
-# Defaults to @DEFCREATECONTAINERTIMEOUT_COCO@ second(s)
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT_COCO@
-
-[runtime]
-# If enabled, the runtime will log additional debug messages to the
-# system log
-# (default: disabled)
-enable_debug = false
-
-#
-# Internetworking model
-# Determines how the VM should be connected to the
-# the container network interface
-# Options:
-#
-#   - macvtap
-#     Used when the Container network interface can be bridged using
-#     macvtap.
-#
-#   - none
-#     Used when customize network. Only creates a tap device. No veth pair.
-#
-#   - tcfilter
-#     Uses tc filter rules to redirect traffic from the network interface
-#     provided by plugin to a tap interface connected to the VM.
-#
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
-
-name = "@RUNTIMENAME@"
-hypervisor_name = "@HYPERVISOR_QEMU@"
-agent_name = "@PROJECT_TYPE@"
-
-# disable guest seccomp
-# Determines whether container seccomp profiles are passed to the virtual
-# machine and applied by the kata agent. If set to true, seccomp is not applied
-# within the guest
-# (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
-
-# vCPUs pinning settings
-# if enabled, each vCPU thread will be scheduled to a fixed CPU
-# qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
-
-# Apply a custom SELinux security policy to the container process inside the VM.
-# This is used when you want to apply a type other than the default `container_t`,
-# so general users should not uncomment and apply it.
-# (format: "user:role:type")
-# Note: You cannot specify MCS policy with the label because the sensitivity levels and
-# categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
-
-# If enabled, the runtime will create opentracing.io traces and spans.
-# (See https://www.jaegertracing.io/docs/getting-started).
-# (default: disabled)
-enable_tracing = false
-
-# Set the full url to the Jaeger HTTP Thrift collector.
-# The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
-
-# Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
-
-# Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
-
-# If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
-# This option may have some potential impacts to your host. It should only be used when you know what you're doing.
-# `disable_new_netns` conflicts with `internetworking_model=tcfilter` and `internetworking_model=macvtap`. It works only
-# with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
-# (like OVS) directly.
-# (default: false)
-disable_new_netns = false
-
-# if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
-# The container cgroups in the host are not created, just one single cgroup per sandbox.
-# The runtime caller is free to restrict or collect cgroup stats of the overall Kata sandbox.
-# The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
-# The sandbox cgroup is constrained if there is no container type annotation.
-# See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_QEMU@
-
-# If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
-# this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
-# when a hardware architecture or hypervisor solutions is utilized which does not support CPU and/or memory hotplug.
-# Compatibility for determining appropriate sandbox (VM) size:
-# - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
-#   does not yet support sandbox sizing annotations.
-# - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_COCO@
-
-# If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
-# This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
-# If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
-# These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
-
-# VFIO Mode
-# Determines how VFIO devices should be be presented to the container.
-# Options:
-#
-#  - vfio
-#    Matches behaviour of OCI runtimes (e.g. runc) as much as
-#    possible.  VFIO devices will appear in the container as VFIO
-#    character devices under /dev/vfio.  The exact names may differ
-#    from the host (they need to match the VM's IOMMU group numbers
-#    rather than the host's)
-#
-#  - guest-kernel
-#    This is a Kata-specific behaviour that's useful in certain cases.
-#    The VFIO device is managed by whatever driver in the VM kernel
-#    claims it.  This means it will appear as one or more device nodes
-#    or network interfaces depending on the nature of the device.
-#    Using this mode requires specially built workloads that know how
-#    to locate the relevant device interfaces within the VM.
-#
-vfio_mode = "@DEFVFIOMODE@"
-
-# If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
-# be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
-
-# Enabled experimental feature list, format: ["a", "b"].
-# Experimental features are features not stable enough for production,
-# they may break compatibility, and are prepared for a big version bump.
-# Supported experimental features:
-# (default: [])
-experimental = @DEFAULTEXPFEATURES@
-
-# If enabled, user can run pprof tools with shim v2 process through kata-monitor.
-# (default: false)
-enable_pprof = false

src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in

@@ -16,22 +16,45 @@
 path = "@QEMUPATH@"
 kernel = "@KERNELPATH_QEMU@"
 image = "@IMAGEPATH@"
+# initrd = "@INITRDPATH@"
 machine_type = "@MACHINETYPE@"
 
 # rootfs filesystem type:
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 
 # Block storage driver to be used for the VM rootfs is backed
 # by a block device. This is virtio-blk-pci, virtio-blk-mmio or nvdimm
 vm_rootfs_driver = "@VMROOTFSDRIVER_QEMU@"
 
+# Enable confidential guest support.
+# Toggling that setting may trigger different hardware features, ranging
+# from memory encryption to both memory and CPU-state encryption and integrity.
+# The Kata Containers runtime dynamically detects the available feature set and
+# aims at enabling the largest possible one, returning an error if none is
+# available, or none is supported by the hypervisor.
+#
+# Known limitations:
+# * Does not work by design:
+#   - CPU Hotplug 
+#   - Memory Hotplug
+#   - NVDIMM devices
+#
+# Default false
+# confidential_guest = true
+
+# Choose AMD SEV-SNP confidential guests
+# In case of using confidential guests on AMD hardware that supports both SEV
+# and SEV-SNP, the following enables SEV-SNP guests. SEV guests are default.
+# Default false
+# sev_snp_guest = true
+
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -69,7 +92,7 @@ firmware_volume = "@FIRMWAREVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -77,13 +100,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -129,7 +151,7 @@ default_bridges = @DEFBRIDGES@
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Default memory size in MiB for SB/VM.
 # If unspecified then it will be set @DEFMEMSZ@ MiB.
@@ -138,7 +160,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -151,13 +173,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -240,17 +262,17 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
 # handled in a separate IO thread. This is currently only implemented
@@ -258,12 +280,6 @@ block_device_cache_noflush = false
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Virtio queue size. Size: byte. default 128
-queue_size = 128
-
-# Block device multi-queue, default 1
-num_queues = 1
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -271,7 +287,7 @@ num_queues = 1
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -279,7 +295,7 @@ enable_mem_prealloc = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -296,11 +312,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -316,7 +332,7 @@ vhost_user_reconnect_timeout_sec = 0
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -331,7 +347,7 @@ pflashes = []
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # This option allows to add an extra HMP or QMP socket when `enable_debug = true`
 #
@@ -346,17 +362,17 @@ enable_debug = false
 #
 # If set to the empty string "", no extra monitor socket is added. This is
 # the default.
-extra_monitor_socket = ""
+#extra_monitor_socket = "hmp"
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -364,44 +380,44 @@ msize_9p = @DEFMSIZE9P@
 # nvdimm is not supported when `confidential_guest = true`.
 #
 # Default is false
-disable_image_nvdimm = false
+#disable_image_nvdimm = true
 
 # VFIO devices are hotplugged on a bridge by default.
 # Enable hotplugging on root bus. This may be required for devices with
 # a large PCI bar, as this is a current limitation with hotplugging on
 # a bridge.
 # Default false
-hotplug_vfio_on_root_bus = false
+#hotplug_vfio_on_root_bus = true
 
 # Enable hot-plugging of VFIO devices to a bridge-port, 
 # root-port or switch-port. 
 # The default setting is  "no-port"
-hot_plug_vfio = "no-port"
+#hot_plug_vfio = "root-port" 
 
 # In a confidential compute environment hot-plugging can compromise
 # security. 
 # Enable cold-plugging of VFIO devices to a bridge-port, 
 # root-port or switch-port. 
 # The default setting is  "no-port", which means disabled. 
-cold_plug_vfio = "no-port"
+#cold_plug_vfio = "root-port" 
 
 # Before hot plugging a PCIe device, you need to add a pcie_root_port device.
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # This value is valid when hotplug_vfio_on_root_bus is true and machine_type is "q35"
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # Before hot plugging a PCIe device onto a switch port, you need add a pcie_switch_port device fist.
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means how many devices attached onto pcie_switch_port will be created.
 # This value is valid when hotplug_vfio_on_root_bus is true, and machine_type is "q35"
 # Default 0
-pcie_switch_port = 0
+#pcie_switch_port = 2
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -413,7 +429,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source =  "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -435,8 +451,7 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 
 # Enable connection to Quote Generation Service (QGS)
 # The "tdx_quote_generation_service_socket_port" parameter configures how QEMU connects to the TDX Quote Generation Service (QGS).
@@ -447,18 +462,18 @@ guest_hook_path = ""
 # It's important to note that setting "tdx_quote_generation_service_socket_port" to 0 enables communication via Unix Domain Sockets (UDS).
 # To activate UDS, the QGS service itself must be launched with the "-port=0" parameter and the UDS will always be located at /var/run/tdx-qgs/qgs.socket.
 # -object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"unix","path":"/var/run/tdx-qgs/qgs.socket"}}'
-tdx_quote_generation_service_socket_port = @QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT@
+# tdx_quote_generation_service_socket_port = @QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT@
 
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -468,10 +483,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -479,20 +493,20 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [hypervisor.qemu.factory]
@@ -507,17 +521,41 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
+
+# The number of caches of VMCache:
+# unspecified or == 0   --> VMCache is disabled
+# > 0                   --> will be set to the specified number
+#
+# VMCache is a function that creates VMs as caches before using it.
+# It helps speed up new container creation.
+# The function consists of a server and some clients communicating
+# through Unix socket.  The protocol is gRPC in protocols/cache/cache.proto.
+# The VMCache server will create some VMs and cache them by factory cache.
+# It will convert the VM to gRPC format and transport it when gets
+# requestion from clients.
+# Factory grpccache is the VMCache client.  It will request gRPC format
+# VM and convert it back to a VM.  If VMCache function is enabled,
+# kata-runtime will request VM from factory grpccache when it creates
+# a new sandbox.
+#
+# Default 0
+#vm_cache_number = 0
+
+# Specify the address of the Unix socket that is used by VMCache.
+#
+# Default /var/run/kata-containers/cache.sock
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -531,7 +569,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -544,18 +582,18 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent dial timeout in millisecond.
 # (default: 10)
-dial_timeout_ms = 10
+#dial_timeout_ms = 10
 
 # Agent reconnect timeout in millisecond.
 # Retry times = reconnect_timeout_ms / dial_timeout_ms (default: 300)
@@ -564,28 +602,28 @@ dial_timeout_ms = 10
 # You'd better not change the value of dial_timeout_ms, unless you have an
 # idea of what you are doing.
 # (default: 3000)
-reconnect_timeout_ms = 3000
+#reconnect_timeout_ms = 3000
 
 [agent.@PROJECT_TYPE@.mem_agent]
 # Control the mem-agent function enable or disable.
 # Default to false
-mem_agent_enable = false
+#mem_agent_enable = true
 
 # Control the mem-agent memcg function disable or enable
 # Default to false
-memcg_disable = false
+#memcg_disable = false
 
 # Control the mem-agent function swap enable or disable.
 # Default to false
-memcg_swap = false
+#memcg_swap = false
 
 # Control the mem-agent function swappiness max number.
 # Default to 50
-memcg_swappiness_max = 50
+#memcg_swappiness_max = 50
 
 # Control the mem-agent memcg function wait period seconds
 # Default to 600
-memcg_period_secs = 600
+#memcg_period_secs = 600
 
 # Control the mem-agent memcg wait period PSI percent limit.
 # If the percentage of memory and IO PSI stall time within
@@ -593,7 +631,7 @@ memcg_period_secs = 600
 # then the aging and eviction for this cgroup will not be
 # executed after this waiting period.
 # Default to 1
-memcg_period_psi_percent_limit = 1
+#memcg_period_psi_percent_limit = 1
 
 # Control the mem-agent memcg eviction PSI percent limit.
 # If the percentage of memory and IO PSI stall time for a cgroup
@@ -601,44 +639,44 @@ memcg_period_psi_percent_limit = 1
 # this cgroup will immediately stop and will not resume until
 # the next memcg waiting period.
 # Default to 1
-memcg_eviction_psi_percent_limit = 1
+#memcg_eviction_psi_percent_limit = 1
 
 # Control the mem-agent memcg eviction run aging count min.
 # A cgroup will only perform eviction when the number of aging cycles
 # in memcg is greater than or equal to memcg_eviction_run_aging_count_min.
 # Default to 3
-memcg_eviction_run_aging_count_min = 3
+#memcg_eviction_run_aging_count_min = 3
 
 # Control the mem-agent compact function disable or enable
 # Default to false
-compact_disable = false
+#compact_disable = false
 
 # Control the mem-agent compaction function wait period seconds
 # Default to 600
-compact_period_secs = 600
+#compact_period_secs = 600
 
 # Control the mem-agent compaction function wait period PSI percent limit.
 # If the percentage of memory and IO PSI stall time within
 # the compaction waiting period exceeds this value,
 # then the compaction will not be executed after this waiting period.
 # Default to 1
-compact_period_psi_percent_limit = 1
+#compact_period_psi_percent_limit = 1
 
 # Control the mem-agent compaction function compact PSI percent limit.
 # During compaction, the percentage of memory and IO PSI stall time
 # is checked every second. If this percentage exceeds
 # compact_psi_percent_limit, the compaction process will stop.
 # Default to 5
-compact_psi_percent_limit = 5
+#compact_psi_percent_limit = 5
 
 # Control the maximum number of seconds for each compaction of mem-agent compact function.
-# Default to 300
-compact_sec_max = 300
+# Default to 180
+#compact_sec_max = 180
 
 # Control the mem-agent compaction function compact order.
 # compact_order is use with compact_threshold.
 # Default to 9
-compact_order = 9
+#compact_order = 9
 
 # Control the mem-agent compaction function compact threshold.
 # compact_threshold is the pages number.
@@ -651,7 +689,7 @@ compact_order = 9
 # since the previous compaction.
 # then the system should initiate another round of memory compaction.
 # Default to 1024
-compact_threshold = 1024
+#compact_threshold = 1024
 
 # Control the mem-agent compaction function force compact times.
 # After one compaction, if there has not been a compaction within
@@ -660,9 +698,7 @@ compact_threshold = 1024
 # If compact_force_times is set to 0, will do force compaction each time.
 # If compact_force_times is set to 18446744073709551615, will never do force compaction.
 # Default to 18446744073709551615
-# Note: Using a large but valid u64 value (within i64::MAX range) instead of u64::MAX to avoid TOML parser issues
-# Using 9223372036854775807 (i64::MAX) which is effectively "never" for practical purposes
-compact_force_times = 9223372036854775807
+#compact_force_times = 18446744073709551615
 
 # Create Container Request Timeout
 # This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
@@ -675,14 +711,14 @@ compact_force_times = 9223372036854775807
 # - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
 # (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
 # Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
+# create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
-
+#enable_debug = true
+#
 # Internetworking model
 # Determines how the VM should be connected to the
 # the container network interface
@@ -699,23 +735,23 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
-name = "@RUNTIMENAME@"
-hypervisor_name = "@HYPERVISOR_QEMU@"
-agent_name = "@PROJECT_TYPE@"
+name="@RUNTIMENAME@"
+hypervisor_name="@HYPERVISOR_QEMU@"
+agent_name="@PROJECT_TYPE@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -723,23 +759,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -747,7 +782,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -755,7 +790,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_QEMU@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_QEMU@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -764,13 +799,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_QEMU@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_QEMU@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_QEMU@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -791,19 +826,19 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true

src/runtime-rs/config/configuration-qemu-se-runtime-rs.toml.in

@@ -40,7 +40,7 @@ confidential_guest = true
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -78,7 +78,7 @@ firmware_volume = "@FIRMWAREVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -86,13 +86,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -137,7 +136,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -150,13 +149,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -239,17 +238,17 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
 # handled in a separate IO thread. This is currently only implemented
@@ -257,12 +256,6 @@ block_device_cache_noflush = false
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Virtio queue size. Size: byte. default 128
-queue_size = 128
-
-# Block device multi-queue, default 1
-num_queues = 1
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -270,7 +263,7 @@ num_queues = 1
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -278,7 +271,7 @@ enable_mem_prealloc = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -295,11 +288,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -310,7 +303,7 @@ valid_vhost_user_store_paths = @DEFVALIDVHOSTUSERSTOREPATHS@
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -325,17 +318,17 @@ pflashes = []
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -343,33 +336,33 @@ msize_9p = @DEFMSIZE9P@
 # nvdimm is not supported when `confidential_guest = true`.
 #
 # Default is false
-disable_image_nvdimm = false
+#disable_image_nvdimm = true
 
 # Enable hot-plugging of VFIO devices to a bridge-port,
 # root-port or switch-port.
 # The default setting is "no-port"
-hot_plug_vfio = "no-port"
+#hot_plug_vfio = "root-port"
 
 # In a confidential compute environment hot-plugging can compromise
 # security.
 # Enable cold-plugging of VFIO devices to a bridge-port,
 # root-port or switch-port.
 # The default setting is "no-port", which means disabled.
-cold_plug_vfio = "no-port"
+cold_plug_vfio = "root-port"
 
 # VFIO devices are hotplugged on a bridge by default.
 # Enable hotplugging on root bus. This may be required for devices with
 # a large PCI bar, as this is a current limitation with hotplugging on
 # a bridge.
 # Default false
-hotplug_vfio_on_root_bus = false
+#hotplug_vfio_on_root_bus = true
 
 # Before hot plugging a PCIe device, you need to add a pcie_root_port device.
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # This value is valid when hotplug_vfio_on_root_bus is true and machine_type is "q35"
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
@@ -385,7 +378,7 @@ disable_vhost_net = true
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source =  "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -407,18 +400,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
-
+#guest_hook_path = "/usr/share/oci/hooks"
+#
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -428,10 +420,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -439,7 +430,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -450,20 +441,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -478,17 +469,41 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
+
+# The number of caches of VMCache:
+# unspecified or == 0   --> VMCache is disabled
+# > 0                   --> will be set to the specified number
+#
+# VMCache is a function that creates VMs as caches before using it.
+# It helps speed up new container creation.
+# The function consists of a server and some clients communicating
+# through Unix socket.  The protocol is gRPC in protocols/cache/cache.proto.
+# The VMCache server will create some VMs and cache them by factory cache.
+# It will convert the VM to gRPC format and transport it when gets
+# requestion from clients.
+# Factory grpccache is the VMCache client.  It will request gRPC format
+# VM and convert it back to a VM.  If VMCache function is enabled,
+# kata-runtime will request VM from factory grpccache when it creates
+# a new sandbox.
+#
+# Default 0
+#vm_cache_number = 0
+
+# Specify the address of the Unix socket that is used by VMCache.
+#
+# Default /var/run/kata-containers/cache.sock
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -502,7 +517,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -515,14 +530,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent dial timeout in millisecond.
 # (default: 10)
@@ -548,14 +563,14 @@ reconnect_timeout_ms = 5000
 # - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
 # (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
 # Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
+# create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
-
+#enable_debug = true
+#
 # Internetworking model
 # Determines how the VM should be connected to the
 # the container network interface
@@ -572,23 +587,23 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
-name = "@RUNTIMENAME@"
-hypervisor_name = "@HYPERVISOR_QEMU@"
-agent_name = "@PROJECT_TYPE@"
+name="@RUNTIMENAME@"
+hypervisor_name="@HYPERVISOR_QEMU@"
+agent_name="@PROJECT_TYPE@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -596,23 +611,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -620,7 +634,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -628,7 +642,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_QEMU@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_QEMU@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -637,13 +651,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_QEMU@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_QEMU@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_QEMU@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -664,19 +678,19 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE_SE@"
+vfio_mode="@DEFVFIOMODE_SE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true

src/runtime-rs/config/configuration-remote.toml.in

@@ -19,6 +19,24 @@ remote_hypervisor_socket = "/run/peerpod/hypervisor.sock"
 # Timeout in seconds for creating a remote hypervisor, 600s(10min) by default
 remote_hypervisor_timeout = 600
 
+
+# Enable confidential guest support.
+# Toggling that setting may trigger different hardware features, ranging
+# from memory encryption to both memory and CPU-state encryption and integrity.
+# The Kata Containers runtime dynamically detects the available feature set and
+# aims at enabling the largest possible one, returning an error if none is
+# available, or none is supported by the hypervisor.
+#
+# Known limitations:
+# * Does not work by design:
+#   - CPU Hotplug
+#   - Memory Hotplug
+#   - NVDIMM devices
+#
+# Default false
+# confidential_guest = true
+
+
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
 # of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
@@ -36,7 +54,7 @@ enable_annotations = ["machine_type", "default_memory", "default_vcpus", "defaul
 # To see the list of default parameters, enable hypervisor debug, create a
 # container and look for 'default-kernel-parameters' log entries.
 # NOTE: kernel_params are not currently passed over in remote hypervisor
-kernel_params = ""
+# kernel_params = ""
 
 # Path to the firmware.
 # If you want that qemu uses the default firmware leave this option empty
@@ -47,7 +65,7 @@ firmware = "@FIRMWAREPATH@"
 # < 0                             --> will be set to the actual number of physical cores
 # > 0 <= number of physical cores --> will be set to the specified number
 # > number of physical cores      --> will be set to the actual number of physical cores
-default_vcpus = 1
+# default_vcpus = 1
 
 # Default maximum number of vCPUs per SB/VM:
 # unspecified or == 0             --> will be set to the actual number of physical cores or to the maximum number
@@ -64,7 +82,7 @@ default_vcpus = 1
 # vCPUs supported by the SB/VM. In general, we recommend that you do not edit this variable,
 # unless you know what are you doing.
 # NOTICE: on arm platform with gicv2 interrupt controller, set it to 8.
-default_maxvcpus = @DEFMAXVCPUS@
+# default_maxvcpus = @DEFMAXVCPUS@
 
 # Bridges can be used to hot plug devices.
 # Limitations:
@@ -81,19 +99,19 @@ default_bridges = @DEFBRIDGES@
 # Default memory size in MiB for SB/VM.
 # If unspecified then it will be set @DEFMEMSZ@ MiB.
 # Note: the remote hypervisor uses the peer pod config to determine the memory of the VM
-default_memory = @DEFMEMSZ@
+# default_memory = @DEFMEMSZ@
 #
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
 # Note: the remote hypervisor uses the peer pod config to determine the memory of the VM
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # This option changes the default hypervisor and kernel parameters
 # to enable debug output where available. And Debug also enable the hmp socket.
 #
 # Default false
-enable_debug = false
+# enable_debug = true
 
 # Path to OCI hook binaries in the *guest rootfs*.
 # This does not affect host-side hooks which must instead be added to
@@ -110,11 +128,10 @@ enable_debug = false
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
@@ -127,7 +144,7 @@ disable_guest_selinux = true
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+# enable_debug = true
 
 # Enable agent tracing.
 #
@@ -141,18 +158,18 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+# enable_tracing = true
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 30)
-dial_timeout = 30
+#dial_timeout = 30
 
 # Create Container Request Timeout
 # This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
@@ -165,13 +182,13 @@ dial_timeout = 30
 # - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
 # (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
 # Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
+# create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+# enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -190,11 +207,11 @@ enable_debug = false
 #     provided by plugin to a tap interface connected to the VM.
 #
 # Note: The remote hypervisor, uses it's own network, so "none" is required
-internetworking_model = "none"
+internetworking_model="none"
 
-name = "virt_container"
-hypervisor_name = "remote"
-agent_name = "kata"
+name="virt_container"
+hypervisor_name="remote"
+agent_name="kata"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
@@ -202,7 +219,7 @@ agent_name = "kata"
 # within the guest
 # (default: true)
 # Note: The remote hypervisor has a different guest, so currently requires this to be set to true
-disable_guest_seccomp = true
+disable_guest_seccomp=true
 
 
 # Apply a custom SELinux security policy to the container process inside the VM.
@@ -211,23 +228,22 @@ disable_guest_seccomp = true
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -244,7 +260,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_REMOTE@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_REMOTE@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -254,7 +270,7 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_REMOTE@
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
 # Note: the remote hypervisor uses the peer pod config to determine the sandbox size, so requires this to be set to true
-static_sandbox_resource_mgmt = true
+static_sandbox_resource_mgmt=true
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -275,20 +291,20 @@ static_sandbox_resource_mgmt = true
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
 # Note: remote hypervisor has no sharing of emptydir mounts from host to guest
-disable_guest_empty_dir = false
+disable_guest_empty_dir=false
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true

src/runtime-rs/config/configuration-rs-fc.toml.in

@@ -16,7 +16,7 @@ path = "@FCPATH@"
 kernel = "@KERNELPATH_FC@"
 image = "@IMAGEPATH@"
 
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
 # of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
@@ -32,7 +32,7 @@ valid_hypervisor_paths = @FCVALIDHYPERVISORPATHS@
 # If the jailer path is not set kata will launch firecracker
 # without a jail. If the jailer is set firecracker will be
 # launched in a jailed enviornment created by the jailer
-jailer_path = "@FCJAILERPATH@"
+#jailer_path = "@FCJAILERPATH@"
 
 # List of valid jailer path values for the hypervisor
 # Each member of the list can be a regular expression
@@ -104,7 +104,7 @@ memory_slots = @DEFMEMSLOTS@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -121,12 +121,12 @@ block_device_driver = "@DEFBLOCKSTORAGEDRIVER_FC@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Bandwidth rate limiter options
 #
@@ -134,14 +134,14 @@ block_device_cache_noflush = false
 # for SB/VM).
 # The same value is used for inbound and outbound bandwidth.
 # Default 0-sized value means unlimited rate.
-disk_rate_limiter_bw_max_rate = 0
+#disk_rate_limiter_bw_max_rate = 0
 #
 # disk_rate_limiter_bw_one_time_burst increases the initial max rate and this
 # initial extra credit does *NOT* affect the overall limit and can be used for
 # an *initial* burst of data.
 # This is *optional* and only takes effect if disk_rate_limiter_bw_max_rate is
 # set to a non zero value.
-disk_rate_limiter_bw_one_time_burst = 0
+#disk_rate_limiter_bw_one_time_burst = 0
 #
 # Operation rate limiter options
 #
@@ -149,20 +149,14 @@ disk_rate_limiter_bw_one_time_burst = 0
 # for SB/VM).
 # The same value is used for inbound and outbound bandwidth.
 # Default 0-sized value means unlimited rate.
-disk_rate_limiter_ops_max_rate = 0
+#disk_rate_limiter_ops_max_rate = 0
 #
 # disk_rate_limiter_ops_one_time_burst increases the initial max rate and this
 # initial extra credit does *NOT* affect the overall limit and can be used for
 # an *initial* burst of data.
 # This is *optional* and only takes effect if disk_rate_limiter_bw_max_rate is
 # set to a non zero value.
-disk_rate_limiter_ops_one_time_burst = 0
-
-# Virtio queue size. Size: byte. default 128
-queue_size = 128
-
-# Block device multi-queue, default 1
-num_queues = 1
+#disk_rate_limiter_ops_one_time_burst = 0
 
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
@@ -171,7 +165,7 @@ num_queues = 1
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -179,40 +173,39 @@ enable_mem_prealloc = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Disable the 'seccomp' feature from Cloud Hypervisor, firecracker or dragonball, default false
-disable_seccomp = false
+# disable_seccomp = true
 
 # Enable vIOMMU, default false
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # This option changes the default hypervisor and kernel parameters
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-# Default false
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # VFIO devices are hotplugged on a bridge by default.
 # Enable hotplugging on root bus. This may be required for devices with
 # a large PCI bar, as this is a current limitation with hotplugging on
 # a bridge.
 # Default false
-hotplug_vfio_on_root_bus = false
+#hotplug_vfio_on_root_bus = true
 
 #
 # Default entropy source.
@@ -224,7 +217,7 @@ hotplug_vfio_on_root_bus = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source =  "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -246,22 +239,21 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered will scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Firecracker, it provides a built-in rate limiter, which is based on TBF(Token Bucket Filter)
 # queueing discipline.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Firecracker, it provides a built-in rate limiter, which is based on TBF(Token Bucket Filter)
 # queueing discipline.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 [factory]
 # VM templating support. Once enabled, new VMs are created from template
@@ -275,12 +267,12 @@ disable_selinux = @DEFDISABLESELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -294,7 +286,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -307,14 +299,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 45)
@@ -322,7 +314,7 @@ dial_timeout = 45
 
 # Confidential Data Hub API timeout value in seconds
 # (default: 50)
-cdh_api_timeout = 50
+#cdh_api_timeout = 50
 
 # Create Container Request Timeout
 # This timeout value is used to set the maximum duration for the agent to process a CreateContainerRequest.
@@ -335,14 +327,13 @@ cdh_api_timeout = 50
 # - runtime-request-timeout: The timeout value specified in the Kubelet configuration described as the link below:
 # (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout)
 # Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
+# create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
-
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -360,33 +351,33 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_FC@"
+internetworking_model="@DEFNETWORKMODEL_FC@"
 
-name = "@RUNTIMENAME@"
-hypervisor_name = "@HYPERVISOR_FC@"
-agent_name = "@PROJECT_TYPE@"
+name="@RUNTIMENAME@"
+hypervisor_name="@HYPERVISOR_FC@"
+agent_name="@PROJECT_TYPE@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -394,7 +385,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -402,7 +393,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_FC@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_FC@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -411,19 +402,19 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_FC@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_FC@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_FC@
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true

src/runtime-rs/crates/agent/src/kata/agent.rs

@@ -129,6 +129,5 @@ impl_agent!(
     get_metrics | crate::Empty | crate::MetricsResponse | None,
     get_guest_details | crate::GetGuestDetailsRequest | crate::GuestDetailsResponse | None,
     add_swap | crate::AddSwapRequest | crate::Empty | None,
-    add_swap_path | crate::AddSwapPathRequest | crate::Empty | None,
-    set_policy | crate::SetPolicyRequest | crate::Empty | None
+    add_swap_path | crate::AddSwapPathRequest | crate::Empty | None
 );

src/runtime-rs/crates/agent/src/kata/trans.rs

@@ -28,8 +28,7 @@ use crate::{
         VersionCheckResponse, VolumeStatsRequest, VolumeStatsResponse, WaitProcessRequest,
         WriteStreamRequest,
     },
-    GetGuestDetailsRequest, OomEventResponse, SetPolicyRequest, WaitProcessResponse,
-    WriteStreamResponse,
+    GetGuestDetailsRequest, OomEventResponse, WaitProcessResponse, WriteStreamResponse,
 };
 
 fn trans_vec<F: Sized + Clone, T: From<F>>(from: Vec<F>) -> Vec<T> {
@@ -745,15 +744,6 @@ impl From<GetGuestDetailsRequest> for agent::GuestDetailsRequest {
     }
 }
 
-impl From<SetPolicyRequest> for agent::SetPolicyRequest {
-    fn from(from: SetPolicyRequest) -> Self {
-        Self {
-            policy: from.policy,
-            ..Default::default()
-        }
-    }
-}
-
 impl From<agent::AgentDetails> for AgentDetails {
     fn from(src: agent::AgentDetails) -> Self {
         Self {

src/runtime-rs/crates/agent/src/lib.rs

@@ -33,8 +33,6 @@ use async_trait::async_trait;
 
 use kata_types::config::Agent as AgentConfig;
 
-use crate::types::SetPolicyRequest;
-
 pub const AGENT_KATA: &str = "kata";
 
 #[async_trait]
@@ -99,5 +97,4 @@ pub trait Agent: AgentManager + HealthService + Send + Sync {
     async fn get_guest_details(&self, req: GetGuestDetailsRequest) -> Result<GuestDetailsResponse>;
     async fn add_swap(&self, req: AddSwapRequest) -> Result<Empty>;
     async fn add_swap_path(&self, req: AddSwapPathRequest) -> Result<Empty>;
-    async fn set_policy(&self, req: SetPolicyRequest) -> Result<Empty>;
 }

src/runtime-rs/crates/agent/src/types.rs

@@ -615,11 +615,6 @@ pub struct AddSwapPathRequest {
     pub path: String,
 }
 
-#[derive(PartialEq, Clone, Default, Debug)]
-pub struct SetPolicyRequest {
-    pub policy: String,
-}
-
 #[cfg(test)]
 mod test {
     use std::convert::TryFrom;

src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs

@@ -2144,10 +2144,7 @@ mod tests {
 
     #[test]
     fn test_check_tdx_rootfs_settings() {
-        let sev_snp_details = SevSnpDetails {
-            cbitpos: 42,
-            phys_addr_reduction: 42,
-        };
+        let sev_snp_details = SevSnpDetails { cbitpos: 42 };
 
         #[derive(Debug)]
         struct TestData<'a> {

src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs

@@ -538,10 +538,7 @@ mod tests {
 
     #[test]
     fn test_guest_protection_is_tdx() {
-        let sev_snp_details = SevSnpDetails {
-            cbitpos: 42,
-            phys_addr_reduction: 42,
-        };
+        let sev_snp_details = SevSnpDetails { cbitpos: 42 };
 
         #[derive(Debug)]
         struct TestData {

src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs

@@ -25,7 +25,7 @@ use ch_config::ch_api::{
     cloud_hypervisor_vm_fs_add, cloud_hypervisor_vm_netdev_add_with_fds,
     cloud_hypervisor_vm_vsock_add, PciDeviceInfo, VmRemoveDeviceData,
 };
-use ch_config::convert::DEFAULT_NUM_PCI_SEGMENTS;
+use ch_config::convert::{DEFAULT_DISK_QUEUES, DEFAULT_DISK_QUEUE_SIZE, DEFAULT_NUM_PCI_SEGMENTS};
 use ch_config::DiskConfig;
 use ch_config::{net_util::MacAddr, DeviceConfig, FsConfig, NetConfig, VsockConfig};
 use kata_sys_util::netns::NetnsGuard;
@@ -542,8 +542,8 @@ impl TryFrom<BlockConfig> for DiskConfig {
         let disk_config: DiskConfig = DiskConfig {
             path: Some(blkcfg.path_on_host.as_str().into()),
             readonly: blkcfg.is_readonly,
-            num_queues: blkcfg.num_queues,
-            queue_size: blkcfg.queue_size as u16,
+            num_queues: DEFAULT_DISK_QUEUES,
+            queue_size: DEFAULT_DISK_QUEUE_SIZE,
             ..Default::default()
         };
 

src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs

@@ -1196,10 +1196,7 @@ mod tests {
         // available_guest_protection() requires super user privs.
         skip_if_not_root!();
 
-        let sev_snp_details = SevSnpDetails {
-            cbitpos: 42,
-            phys_addr_reduction: 42,
-        };
+        let sev_snp_details = SevSnpDetails { cbitpos: 42 };
 
         #[derive(Debug)]
         struct TestData {

src/runtime-rs/crates/hypervisor/src/device/driver/protection_device.rs

@@ -21,7 +21,6 @@ pub enum ProtectionDeviceConfig {
 pub struct SevSnpConfig {
     pub is_snp: bool,
     pub cbitpos: u32,
-    pub phys_addr_reduction: u32,
     pub firmware: String,
     pub host_data: Option<String>,
 }

src/runtime-rs/crates/hypervisor/src/device/driver/virtio_blk.rs

@@ -103,12 +103,6 @@ pub struct BlockConfig {
 
     /// device minor number
     pub minor: i64,
-
-    /// virtio queue size. size: byte
-    pub queue_size: u32,
-
-    /// block device multi-queue
-    pub num_queues: usize,
 }
 
 #[derive(Debug, Clone, Default)]

src/runtime-rs/crates/hypervisor/src/dragonball/inner.rs

@@ -233,7 +233,7 @@ impl DragonballInner {
         let vm_config = VmConfigInfo {
             serial_path: Some(serial_path),
             mem_size_mib: self.config.memory_info.default_memory as usize,
-            vcpu_count: self.config.cpu_info.default_vcpus.ceil() as u8,
+            vcpu_count: self.config.cpu_info.default_vcpus as u8,
             max_vcpu_count: self.config.cpu_info.default_maxvcpus as u8,
             mem_type,
             mem_file_path,

src/runtime-rs/crates/hypervisor/src/qemu/cmdline_generator.rs

@@ -335,7 +335,7 @@ struct Smp {
 impl Smp {
     fn new(config: &HypervisorConfig) -> Smp {
         Smp {
-            num_vcpus: config.cpu_info.default_vcpus.ceil() as u32,
+            num_vcpus: config.cpu_info.default_vcpus as u32,
             max_num_vcpus: config.cpu_info.default_maxvcpus,
         }
     }
@@ -1875,11 +1875,11 @@ struct ObjectSevSnpGuest {
 }
 
 impl ObjectSevSnpGuest {
-    fn new(is_snp: bool, cbitpos: u32, reduced_phys_bits: u32, host_data: Option<String>) -> Self {
+    fn new(is_snp: bool, cbitpos: u32, host_data: Option<String>) -> Self {
         ObjectSevSnpGuest {
             id: (if is_snp { "snp" } else { "sev" }).to_owned(),
             cbitpos,
-            reduced_phys_bits,
+            reduced_phys_bits: 1,
             kernel_hashes: true,
             host_data,
             is_snp,
@@ -2538,13 +2538,8 @@ impl<'a> QemuCmdLine<'a> {
             .remove_all_by_key("rootfstype".to_string());
     }
 
-    pub fn add_sev_protection_device(
-        &mut self,
-        cbitpos: u32,
-        phys_addr_reduction: u32,
-        firmware: &str,
-    ) {
-        let sev_object = ObjectSevSnpGuest::new(false, cbitpos, phys_addr_reduction, None);
+    pub fn add_sev_protection_device(&mut self, cbitpos: u32, firmware: &str) {
+        let sev_object = ObjectSevSnpGuest::new(true, cbitpos, None);
         self.devices.push(Box::new(sev_object));
 
         self.devices.push(Box::new(Bios::new(firmware.to_owned())));
@@ -2557,12 +2552,10 @@ impl<'a> QemuCmdLine<'a> {
     pub fn add_sev_snp_protection_device(
         &mut self,
         cbitpos: u32,
-        phys_addr_reduction: u32,
         firmware: &str,
         host_data: &Option<String>,
     ) {
-        let sev_snp_object =
-            ObjectSevSnpGuest::new(true, cbitpos, phys_addr_reduction, host_data.clone());
+        let sev_snp_object = ObjectSevSnpGuest::new(true, cbitpos, host_data.clone());
         self.devices.push(Box::new(sev_snp_object));
 
         self.devices.push(Box::new(Bios::new(firmware.to_owned())));

src/runtime-rs/crates/hypervisor/src/qemu/inner.rs

@@ -163,14 +163,12 @@ impl QemuInner {
                         if sev_snp_cfg.is_snp {
                             cmdline.add_sev_snp_protection_device(
                                 sev_snp_cfg.cbitpos,
-                                sev_snp_cfg.phys_addr_reduction,
                                 &sev_snp_cfg.firmware,
                                 &sev_snp_cfg.host_data,
                             )
                         } else {
                             cmdline.add_sev_protection_device(
                                 sev_snp_cfg.cbitpos,
-                                sev_snp_cfg.phys_addr_reduction,
                                 &sev_snp_cfg.firmware,
                             )
                         }

src/runtime-rs/crates/hypervisor/src/qemu/qmp.rs

@@ -488,7 +488,7 @@ impl Qmp {
         );
         netdev_frontend_args.insert("addr".to_owned(), format!("{:02}", slot).into());
         netdev_frontend_args.insert("mac".to_owned(), virtio_net_device.get_mac_addr().into());
-        netdev_frontend_args.insert("mq".to_owned(), true.into());
+        netdev_frontend_args.insert("mq".to_owned(), "on".into());
         // As the golang runtime documents the vectors computation, it's
         // 2N+2 vectors, N for tx queues, N for rx queues, 1 for config, and one for possible control vq
         netdev_frontend_args.insert(

src/runtime-rs/crates/hypervisor/src/remote/inner.rs

@@ -173,10 +173,7 @@ impl RemoteInner {
             ..Default::default()
         };
         info!(sl!(), "Preparing REMOTE VM req: {:?}", req.clone());
-        let resp = client
-            .create_vm(ctx, &req)
-            .await
-            .map_err(|e| anyhow::anyhow!("error creating VM: {e}"))?;
+        let resp = client.create_vm(ctx, &req).await?;
         info!(sl!(), "Preparing REMOTE VM resp: {:?}", resp.clone());
         self.agent_socket_path = resp.agentSocketPath;
         self.netns = netns;

src/runtime-rs/crates/hypervisor/src/utils.rs

@@ -359,16 +359,6 @@ pub fn megs_to_bytes(bytes: u32) -> u64 {
     bytes as u64 * (1 << 20)
 }
 
-#[allow(dead_code)]
-pub fn get_cmd_output(cmd: &str, args: &[&str]) -> Result<String> {
-    let mut cmd = std::process::Command::new(cmd);
-    if !args.is_empty() {
-        cmd.args(args);
-    }
-    let result = cmd.output()?;
-    Ok(String::from_utf8(result.stdout)?)
-}
-
 #[cfg(test)]
 mod tests {
     use std::fs;

src/runtime-rs/crates/resource/Cargo.toml

@@ -17,7 +17,7 @@ anyhow = { workspace = true }
 async-trait = { workspace = true }
 bitflags = "2.9.0"
 byte-unit = "5.1.6"
-cgroups-rs = { version = "0.5.0", features = ["oci"] }
+cgroups-rs = { version = "0.4.0", features = ["oci"] }
 futures = "0.3.11"
 lazy_static = { workspace = true }
 libc = { workspace = true }
@@ -35,7 +35,7 @@ uuid = { version = "0.4", features = ["v4"] }
 oci-spec = { workspace = true }
 inotify = "0.11.0"
 walkdir = "2.5.0"
-flate2 = "1.1"
+flate2 = { version = "1.0", features = ["zlib"] }
 tempfile = "3.19.1"
 hex = "0.4"
 

src/runtime-rs/crates/resource/src/manager_inner.rs

@@ -413,14 +413,17 @@ impl ResourceManagerInner {
         for d in linux_devices.iter() {
             match d.typ() {
                 LinuxDeviceType::B => {
-                    let blkdev_info = get_block_device_info(&self.device_manager).await;
+                    let block_driver = get_block_device_info(&self.device_manager)
+                        .await
+                        .block_device_driver;
+                    let aio = get_block_device_info(&self.device_manager)
+                        .await
+                        .block_device_aio;
                     let dev_info = DeviceConfig::BlockCfg(BlockConfig {
                         major: d.major(),
                         minor: d.minor(),
-                        driver_option: blkdev_info.block_device_driver,
-                        blkdev_aio: BlockDeviceAio::new(&blkdev_info.block_device_aio),
-                        num_queues: blkdev_info.num_queues,
-                        queue_size: blkdev_info.queue_size,
+                        driver_option: block_driver,
+                        blkdev_aio: BlockDeviceAio::new(&aio),
                         ..Default::default()
                     });
 

src/runtime-rs/crates/resource/src/volume/block_volume.rs

@@ -47,8 +47,6 @@ impl BlockVolume {
             minor: stat::minor(fstat.st_rdev) as i64,
             driver_option: blkdev_info.block_device_driver,
             blkdev_aio: BlockDeviceAio::new(&blkdev_info.block_device_aio),
-            num_queues: blkdev_info.num_queues,
-            queue_size: blkdev_info.queue_size,
             ..Default::default()
         };
 

src/runtime-rs/crates/resource/src/volume/direct_volumes/rawblock_volume.rs

@@ -62,8 +62,6 @@ impl RawblockVolume {
             path_on_host: mount_info.device.clone(),
             driver_option: blkdev_info.block_device_driver,
             blkdev_aio: BlockDeviceAio::new(&blkdev_info.block_device_aio),
-            num_queues: blkdev_info.num_queues,
-            queue_size: blkdev_info.queue_size,
             ..Default::default()
         };
 

src/runtime-rs/crates/resource/src/volume/ephemeral_volume.rs

@@ -73,7 +73,7 @@ impl EphemeralVolume {
         mount.set_destination(m.destination().clone());
         mount.set_typ(Some("bind".to_string()));
         mount.set_source(Some(PathBuf::from(&source)));
-        mount.set_options(m.options().clone());
+        mount.set_options(Some(vec!["rbind".to_string()]));
 
         Ok(Self {
             mount,

src/runtime-rs/crates/resource/src/volume/local_volume.rs

@@ -1,126 +0,0 @@
-// Copyright (c) 2025 Ant Group
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-use std::path::{Path, PathBuf};
-
-use crate::share_fs::{kata_guest_share_dir, PASSTHROUGH_FS_DIR};
-
-use super::Volume;
-use anyhow::{anyhow, Context, Result};
-use async_trait::async_trait;
-use hypervisor::device::device_manager::DeviceManager;
-use kata_sys_util::mount::{get_mount_path, get_mount_type};
-use kata_types::mount::KATA_K8S_LOCAL_STORAGE_TYPE;
-use nix::sys::stat::stat;
-use oci_spec::runtime as oci;
-use tokio::sync::RwLock;
-
-/// Allocating an FSGroup that owns the pod's volumes
-const FS_GID: &str = "fsgid";
-
-#[derive(Debug)]
-pub(crate) struct LocalStorage {
-    mounts: Vec<oci::Mount>,
-    storage: Option<agent::Storage>,
-}
-
-impl LocalStorage {
-    pub(crate) fn new(m: &oci::Mount, sid: &str, cid: &str) -> Result<Self> {
-        if m.source().is_none() {
-            return Err(anyhow!(format!(
-                "got a wrong volume without source: {:?}",
-                m
-            )));
-        }
-
-        let source = &get_mount_path(m.source());
-        let file_stat = stat(Path::new(source))?;
-        let mut dir_options = vec!["mode=0777".to_string()];
-
-        // if volume's gid isn't root group(default group), this means there's
-        // an specific fsGroup is set on this local volume, then it should pass
-        // to guest.
-        if file_stat.st_gid != 0 {
-            dir_options.push(format!("{}={}", FS_GID, file_stat.st_gid));
-        }
-
-        let file_name = Path::new(source)
-            .file_name()
-            .context(format!("get file name from {:?}", &m.source()))?;
-
-        // Set the mount source path to a the desired directory point in the VM.
-        // In this case it is located in the sandbox directory.
-        // We rely on the fact that the first container in the VM has the same ID as the sandbox ID.
-        // In Kubernetes, this is usually the pause container and we depend on it existing for
-        // local directories to work.
-        let source = Path::new(&kata_guest_share_dir())
-            .join(PASSTHROUGH_FS_DIR)
-            .join(sid)
-            .join("rootfs")
-            .join(KATA_K8S_LOCAL_STORAGE_TYPE)
-            .join(file_name)
-            .into_os_string()
-            .into_string()
-            .map_err(|e| anyhow!("failed to get local path {:?}", e))?;
-
-        // Create a storage struct so that kata agent is able to create
-        // tmpfs backed volume inside the VM
-        let local_storage = agent::Storage {
-            driver: String::from(KATA_K8S_LOCAL_STORAGE_TYPE),
-            driver_options: Vec::new(),
-            source: String::from(KATA_K8S_LOCAL_STORAGE_TYPE),
-            fs_type: String::from(KATA_K8S_LOCAL_STORAGE_TYPE),
-            fs_group: None,
-            options: dir_options,
-            mount_point: source.clone(),
-        };
-
-        let mounts: Vec<oci::Mount> = if sid != cid {
-            let mut mount = oci::Mount::default();
-            mount.set_destination(m.destination().clone());
-            mount.set_typ(Some(KATA_K8S_LOCAL_STORAGE_TYPE.to_string()));
-            mount.set_source(Some(PathBuf::from(&source)));
-            mount.set_options(m.options().clone());
-            vec![mount]
-        } else {
-            vec![]
-        };
-
-        Ok(Self {
-            mounts,
-            storage: Some(local_storage),
-        })
-    }
-}
-
-#[async_trait]
-impl Volume for LocalStorage {
-    fn get_volume_mount(&self) -> anyhow::Result<Vec<oci::Mount>> {
-        Ok(self.mounts.clone())
-    }
-
-    fn get_storage(&self) -> Result<Vec<agent::Storage>> {
-        let s = if let Some(s) = self.storage.as_ref() {
-            vec![s.clone()]
-        } else {
-            vec![]
-        };
-        Ok(s)
-    }
-
-    async fn cleanup(&self, _device_manager: &RwLock<DeviceManager>) -> Result<()> {
-        // TODO: Clean up LocalStorage
-        warn!(sl!(), "Cleaning up LocalStorage is no need.");
-        Ok(())
-    }
-
-    fn get_device_id(&self) -> Result<Option<String>> {
-        Ok(None)
-    }
-}
-
-pub(crate) fn is_local_volume(m: &oci::Mount) -> bool {
-    get_mount_type(m).as_str() == KATA_K8S_LOCAL_STORAGE_TYPE
-}

src/runtime-rs/crates/resource/src/volume/mod.rs

@@ -8,7 +8,6 @@ mod block_volume;
 mod default_volume;
 mod ephemeral_volume;
 pub mod hugepage;
-mod local_volume;
 mod share_fs_volume;
 mod shm_volume;
 pub mod utils;
@@ -82,11 +81,6 @@ impl VolumeResource {
                     shm_volume::ShmVolume::new(m)
                         .with_context(|| format!("new shm volume {:?}", m))?,
                 )
-            } else if local_volume::is_local_volume(m) {
-                Arc::new(
-                    local_volume::LocalStorage::new(m, sid, cid)
-                        .with_context(|| format!("new local volume {:?}", m))?,
-                )
             } else if ephemeral_volume::is_ephemeral_volume(m) {
                 Arc::new(
                     ephemeral_volume::EphemeralVolume::new(m)

src/runtime-rs/crates/resource/src/volume/share_fs_volume.rs

@@ -330,6 +330,9 @@ impl VolumeManager {
                 state.guest_path,
                 state.ref_count,
             );
+
+            // Return guest path
+            return Ok(state.guest_path.clone());
         }
 
         // Create a new volume state

src/runtime-rs/crates/runtimes/common/src/sandbox.rs

@@ -54,7 +54,4 @@ pub trait Sandbox: Send + Sync {
     // metrics function
     async fn agent_metrics(&self) -> Result<String>;
     async fn hypervisor_metrics(&self) -> Result<String>;
-
-    // set agent policy
-    async fn set_policy(&self, policy: &str) -> Result<()>;
 }

src/runtime-rs/crates/runtimes/src/shim_mgmt/handlers.rs

@@ -12,12 +12,12 @@ use agent::ResizeVolumeRequest;
 use anyhow::{anyhow, Context, Result};
 use common::Sandbox;
 use hyper::{Body, Method, Request, Response, StatusCode};
-use std::{str, sync::Arc};
+use std::sync::Arc;
 use url::Url;
 
 use shim_interface::shim_mgmt::{
-    AGENT_POLICY_URL, AGENT_URL, DIRECT_VOLUME_PATH_KEY, DIRECT_VOLUME_RESIZE_URL,
-    DIRECT_VOLUME_STATS_URL, IP6_TABLE_URL, IP_TABLE_URL, METRICS_URL,
+    AGENT_URL, DIRECT_VOLUME_PATH_KEY, DIRECT_VOLUME_RESIZE_URL, DIRECT_VOLUME_STATS_URL,
+    IP6_TABLE_URL, IP_TABLE_URL, METRICS_URL,
 };
 
 // main router for response, this works as a multiplexer on
@@ -45,7 +45,6 @@ pub(crate) async fn handler_mux(
             direct_volume_resize_handler(sandbox, req).await
         }
         (&Method::GET, METRICS_URL) => metrics_url_handler(sandbox, req).await,
-        (&Method::PUT, AGENT_POLICY_URL) => set_agent_policy_handler(sandbox, req).await,
         _ => Ok(not_found(req).await),
     }
 }
@@ -165,22 +164,3 @@ async fn metrics_url_handler(
         agent_metrics, hypervisor_metrics, shim_metrics
     ))))
 }
-
-/// The set agent policy handler, for setting agent policy
-async fn set_agent_policy_handler(
-    sandbox: Arc<dyn Sandbox>,
-    req: Request<Body>,
-) -> Result<Response<Body>> {
-    match *req.method() {
-        Method::PUT => {
-            let data = hyper::body::to_bytes(req.into_body()).await?;
-            let policy: &str = str::from_utf8(&data)?;
-            sandbox
-                .set_policy(policy)
-                .await
-                .context("set agent policy handler failed")?;
-            Ok(Response::new(Body::from("")))
-        }
-        _ => Err(anyhow!("Set agent policy only takes PUT method")),
-    }
-}

src/runtime-rs/crates/runtimes/virt_container/src/container_manager/container.rs

@@ -22,7 +22,7 @@ use kata_types::{
     container::{update_ocispec_annotations, POD_CONTAINER, POD_SANDBOX},
     k8s::{self, container_type},
 };
-use oci_spec::runtime as oci;
+use oci_spec::runtime::{self as oci, LinuxDeviceCgroup};
 
 use oci::{LinuxResources, Process as OCIProcess};
 use resource::{
@@ -134,7 +134,6 @@ impl Container {
             &mut spec,
             toml_config.runtime.disable_guest_seccomp,
             disable_guest_selinux,
-            toml_config.runtime.disable_guest_empty_dir,
         )
         .context("amend spec")?;
 
@@ -217,10 +216,11 @@ impl Container {
         if let Some(linux) = &mut spec.linux_mut() {
             linux.set_resources(resources);
 
-            // In certain scenarios, particularly under CoCo/Agent Policy enforcement,
-            // the value of `Linux.Resources.Devices` should be empty.
+            // In certain scenarios, particularly under CoCo/Agent Policy enforcement, the default initial value of `Linux.Resources.Devices`
+            // is considered non-compliant, leading to container creation failures. To address this issue and ensure consistency with the behavior
+            // in `runtime-go`, the default value of `Linux.Resources.Devices` from the OCI Spec should be removed.
             if let Some(resource) = linux.resources_mut() {
-                resource.set_devices(None);
+                clean_linux_resources_devices(resource);
             }
         }
 
@@ -622,7 +622,6 @@ fn amend_spec(
     spec: &mut oci::Spec,
     disable_guest_seccomp: bool,
     disable_guest_selinux: bool,
-    disable_guest_empty_dir: bool,
 ) -> Result<()> {
     // Only the StartContainer hook needs to be reserved for execution in the guest
     if let Some(hooks) = spec.hooks().as_ref() {
@@ -632,7 +631,7 @@ fn amend_spec(
     }
 
     // special process K8s ephemeral volumes.
-    update_ephemeral_storage_type(spec, disable_guest_empty_dir);
+    update_ephemeral_storage_type(spec);
 
     if let Some(linux) = &mut spec.linux_mut() {
         if disable_guest_seccomp {
@@ -687,6 +686,30 @@ fn is_pid_namespace_enabled(spec: &oci::Spec) -> bool {
     false
 }
 
+/// Cleans or filters specific device cgroup rules within the `devices` field of the `LinuxResources`.
+/// Specifically, it iterates through all `LinuxDeviceCgroup` rules in `resources`
+/// and removes those considered to be "default, all-access (rwm), and non-specific device" rules.
+fn clean_linux_resources_devices(resources: &mut LinuxResources) {
+    if let Some(devices) = resources.devices_mut().take() {
+        let cleaned_devices: Vec<LinuxDeviceCgroup> = devices
+            .into_iter()
+            .filter(|device| {
+                !(!device.allow()
+                    && device.typ().is_none()
+                    && device.major().is_none()
+                    && device.minor().is_none()
+                    && device.access().as_deref() == Some("rwm"))
+            })
+            .collect();
+
+        resources.set_devices(if cleaned_devices.is_empty() {
+            None
+        } else {
+            Some(cleaned_devices)
+        });
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::amend_spec;
@@ -705,11 +728,11 @@ mod tests {
         assert!(spec.linux().as_ref().unwrap().seccomp().is_some());
 
         // disable_guest_seccomp = false
-        amend_spec(&mut spec, false, false, false).unwrap();
+        amend_spec(&mut spec, false, false).unwrap();
         assert!(spec.linux().as_ref().unwrap().seccomp().is_some());
 
         // disable_guest_seccomp = true
-        amend_spec(&mut spec, true, false, false).unwrap();
+        amend_spec(&mut spec, true, false).unwrap();
         assert!(spec.linux().as_ref().unwrap().seccomp().is_none());
     }
 
@@ -732,12 +755,12 @@ mod tests {
             .unwrap();
 
         // disable_guest_selinux = false, selinux labels are left alone
-        amend_spec(&mut spec, false, false, false).unwrap();
+        amend_spec(&mut spec, false, false).unwrap();
         assert!(spec.process().as_ref().unwrap().selinux_label() == &Some("xxx".to_owned()));
         assert!(spec.linux().as_ref().unwrap().mount_label() == &Some("yyy".to_owned()));
 
         // disable_guest_selinux = true, selinux labels are reset
-        amend_spec(&mut spec, false, true, false).unwrap();
+        amend_spec(&mut spec, false, true).unwrap();
         assert!(spec.process().as_ref().unwrap().selinux_label().is_none());
         assert!(spec.linux().as_ref().unwrap().mount_label().is_none());
     }

src/runtime-rs/crates/runtimes/virt_container/src/sandbox.rs

@@ -6,7 +6,7 @@
 
 use crate::health_check::HealthCheck;
 use agent::kata::KataAgent;
-use agent::types::{KernelModule, SetPolicyRequest};
+use agent::types::KernelModule;
 use agent::{
     self, Agent, GetGuestDetailsRequest, GetIPTablesRequest, SetIPTablesRequest, VolumeStatsRequest,
 };
@@ -358,13 +358,7 @@ impl VirtSandbox {
         }
 
         if boot_info.image.is_empty() {
-            let is_remote_hypervisor = Arc::clone(&self.resource_manager.config().await)
-                .runtime
-                .hypervisor_name
-                == "remote";
-            if (boot_info.vm_rootfs_driver.ends_with("ccw") && security_info.confidential_guest)
-                || is_remote_hypervisor
-            {
+            if boot_info.vm_rootfs_driver.ends_with("ccw") && security_info.confidential_guest {
                 return Ok(None);
             } else {
                 return Err(anyhow!("both of image and initrd isn't set"));
@@ -379,28 +373,6 @@ impl VirtSandbox {
         }))
     }
 
-    async fn set_agent_policy(&self) -> Result<()> {
-        // TODO: Exclude policy-related items from the annotations.
-        let toml_config = self.resource_manager.config().await;
-        if let Some(agent_config) = toml_config.agent.get(&toml_config.runtime.agent_name) {
-            // If a Policy has been specified, send it to the agent.
-            if !agent_config.policy.is_empty() {
-                info!(
-                    sl!(),
-                    "Setting Agent Policy with {:?}.", &agent_config.policy
-                );
-                self.agent
-                    .set_policy(SetPolicyRequest {
-                        policy: agent_config.policy.clone(),
-                    })
-                    .await
-                    .context("sandbox: set policy failed")?;
-            }
-        }
-
-        Ok(())
-    }
-
     async fn prepare_vm_socket_config(&self) -> Result<ResourceConfig> {
         // It will check the hypervisor's capabilities to see if it supports hybrid-vsock.
         // If it does not, it'll assume that it only supports legacy vsock.
@@ -445,7 +417,6 @@ impl VirtSandbox {
                 Ok(Some(ProtectionDeviceConfig::SevSnp(SevSnpConfig {
                     is_snp: false,
                     cbitpos: details.cbitpos,
-                    phys_addr_reduction: details.phys_addr_reduction,
                     firmware: hypervisor_config.boot_info.firmware.clone(),
                     host_data: None,
                 })))
@@ -466,7 +437,6 @@ impl VirtSandbox {
                 Ok(Some(ProtectionDeviceConfig::SevSnp(SevSnpConfig {
                     is_snp,
                     cbitpos: details.cbitpos,
-                    phys_addr_reduction: details.phys_addr_reduction,
                     firmware: hypervisor_config.boot_info.firmware.clone(),
                     host_data: init_data,
                 })))
@@ -658,7 +628,6 @@ impl Sandbox for VirtSandbox {
             .start(&address)
             .await
             .context(format!("connect to address {:?}", &address))?;
-        self.set_agent_policy().await.context("set agent policy")?;
 
         self.resource_manager
             .setup_after_start_vm()
@@ -958,24 +927,6 @@ impl Sandbox for VirtSandbox {
     async fn hypervisor_metrics(&self) -> Result<String> {
         self.hypervisor.get_hypervisor_metrics().await
     }
-
-    async fn set_policy(&self, policy: &str) -> Result<()> {
-        if policy.is_empty() {
-            debug!(sl!(), "sb: set_policy skipped without policy");
-            return Ok(());
-        }
-
-        info!(sl!(), "sb: set_policy invoked");
-        let policy_req = SetPolicyRequest {
-            policy: policy.to_string(),
-        };
-        self.agent
-            .set_policy(policy_req)
-            .await
-            .context("sandbox: failed to set policy")?;
-
-        Ok(())
-    }
 }
 
 #[async_trait]

src/runtime-rs/crates/shim/Cargo.toml

@@ -14,8 +14,9 @@ path = "src/bin/main.rs"
 
 [dependencies]
 anyhow = { workspace = true }
-backtrace = { version = ">=0.3.76", features = [
+backtrace = { version = ">=0.3.35", features = [
     "libunwind",
+    "libbacktrace",
     "std",
 ], default-features = false }
 containerd-shim-protos = { workspace = true }

src/runtime/Makefile

@@ -233,19 +233,13 @@ DEFDISABLESELINUX := false
 
 # Default guest SELinux configuration
 DEFDISABLEGUESTSELINUX := true
-# Default is empty string "" to match the default golang (when commented out in config).
-# Most users will want to set this to "system_u:system_r:container_t" for SELinux support.
-DEFGUESTSELINUXLABEL := 
+DEFGUESTSELINUXLABEL := system_u:system_r:container_t
 
 #Default SeccomSandbox param
 #The same default policy is used by libvirt
-# More explanation on https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg03348.html
-#
-# Default is empty string "" to match the default (when commented out in config).
-# Most users will want to set this to "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-# for better security. Note: "elevateprivileges=deny" doesn't work with daemonize option.
+#More explanation on https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg03348.html
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
-DEFSECCOMPSANDBOXPARAM :=
+DEFSECCOMPSANDBOXPARAM := on,obsolete=deny,spawn=deny,resourcecontrol=deny
 
 #Default entropy source
 DEFENTROPYSOURCE := /dev/urandom
@@ -275,7 +269,6 @@ DEFVIRTIOFSQUEUESIZE ?= 1024
 # Make sure you quote args.
 DEFVIRTIOFSEXTRAARGS ?= [\"--thread-pool-size=1\", \"--announce-submounts\"]
 DEFENABLEIOTHREADS := false
-DEFINDEPIOTHREADS := 0
 DEFENABLEVHOSTUSERSTORE := false
 DEFVHOSTUSERSTOREPATH := $(PKGRUNDIR)/vhost-user
 DEFVALIDVHOSTUSERSTOREPATHS := [\"$(DEFVHOSTUSERSTOREPATH)\"]
@@ -302,10 +295,6 @@ DEFDANCONF := /run/kata-containers/dans
 
 DEFFORCEGUESTPULL := false
 
-# Device cold plug
-DEFPODRESOURCEAPISOCK := ""
-DEFPODRESOURCEAPISOCK_NV := "/var/lib/kubelet/pod-resources/kubelet.sock"
-
 SED = sed
 
 CLI_DIR = cmd
@@ -472,7 +461,7 @@ ifneq (,$(QEMUCMD))
 
     DEFAULTVCPUS_NV = 1
     DEFAULTMEMORY_NV = 2048
-    DEFAULTTIMEOUT_NV = 1200
+    DEFAULTTIMEOUT_NV = 500
     DEFAULTVFIOPORT_NV = root-port
     DEFAULTPCIEROOTPORT_NV = 8
 
@@ -480,9 +469,12 @@ ifneq (,$(QEMUCMD))
     KERNELPARAMS_NV += "cgroup_no_v1=all"
 
     KERNELTDXPARAMS_NV = $(KERNELPARAMS_NV)
+    KERNELTDXPARAMS_NV += "clearcpuid=mtrr"
     KERNELTDXPARAMS_NV += "authorize_allow_devs=pci:ALL"
 
     KERNELSNPPARAMS_NV = $(KERNELPARAMS_NV)
+    #TODO: temporary until the attestation agent activates the device after successful attestation
+    KERNELSNPPARAMS_NV += "nvrc.smi.srs=1"
 
     # Setting this to false can lead to cgroup leakages in the host
     # Best practice for production is to set this to true
@@ -766,7 +758,6 @@ USER_VARS += DEFVIRTIOFSEXTRAARGS
 USER_VARS += DEFENABLEANNOTATIONS
 USER_VARS += DEFENABLEANNOTATIONS_COCO
 USER_VARS += DEFENABLEIOTHREADS
-USER_VARS += DEFINDEPIOTHREADS
 USER_VARS += DEFSECCOMPSANDBOXPARAM
 USER_VARS += DEFENABLEVHOSTUSERSTORE
 USER_VARS += DEFVHOSTUSERSTOREPATH
@@ -792,8 +783,7 @@ USER_VARS += BUILDFLAGS
 USER_VARS += DEFDISABLEIMAGENVDIMM
 USER_VARS += DEFCCAMEASUREMENTALGO
 USER_VARS += DEFSHAREDFS_QEMU_CCA_VIRTIOFS
-USER_VARS += DEFPODRESOURCEAPISOCK
-USER_VARS += DEFPODRESOURCEAPISOCK_NV
+
 
 V              = @
 Q              = $(V:1=)

src/runtime/config/configuration-clh.toml.in

@@ -20,22 +20,41 @@ image = "@IMAGEPATH@"
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
+
+# Enable confidential guest support.
+# Toggling that setting may trigger different hardware features, ranging
+# from memory encryption to both memory and CPU-state encryption and integrity.
+# The Kata Containers runtime dynamically detects the available feature set and
+# aims at enabling the largest possible one, returning an error if none is
+# available, or none is supported by the hypervisor.
+#
+# Known limitations:
+# * Does not work by design:
+#   - CPU Hotplug 
+#   - Memory Hotplug
+#   - NVDIMM devices
+#
+# Supported TEEs:
+# * Intel TDX
+#
+# Default false
+# confidential_guest = true
 
 # Enable running clh VMM as a non-root user.
 # By default clh VMM run as root. When this is set to true, clh VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 # Path to the firmware.
 # If you want Cloud Hypervisor to use a specific firmware, set its path below.
@@ -101,7 +120,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -163,12 +182,12 @@ block_device_driver = "virtio-blk"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -178,32 +197,32 @@ block_device_cache_direct = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
 # being allocated using huge pages.
-enable_hugepages = false
+#enable_hugepages = true
 
 # Disable the 'seccomp' feature from Cloud Hypervisor, default false
-disable_seccomp = false
+# disable_seccomp = true
 
 # Enable vIOMMU, default false
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # This option changes the default hypervisor and kernel parameters
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # This option specifies the loglevel of the hypervisor
 #
 # Default 1
-hypervisor_loglevel = 1
+#hypervisor_loglevel = 1
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -213,7 +232,7 @@ disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 
 # Enable hot-plugging of VFIO devices to a root-port.
 # The default setting is  "no-port"
-hot_plug_vfio = "no-port"
+#hot_plug_vfio = "root-port"
 
 # Path to OCI hook binaries in the *guest rootfs*.
 # This does not affect host-side hooks which must instead be added to
@@ -230,7 +249,7 @@ hot_plug_vfio = "no-port"
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # These options are related to network rate limiter at the VMM level, and are
 # based on the Cloud Hypervisor I/O throttling.  Those are disabled by default
@@ -244,14 +263,14 @@ guest_hook_path = ""
 # for SB/VM).
 # The same value is used for inbound and outbound bandwidth.
 # Default 0-sized value means unlimited rate.
-net_rate_limiter_bw_max_rate = 0
+#net_rate_limiter_bw_max_rate = 0
 #
 # net_rate_limiter_bw_one_time_burst increases the initial max rate and this
 # initial extra credit does *NOT* affect the overall limit and can be used for
 # an *initial* burst of data.
 # This is *optional* and only takes effect if net_rate_limiter_bw_max_rate is
 # set to a non zero value.
-net_rate_limiter_bw_one_time_burst = 0
+#net_rate_limiter_bw_one_time_burst = 0
 #
 # Operation rate limiter options
 #
@@ -259,14 +278,14 @@ net_rate_limiter_bw_one_time_burst = 0
 # for SB/VM).
 # The same value is used for inbound and outbound bandwidth.
 # Default 0-sized value means unlimited rate.
-net_rate_limiter_ops_max_rate = 0
+#net_rate_limiter_ops_max_rate = 0
 #
 # net_rate_limiter_ops_one_time_burst increases the initial max rate and this
 # initial extra credit does *NOT* affect the overall limit and can be used for
 # an *initial* burst of data.
 # This is *optional* and only takes effect if net_rate_limiter_bw_max_rate is
 # set to a non zero value.
-net_rate_limiter_ops_one_time_burst = 0
+#net_rate_limiter_ops_one_time_burst = 0
 #
 # These options are related to disk rate limiter at the VMM level, and are
 # based on the Cloud Hypervisor I/O throttling.  Those are disabled by default
@@ -280,14 +299,14 @@ net_rate_limiter_ops_one_time_burst = 0
 # for SB/VM).
 # The same value is used for inbound and outbound bandwidth.
 # Default 0-sized value means unlimited rate.
-disk_rate_limiter_bw_max_rate = 0
+#disk_rate_limiter_bw_max_rate = 0
 #
 # disk_rate_limiter_bw_one_time_burst increases the initial max rate and this
 # initial extra credit does *NOT* affect the overall limit and can be used for
 # an *initial* burst of data.
 # This is *optional* and only takes effect if disk_rate_limiter_bw_max_rate is
 # set to a non zero value.
-disk_rate_limiter_bw_one_time_burst = 0
+#disk_rate_limiter_bw_one_time_burst = 0
 #
 # Operation rate limiter options
 #
@@ -295,19 +314,19 @@ disk_rate_limiter_bw_one_time_burst = 0
 # for SB/VM).
 # The same value is used for inbound and outbound bandwidth.
 # Default 0-sized value means unlimited rate.
-disk_rate_limiter_ops_max_rate = 0
+#disk_rate_limiter_ops_max_rate = 0
 #
 # disk_rate_limiter_ops_one_time_burst increases the initial max rate and this
 # initial extra credit does *NOT* affect the overall limit and can be used for
 # an *initial* burst of data.
 # This is *optional* and only takes effect if disk_rate_limiter_bw_max_rate is
 # set to a non zero value.
-disk_rate_limiter_ops_one_time_burst = 0
+#disk_rate_limiter_ops_one_time_burst = 0
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -321,14 +340,14 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 45)
@@ -336,13 +355,13 @@ dial_timeout = 45
 
 # Confidential Data Hub API timeout value in seconds
 # (default: 50)
-cdh_api_timeout = 50
+#cdh_api_timeout = 50
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -360,14 +379,14 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_CLH@"
+internetworking_model="@DEFNETWORKMODEL_CLH@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -375,23 +394,22 @@ disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -399,7 +417,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -407,7 +425,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -416,13 +434,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_CLH@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_CLH@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -443,22 +461,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -476,26 +494,3 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-fc.toml.in

@@ -20,7 +20,7 @@ image = "@IMAGEPATH@"
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -102,14 +102,14 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # The size in MiB will be plused to max memory of hypervisor.
 # It is the memory address space for the NVDIMM device.
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -124,12 +124,12 @@ block_device_driver = "@DEFBLOCKSTORAGEDRIVER_FC@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
@@ -138,7 +138,7 @@ block_device_cache_noflush = false
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -146,29 +146,29 @@ enable_mem_prealloc = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vIOMMU, default false
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # This option changes the default hypervisor and kernel parameters
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 #
 # Default entropy source.
@@ -180,7 +180,7 @@ msize_9p = @DEFMSIZE9P@
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -202,21 +202,21 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered will scanning for hooks,
 # but it will not abort container execution.
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Firecracker, it provides a built-in rate limiter, which is based on TBF(Token Bucket Filter)
 # queueing discipline.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Firecracker, it provides a built-in rate limiter, which is based on TBF(Token Bucket Filter)
 # queueing discipline.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 [factory]
 # VM templating support. Once enabled, new VMs are created from template
@@ -230,12 +230,12 @@ disable_selinux = @DEFDISABLESELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -249,7 +249,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -262,14 +262,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 45)
@@ -277,13 +277,13 @@ dial_timeout = 45
 
 # Confidential Data Hub API timeout value in seconds
 # (default: 50)
-cdh_api_timeout = 50
+#cdh_api_timeout = 50
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -301,29 +301,29 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_FC@"
+internetworking_model="@DEFNETWORKMODEL_FC@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -331,7 +331,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -339,7 +339,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -348,22 +348,22 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_FC@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_FC@
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -381,22 +381,3 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-qemu-cca.toml.in

@@ -14,13 +14,14 @@
 path = "@QEMUCCAEXPERIMENTALPATH@"
 kernel = "@KERNELCONFIDENTIALPATH@"
 image = "@IMAGECONFIDENTIALPATH@"
+# initrd = "@INITRDCONFIDENTIALPATH@"
 machine_type = "@MACHINETYPE@"
 
 # rootfs filesystem type:
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 
 # Enable confidential guest support.
 # Toggling that setting may trigger different hardware features, ranging
@@ -41,7 +42,7 @@ confidential_guest = true
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -79,7 +80,7 @@ firmware_volume = "@FIRMWAREVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -87,13 +88,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -138,7 +138,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -151,13 +151,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -217,17 +217,17 @@ block_device_driver = "@DEFBLOCKSTORAGEDRIVER_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
 # handled in a separate IO thread. This is currently only implemented
@@ -242,7 +242,7 @@ enable_iothreads = @DEFENABLEIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -250,7 +250,7 @@ enable_mem_prealloc = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -267,11 +267,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -282,7 +282,7 @@ valid_vhost_user_store_paths = @DEFVALIDVHOSTUSERSTOREPATHS@
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -297,17 +297,17 @@ pflashes = []
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -319,11 +319,11 @@ disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -335,7 +335,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -357,17 +357,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -377,10 +377,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -388,7 +387,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -399,26 +398,26 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 # In QEMU, the Realm Management Extension (RME) measurement algorithm is used for attestation, and it supports
 # sha256 and sha512 as options. The default is sha512. This algorithm is crucial for verifying the integrity of a
 # Realm, a secure execution environment within the larger system. QEMU supports sha256 and sha512 for CCA RME
 # measurements. sha512 is generally preferred on 64-bit architectures due to potential hardware acceleration.
-measurement_algo = "@DEFCCAMEASUREMENTALGO@"
+measurement_algo="@DEFCCAMEASUREMENTALGO@"
 
 [factory]
 # VM templating support. Once enabled, new VMs are created from template
@@ -432,12 +431,12 @@ measurement_algo = "@DEFCCAMEASUREMENTALGO@"
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -456,17 +455,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -480,7 +479,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -493,14 +492,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 90)
@@ -510,7 +509,7 @@ dial_timeout = 90
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -528,14 +527,14 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -543,23 +542,22 @@ disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -567,7 +565,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -575,7 +573,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -584,13 +582,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_TEE@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_TEE@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -611,22 +609,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -649,21 +647,3 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-qemu-coco-dev.toml.in

@@ -16,18 +16,41 @@
 path = "@QEMUPATH@"
 kernel = "@KERNELCONFIDENTIALPATH@"
 image = "@IMAGECONFIDENTIALPATH@"
+# initrd = "@INITRDCONFIDENTIALPATH@"
 machine_type = "@MACHINETYPE@"
 
 # rootfs filesystem type:
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
+
+# Enable confidential guest support.
+# Toggling that setting may trigger different hardware features, ranging
+# from memory encryption to both memory and CPU-state encryption and integrity.
+# The Kata Containers runtime dynamically detects the available feature set and
+# aims at enabling the largest possible one, returning an error if none is
+# available, or none is supported by the hypervisor.
+#
+# Known limitations:
+# * Does not work by design:
+#   - CPU Hotplug 
+#   - Memory Hotplug
+#   - NVDIMM devices
+#
+# Default false
+# confidential_guest = true
+
+# Choose AMD SEV-SNP confidential guests
+# In case of using confidential guests on AMD hardware that supports both SEV
+# and SEV-SNP, the following enables SEV-SNP guests. SEV guests are default.
+# Default false
+# sev_snp_guest = true
 
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -65,7 +88,7 @@ firmware_volume = "@FIRMWAREVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -73,13 +96,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -124,7 +146,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -137,13 +159,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -224,28 +246,24 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently implemented
-# for virtio-scsi and virtio-blk.
+# handled in a separate IO thread. This is currently only implemented
+# for SCSI.
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Independent IOThreads enables IO to be processed in a separate thread, it is
-# for QEMU hotplug device attach to iothread, like virtio-blk.
-indep_iothreads = @DEFINDEPIOTHREADS@
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -253,7 +271,7 @@ indep_iothreads = @DEFINDEPIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -263,7 +281,7 @@ enable_mem_prealloc = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -271,7 +289,7 @@ reclaim_guest_freed_memory = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -288,11 +306,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -308,7 +326,7 @@ vhost_user_reconnect_timeout_sec = 0
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -323,7 +341,7 @@ pflashes = []
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # This option allows to add an extra HMP or QMP socket when `enable_debug = true`
 #
@@ -338,17 +356,17 @@ enable_debug = false
 #
 # If set to the empty string "", no extra monitor socket is added. This is
 # the default.
-extra_monitor_socket = ""
+#extra_monitor_socket = hmp
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = true
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -359,24 +377,24 @@ disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 # Enable hot-plugging of VFIO devices to a bridge-port, 
 # root-port or switch-port. 
 # The default setting is  "no-port"
-hot_plug_vfio = "no-port" 
+#hot_plug_vfio = "root-port" 
 
 # In a confidential compute environment hot-plugging can compromise
 # security. 
 # Enable cold-plugging of VFIO devices to a bridge-port, 
 # root-port or switch-port. 
 # The default setting is  "no-port", which means disabled. 
-cold_plug_vfio = "no-port" 
+#cold_plug_vfio = "root-port" 
 
 # Before hot plugging a PCIe device, you need to add a pcie_root_port device.
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -388,7 +406,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -410,18 +428,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -431,10 +448,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -442,7 +458,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -453,20 +469,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -481,12 +497,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -505,17 +521,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -529,7 +545,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -542,14 +558,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 45)
@@ -557,13 +573,13 @@ dial_timeout = 45
 
 # Confidential Data Hub API timeout value in seconds
 # (default: 50)
-cdh_api_timeout = 50
+#cdh_api_timeout = 50
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -581,19 +597,19 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -601,23 +617,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -625,7 +640,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -633,7 +648,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -642,13 +657,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_TEE@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_TEE@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -669,22 +684,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -707,22 +722,3 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-qemu-nvidia-gpu-snp.toml.in

@@ -23,7 +23,7 @@ machine_type = "@MACHINETYPE@"
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 
 # Enable confidential guest support.
 # Toggling that setting may trigger different hardware features, ranging
@@ -47,12 +47,12 @@ sev_snp_guest = true
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
 # of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
-enable_annotations = @DEFENABLEANNOTATIONS_COCO@
+enable_annotations = @DEFENABLEANNOTATIONS@
 
 # List of valid annotations values for the hypervisor
 # Each member of the list is a path pattern as described by glob(3).
@@ -68,17 +68,17 @@ valid_hypervisor_paths = @QEMUSNPVALIDHYPERVISORPATHS@
 #
 # 96-byte, base64-encoded blob to provide the ‘ID Block’ structure for the
 # SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (QEMU default: all-zero)
-snp_id_block = ""
+#snp_id_block = ""
 # 4096-byte, base64-encoded blob to provide the ‘ID Authentication Information Structure’
 # for the SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (QEMU default: all-zero)
-snp_id_auth = ""
+#snp_id_auth = ""
 
 # SNP Guest Policy, the ‘POLICY’ parameter to the SNP_LAUNCH_START command.
 # If unset, the QEMU default policy (0x30000) will be used.
 # Notice that the guest policy is enforced at VM launch, and your pod VMs 
 # won't start at all if the policy denys it. This will be indicated by a
 # 'SNP_LAUNCH_START' error.
-snp_guest_policy = 196608
+#snp_guest_policy = 196608
 
 # Optional space-separated list of options to pass to the guest kernel.
 # For example, use `kernel_params = "vsyscall=emulate"` if you are having
@@ -105,7 +105,7 @@ firmware_volume = "@FIRMWARETDVFVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -113,13 +113,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -164,7 +163,7 @@ default_memory = @DEFAULTMEMORY_NV@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -177,13 +176,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -264,28 +263,24 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently implemented
-# for virtio-scsi and virtio-blk.
+# handled in a separate IO thread. This is currently only implemented
+# for SCSI.
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Independent IOThreads enables IO to be processed in a separate thread, it is
-# for QEMU hotplug device attach to iothread, like virtio-blk.
-indep_iothreads = @DEFINDEPIOTHREADS@
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -293,7 +288,7 @@ indep_iothreads = @DEFINDEPIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -303,7 +298,7 @@ enable_mem_prealloc = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -311,7 +306,7 @@ reclaim_guest_freed_memory = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -328,11 +323,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -363,17 +358,17 @@ pflashes = []
 # to enable debug output where available. And Debug also enable the hmp socket.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -385,7 +380,7 @@ disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # In a confidential compute environment hot-plugging can compromise
 # security. 
@@ -396,7 +391,7 @@ cold_plug_vfio = "@DEFAULTVFIOPORT_NV@"
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -408,7 +403,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -430,18 +425,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -451,10 +445,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -462,7 +455,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -473,20 +466,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -501,12 +494,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -525,17 +518,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -549,7 +542,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -562,14 +555,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 90)
@@ -579,7 +572,7 @@ dial_timeout = 90
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -597,19 +590,19 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -617,23 +610,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -641,7 +633,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -649,7 +641,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_NV@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_NV@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -658,13 +650,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_NV@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_TEE@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_TEE@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -685,22 +677,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -723,22 +715,3 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK_NV@"

src/runtime/config/configuration-qemu-nvidia-gpu-tdx.toml.in

@@ -23,7 +23,7 @@ tdx_quote_generation_service_socket_port = @QEMUTDXQUOTEGENERATIONSERVICESOCKETP
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 
 # Enable confidential guest support.
 # Toggling that setting may trigger different hardware features, ranging
@@ -44,12 +44,12 @@ confidential_guest = true
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
 # of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
-enable_annotations = @DEFENABLEANNOTATIONS_COCO@
+enable_annotations = @DEFENABLEANNOTATIONS@
 
 # List of valid annotations values for the hypervisor
 # Each member of the list is a path pattern as described by glob(3).
@@ -82,7 +82,7 @@ firmware_volume = "@FIRMWARETDVFVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -90,13 +90,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@TDXCPUFEATURES@"
+cpu_features="@TDXCPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -141,7 +140,7 @@ default_memory = @DEFAULTMEMORY_NV@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -154,13 +153,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -241,28 +240,24 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently implemented
-# for virtio-scsi and virtio-blk.
+# handled in a separate IO thread. This is currently only implemented
+# for SCSI.
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Independent IOThreads enables IO to be processed in a separate thread, it is
-# for QEMU hotplug device attach to iothread, like virtio-blk.
-indep_iothreads = @DEFINDEPIOTHREADS@
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -270,7 +265,7 @@ indep_iothreads = @DEFINDEPIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -280,7 +275,7 @@ enable_mem_prealloc = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -288,7 +283,7 @@ reclaim_guest_freed_memory = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -305,11 +300,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -325,7 +320,7 @@ vhost_user_reconnect_timeout_sec = 0
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -340,17 +335,17 @@ pflashes = []
 # to enable debug output where available. And Debug also enable the hmp socket.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -362,7 +357,7 @@ disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # In a confidential compute environment hot-plugging can compromise
 # security. 
@@ -373,7 +368,7 @@ cold_plug_vfio = "@DEFAULTVFIOPORT_NV@"
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -385,7 +380,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -407,18 +402,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -428,10 +422,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -439,7 +432,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -450,20 +443,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -478,12 +471,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -502,17 +495,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -526,7 +519,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -539,14 +532,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 90)
@@ -556,7 +549,7 @@ dial_timeout = 90
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -574,19 +567,19 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -594,23 +587,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -618,7 +610,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -626,7 +618,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_NV@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_NV@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -635,13 +627,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_NV@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_TEE@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_TEE@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -662,22 +654,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -700,22 +692,3 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK_NV@"

src/runtime/config/configuration-qemu-nvidia-gpu.toml.in

@@ -21,12 +21,34 @@ machine_type = "@MACHINETYPE@"
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
+
+# Enable confidential guest support.
+# Toggling that setting may trigger different hardware features, ranging
+# from memory encryption to both memory and CPU-state encryption and integrity.
+# The Kata Containers runtime dynamically detects the available feature set and
+# aims at enabling the largest possible one, returning an error if none is
+# available, or none is supported by the hypervisor.
+#
+# Known limitations:
+# * Does not work by design:
+#   - CPU Hotplug 
+#   - Memory Hotplug
+#   - NVDIMM devices
+#
+# Default false
+# confidential_guest = true
+
+# Choose AMD SEV-SNP confidential guests
+# In case of using confidential guests on AMD hardware that supports both SEV
+# and SEV-SNP, the following enables SEV-SNP guests. SEV guests are default.
+# Default false
+# sev_snp_guest = true
 
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -64,7 +86,7 @@ firmware_volume = "@FIRMWAREVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -72,13 +94,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -123,7 +144,7 @@ default_memory = @DEFAULTMEMORY_NV@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -136,13 +157,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -223,28 +244,24 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently implemented
-# for virtio-scsi and virtio-blk.
+# handled in a separate IO thread. This is currently only implemented
+# for SCSI.
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Independent IOThreads enables IO to be processed in a separate thread, it is
-# for QEMU hotplug device attach to iothread, like virtio-blk.
-indep_iothreads = @DEFINDEPIOTHREADS@
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -252,7 +269,7 @@ indep_iothreads = @DEFINDEPIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -262,7 +279,7 @@ enable_mem_prealloc = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -270,7 +287,7 @@ reclaim_guest_freed_memory = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -287,11 +304,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -307,7 +324,7 @@ vhost_user_reconnect_timeout_sec = 0
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -322,7 +339,7 @@ pflashes = []
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # This option allows to add an extra HMP or QMP socket when `enable_debug = true`
 #
@@ -337,17 +354,17 @@ enable_debug = false
 #
 # If set to the empty string "", no extra monitor socket is added. This is
 # the default.
-extra_monitor_socket = ""
+#extra_monitor_socket = hmp
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = true
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -365,7 +382,7 @@ hot_plug_vfio = "@DEFAULTVFIOPORT_NV@"
 # Enable cold-plugging of VFIO devices to a bridge-port, 
 # root-port or switch-port. 
 # The default setting is  "no-port", which means disabled. 
-cold_plug_vfio = "no-port"
+#cold_plug_vfio = "@DEFAULTVFIOPORT_NV@"
 
 # Before hot plugging a PCIe device, you need to add a pcie_root_port device.
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
@@ -375,7 +392,7 @@ pcie_root_port = @DEFAULTPCIEROOTPORT_NV@
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -387,7 +404,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -409,18 +426,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -430,10 +446,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -441,7 +456,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -452,20 +467,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -480,12 +495,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -504,17 +519,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -528,7 +543,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -541,14 +556,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 90)
@@ -558,7 +573,7 @@ dial_timeout = 90
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -576,19 +591,19 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -596,23 +611,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -620,7 +634,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -628,7 +642,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_NV@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY_NV@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -637,13 +651,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY_NV@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -664,22 +678,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -697,22 +711,3 @@ create_container_timeout = @DEFAULTTIMEOUT_NV@
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK_NV@"

src/runtime/config/configuration-qemu-se.toml.in

@@ -35,7 +35,7 @@ confidential_guest = true
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -73,7 +73,7 @@ firmware_volume = "@FIRMWAREVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -81,13 +81,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -132,7 +131,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -145,13 +144,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -231,28 +230,24 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently implemented
-# for virtio-scsi and virtio-blk.
+# handled in a separate IO thread. This is currently only implemented
+# for SCSI.
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Independent IOThreads enables IO to be processed in a separate thread, it is
-# for QEMU hotplug device attach to iothread, like virtio-blk.
-indep_iothreads = @DEFINDEPIOTHREADS@
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -260,7 +255,7 @@ indep_iothreads = @DEFINDEPIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -270,7 +265,7 @@ enable_mem_prealloc = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -278,7 +273,7 @@ reclaim_guest_freed_memory = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -295,11 +290,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -310,7 +305,7 @@ valid_vhost_user_store_paths = @DEFVALIDVHOSTUSERSTOREPATHS@
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -325,17 +320,17 @@ pflashes = []
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -343,10 +338,10 @@ msize_9p = @DEFMSIZE9P@
 # nvdimm is not supported when `confidential_guest = true`.
 disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 
-# Enable hot-plugging of VFIO devices to a bridge-port, 
+# Enable hot-plugging of VFIO devices to a bridge-port,
 # root-port or switch-port.
 # The default setting is "no-port"
-hot_plug_vfio = "no-port"
+#hot_plug_vfio = "bridge-port"
 
 # In a confidential compute environment hot-plugging can compromise
 # security.
@@ -359,11 +354,11 @@ cold_plug_vfio = "bridge-port"
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -375,7 +370,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -397,18 +392,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -418,10 +412,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -429,7 +422,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -440,20 +433,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -468,12 +461,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -492,17 +485,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -516,7 +509,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -529,14 +522,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 30)
@@ -546,7 +539,7 @@ dial_timeout = 90
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -564,19 +557,19 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -584,23 +577,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -608,7 +600,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -616,7 +608,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -625,13 +617,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -652,22 +644,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE_SE@"
+vfio_mode="@DEFVFIOMODE_SE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -690,22 +682,3 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-qemu-snp.toml.in

@@ -15,6 +15,7 @@
 [hypervisor.qemu]
 path = "@QEMUPATH@"
 kernel = "@KERNELCONFIDENTIALPATH@"
+#image = "@IMAGEPATH@"
 initrd = "@INITRDCONFIDENTIALPATH@"
 machine_type = "@MACHINETYPE@"
 
@@ -22,7 +23,7 @@ machine_type = "@MACHINETYPE@"
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 
 # Enable confidential guest support.
 # Toggling that setting may trigger different hardware features, ranging
@@ -46,7 +47,7 @@ sev_snp_guest = true
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -67,17 +68,17 @@ valid_hypervisor_paths = @QEMUVALIDHYPERVISORPATHS@
 #
 # 96-byte, base64-encoded blob to provide the ‘ID Block’ structure for the
 # SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (QEMU default: all-zero)
-snp_id_block = ""
+#snp_id_block = ""
 # 4096-byte, base64-encoded blob to provide the ‘ID Authentication Information Structure’
 # for the SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (QEMU default: all-zero)
-snp_id_auth = ""
+#snp_id_auth = ""
 
 # SNP Guest Policy, the ‘POLICY’ parameter to the SNP_LAUNCH_START command.
 # If unset, the QEMU default policy (0x30000) will be used.
 # Notice that the guest policy is enforced at VM launch, and your pod VMs 
 # won't start at all if the policy denys it. This will be indicated by a
 # 'SNP_LAUNCH_START' error.
-snp_guest_policy = 196608
+#snp_guest_policy = 196608
 
 # Optional space-separated list of options to pass to the guest kernel.
 # For example, use `kernel_params = "vsyscall=emulate"` if you are having
@@ -104,7 +105,7 @@ firmware_volume = "@FIRMWARETDVFVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -112,13 +113,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -163,7 +163,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -176,13 +176,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -263,28 +263,24 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently implemented
-# for virtio-scsi and virtio-blk.
+# handled in a separate IO thread. This is currently only implemented
+# for SCSI.
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Independent IOThreads enables IO to be processed in a separate thread, it is
-# for QEMU hotplug device attach to iothread, like virtio-blk.
-indep_iothreads = @DEFINDEPIOTHREADS@
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -292,7 +288,7 @@ indep_iothreads = @DEFINDEPIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -302,7 +298,7 @@ enable_mem_prealloc = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -310,7 +306,7 @@ reclaim_guest_freed_memory = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -327,11 +323,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -362,7 +358,7 @@ pflashes = []
 # to enable debug output where available. And Debug also enable the hmp socket.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
@@ -372,7 +368,7 @@ disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -384,11 +380,11 @@ disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -400,7 +396,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -422,18 +418,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -443,10 +438,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -454,7 +448,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -465,20 +459,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -493,12 +487,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -517,17 +511,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -541,7 +535,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -554,14 +548,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 90)
@@ -571,7 +565,7 @@ dial_timeout = 90
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -589,19 +583,19 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -609,23 +603,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -633,7 +626,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -641,7 +634,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -650,13 +643,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_TEE@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_TEE@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -677,22 +670,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -715,22 +708,3 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-qemu-tdx.toml.in

@@ -15,6 +15,7 @@
 path = "@QEMUTDXPATH@"
 kernel = "@KERNELCONFIDENTIALPATH@"
 image = "@IMAGECONFIDENTIALPATH@"
+# initrd = "@INITRDPATH@"
 machine_type = "@MACHINETYPE@"
 tdx_quote_generation_service_socket_port = @QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT@
 
@@ -22,7 +23,7 @@ tdx_quote_generation_service_socket_port = @QEMUTDXQUOTEGENERATIONSERVICESOCKETP
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
 
 # Enable confidential guest support.
 # Toggling that setting may trigger different hardware features, ranging
@@ -43,7 +44,7 @@ confidential_guest = true
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -81,7 +82,7 @@ firmware_volume = "@FIRMWARETDVFVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -89,13 +90,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@TDXCPUFEATURES@"
+cpu_features="@TDXCPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -140,7 +140,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -153,13 +153,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -240,28 +240,24 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently implemented
-# for virtio-scsi and virtio-blk.
+# handled in a separate IO thread. This is currently only implemented
+# for SCSI.
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Independent IOThreads enables IO to be processed in a separate thread, it is
-# for QEMU hotplug device attach to iothread, like virtio-blk.
-indep_iothreads = @DEFINDEPIOTHREADS@
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -269,7 +265,7 @@ indep_iothreads = @DEFINDEPIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -279,7 +275,7 @@ enable_mem_prealloc = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -287,7 +283,7 @@ reclaim_guest_freed_memory = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -304,11 +300,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -324,7 +320,7 @@ vhost_user_reconnect_timeout_sec = 0
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -339,17 +335,17 @@ pflashes = []
 # to enable debug output where available. And Debug also enable the hmp socket.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -361,11 +357,11 @@ disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -377,7 +373,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -399,18 +395,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -420,10 +415,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -431,7 +425,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -442,20 +436,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -470,12 +464,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -494,17 +488,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -518,7 +512,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -531,14 +525,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 60)
@@ -548,7 +542,7 @@ dial_timeout = 60
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -566,19 +560,19 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -586,23 +580,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -610,7 +603,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -618,7 +611,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -627,13 +620,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT_TEE@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_TEE@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -654,22 +647,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -692,22 +685,3 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-qemu.toml.in

@@ -15,18 +15,41 @@
 path = "@QEMUPATH@"
 kernel = "@KERNELPATH@"
 image = "@IMAGEPATH@"
+# initrd = "@INITRDPATH@"
 machine_type = "@MACHINETYPE@"
 
 # rootfs filesystem type:
 #   - ext4 (default)
 #   - xfs
 #   - erofs
-rootfs_type = @DEFROOTFSTYPE@
+rootfs_type=@DEFROOTFSTYPE@
+
+# Enable confidential guest support.
+# Toggling that setting may trigger different hardware features, ranging
+# from memory encryption to both memory and CPU-state encryption and integrity.
+# The Kata Containers runtime dynamically detects the available feature set and
+# aims at enabling the largest possible one, returning an error if none is
+# available, or none is supported by the hypervisor.
+#
+# Known limitations:
+# * Does not work by design:
+#   - CPU Hotplug 
+#   - Memory Hotplug
+#   - NVDIMM devices
+#
+# Default false
+# confidential_guest = true
+
+# Choose AMD SEV-SNP confidential guests
+# In case of using confidential guests on AMD hardware that supports both SEV
+# and SEV-SNP, the following enables SEV-SNP guests. SEV guests are default.
+# Default false
+# sev_snp_guest = true
 
 # Enable running QEMU VMM as a non-root user.
 # By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
 # a non-root random user. See documentation for the limitations of this mode.
-rootless = false
+# rootless = true
 
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
@@ -64,7 +87,7 @@ firmware_volume = "@FIRMWAREVOLUMEPATH@"
 # Machine accelerators
 # comma-separated list of machine accelerators to pass to the hypervisor.
 # For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators = "@MACHINEACCELERATORS@"
+machine_accelerators="@MACHINEACCELERATORS@"
 
 # Qemu seccomp sandbox feature
 # comma-separated list of seccomp sandbox features to control the syscall access.
@@ -72,13 +95,12 @@ machine_accelerators = "@MACHINEACCELERATORS@"
 # Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
 # Another note: enabling this feature may reduce performance, you may enable
 # /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-# Recommended value when enabling: "on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-seccompsandbox = "@DEFSECCOMPSANDBOXPARAM@"
+#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
 
 # CPU features
 # comma-separated list of cpu features to pass to the cpu
 # For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features = "@CPUFEATURES@"
+cpu_features="@CPUFEATURES@"
 
 # Default number of vCPUs per SB/VM:
 # unspecified or 0                --> will be set to @DEFVCPUS@
@@ -123,7 +145,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -136,13 +158,13 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Specifies virtio-mem will be enabled or not.
 # Please note that this option should be used with the command
 # "echo 1 > /proc/sys/vm/overcommit_memory".
 # Default false
-enable_virtio_mem = false
+#enable_virtio_mem = true
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -223,28 +245,24 @@ block_device_aio = "@DEFBLOCKDEVICEAIO_QEMU@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently implemented
-# for virtio-scsi and virtio-blk.
+# handled in a separate IO thread. This is currently only implemented
+# for SCSI.
 #
 enable_iothreads = @DEFENABLEIOTHREADS@
 
-# Independent IOThreads enables IO to be processed in a separate thread, it is
-# for QEMU hotplug device attach to iothread, like virtio-blk.
-indep_iothreads = @DEFINDEPIOTHREADS@
-
 # Enable pre allocation of VM RAM, default false
 # Enabling this will result in lower container density
 # as all of the memory will be allocated and locked
@@ -252,7 +270,7 @@ indep_iothreads = @DEFINDEPIOTHREADS@
 # upfront or in the cases where you want memory latencies
 # to be very predictable
 # Default false
-enable_mem_prealloc = false
+#enable_mem_prealloc = true
 
 # Reclaim guest freed memory.
 # Enabling this will result in the VM balloon device having f_reporting=on set.
@@ -262,7 +280,7 @@ enable_mem_prealloc = false
 # the VM.
 #
 # Default false
-reclaim_guest_freed_memory = false
+#reclaim_guest_freed_memory = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -270,7 +288,7 @@ reclaim_guest_freed_memory = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vhost-user storage device, default false
 # Enabling this will result in some Linux reserved block type
@@ -287,11 +305,11 @@ vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # Enable IOMMU_PLATFORM, default false
 # Enabling this will result in the VM device having iommu_platform=on set
-enable_iommu_platform = false
+#enable_iommu_platform = true
 
 # List of valid annotations values for the vhost user store path
 # The default if not set is empty (all annotations rejected.)
@@ -307,7 +325,7 @@ vhost_user_reconnect_timeout_sec = 0
 # will disable this feature. In the case of virtio-fs, this is enabled
 # automatically and '/dev/shm' is used as the backing folder.
 # This option will be ignored if VM templating is enabled.
-file_mem_backend = "@DEFFILEMEMBACKEND@"
+#file_mem_backend = "@DEFFILEMEMBACKEND@"
 
 # List of valid annotations values for the file_mem_backend annotation
 # The default if not set is empty (all annotations rejected.)
@@ -322,7 +340,7 @@ pflashes = []
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # This option allows to add an extra HMP or QMP socket when `enable_debug = true`
 #
@@ -337,17 +355,17 @@ enable_debug = false
 #
 # If set to the empty string "", no extra monitor socket is added. This is
 # the default.
-extra_monitor_socket = ""
+#extra_monitor_socket = hmp
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 # This is the msize used for 9p shares. It is the number of bytes
 # used for 9p packet payload.
-msize_9p = @DEFMSIZE9P@
+#msize_9p = @DEFMSIZE9P@
 
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
@@ -358,24 +376,24 @@ disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
 # Enable hot-plugging of VFIO devices to a bridge-port, 
 # root-port or switch-port. 
 # The default setting is  "no-port"
-hot_plug_vfio = "no-port"
+#hot_plug_vfio = "root-port" 
 
 # In a confidential compute environment hot-plugging can compromise
 # security. 
 # Enable cold-plugging of VFIO devices to a bridge-port, 
 # root-port or switch-port. 
 # The default setting is  "no-port", which means disabled. 
-cold_plug_vfio = "no-port" 
+#cold_plug_vfio = "root-port" 
 
 # Before hot plugging a PCIe device, you need to add a pcie_root_port device.
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
 # Default 0
-pcie_root_port = 0
+#pcie_root_port = 2
 
 # If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
 # security (vhost-net runs ring0) for network I/O performance.
-disable_vhost_net = false
+#disable_vhost_net = true
 
 #
 # Default entropy source.
@@ -387,7 +405,7 @@ disable_vhost_net = false
 # The source of entropy /dev/urandom is non-blocking and provides a
 # generally acceptable source of entropy. It should work well for pretty much
 # all practical purposes.
-entropy_source= "@DEFENTROPYSOURCE@"
+#entropy_source= "@DEFENTROPYSOURCE@"
 
 # List of valid annotations values for entropy_source
 # The default if not set is empty (all annotations rejected.)
@@ -409,18 +427,17 @@ valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 #
 # Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
 # Default 0-sized value means unlimited rate.
-rx_rate_limiter_max_rate = 0
+#rx_rate_limiter_max_rate = 0
 # Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
 # In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
 # to discipline traffic.
 # Default 0-sized value means unlimited rate.
-tx_rate_limiter_max_rate = 0
+#tx_rate_limiter_max_rate = 0
 
 # Set where to save the guest memory dump file.
 # If set, when GUEST_PANICKED event occurred,
@@ -430,10 +447,9 @@ tx_rate_limiter_max_rate = 0
 # The dumped file(also called vmcore) can be processed with crash or gdb.
 #
 # WARNING:
-#   Dump guest's memory can take very long depending on the amount of guest memory
+#   Dump guest’s memory can take very long depending on the amount of guest memory
 #   and use much disk space.
-# Recommended value when enabling: "/var/crash/kata"
-guest_memory_dump_path = ""
+#guest_memory_dump_path="/var/crash/kata"
 
 # If enable paging.
 # Basically, if you want to use "gdb" rather than "crash",
@@ -441,7 +457,7 @@ guest_memory_dump_path = ""
 # then you should enable paging.
 #
 # See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-guest_memory_dump_paging = false
+#guest_memory_dump_paging=false
 
 # Enable swap in the guest. Default false.
 # When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
@@ -452,20 +468,20 @@ guest_memory_dump_paging = false
 # If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
 # If swap_in_bytes and memory_limit_in_bytes is not set, the size should
 # be default_memory.
-enable_guest_swap = false
+#enable_guest_swap = true
 
 # use legacy serial for guest console if available and implemented for architecture. Default false
-use_legacy_serial = false
+#use_legacy_serial = true
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
 # Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
 # with `SELINUX=yes`.
 # (default: true)
-disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
+disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
 
 
 [factory]
@@ -480,12 +496,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 # Specifies the path of template.
 #
 # Default "/run/vc/vm/template"
-template_path = "/run/vc/vm/template"
+#template_path = "/run/vc/vm/template"
 
 # The number of caches of VMCache:
 # unspecified or == 0   --> VMCache is disabled
@@ -504,17 +520,17 @@ template_path = "/run/vc/vm/template"
 # a new sandbox.
 #
 # Default 0
-vm_cache_number = 0
+#vm_cache_number = 0
 
 # Specify the address of the Unix socket that is used by VMCache.
 #
 # Default /var/run/kata-containers/cache.sock
-vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
+#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -528,7 +544,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -541,14 +557,14 @@ enable_tracing = false
 #  * The module is not available in the guest or it doesn't met the guest kernel
 #    requirements, like architecture and version.
 #
-kernel_modules = []
+kernel_modules=[]
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 45)
@@ -556,13 +572,13 @@ dial_timeout = 45
 
 # Confidential Data Hub API timeout value in seconds
 # (default: 50)
-cdh_api_timeout = 50
+#cdh_api_timeout = 50
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -580,19 +596,19 @@ enable_debug = false
 #     Uses tc filter rules to redirect traffic from the network interface
 #     provided by plugin to a tap interface connected to the VM.
 #
-internetworking_model = "@DEFNETWORKMODEL_QEMU@"
+internetworking_model="@DEFNETWORKMODEL_QEMU@"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
 # machine and applied by the kata agent. If set to true, seccomp is not applied
 # within the guest
 # (default: true)
-disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
+disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
 
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = false
+# enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -600,23 +616,22 @@ enable_vcpus_pinning = false
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -624,7 +639,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -632,7 +647,7 @@ disable_new_netns = false
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -641,13 +656,13 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 # - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt = @DEFSTATICRESOURCEMGMT@
+static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT@
 
 # If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
 # This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
 # If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
 # These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts = @DEFBINDMOUNTS@
+sandbox_bind_mounts=@DEFBINDMOUNTS@
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -668,22 +683,22 @@ sandbox_bind_mounts = @DEFBINDMOUNTS@
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir = @DEFDISABLEGUESTEMPTYDIR@
+disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -701,22 +716,3 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-remote.toml.in

@@ -16,6 +16,24 @@
 remote_hypervisor_socket = "/run/peerpod/hypervisor.sock"
 remote_hypervisor_timeout = 600
 
+
+# Enable confidential guest support.
+# Toggling that setting may trigger different hardware features, ranging
+# from memory encryption to both memory and CPU-state encryption and integrity.
+# The Kata Containers runtime dynamically detects the available feature set and
+# aims at enabling the largest possible one, returning an error if none is
+# available, or none is supported by the hypervisor.
+#
+# Known limitations:
+# * Does not work by design:
+#   - CPU Hotplug
+#   - Memory Hotplug
+#   - NVDIMM devices
+#
+# Default false
+# confidential_guest = true
+
+
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
 # of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
@@ -84,13 +102,13 @@ default_bridges = @DEFBRIDGES@
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
 # Note: the remote hypervisor uses the peer pod config to determine the memory of the VM
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # This option changes the default hypervisor and kernel parameters
 # to enable debug output where available. And Debug also enable the hmp socket.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Path to OCI hook binaries in the *guest rootfs*.
 # This does not affect host-side hooks which must instead be added to
@@ -107,11 +125,10 @@ enable_debug = false
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 
 # disable applying SELinux on the VMM process (default false)
-disable_selinux = @DEFDISABLESELINUX@
+disable_selinux=@DEFDISABLESELINUX@
 
 # disable applying SELinux on the container process
 # If set to false, the type `container_t` is applied to the container process by default.
@@ -124,7 +141,7 @@ disable_guest_selinux = true
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -138,24 +155,24 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Enable debug console.
 
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 30)
-dial_timeout = 30
+#dial_timeout = 30
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -174,7 +191,7 @@ enable_debug = false
 #     provided by plugin to a tap interface connected to the VM.
 #
 # Note: The remote hypervisor, uses it's own network, so "none" is required
-internetworking_model = "none"
+internetworking_model="none"
 
 # disable guest seccomp
 # Determines whether container seccomp profiles are passed to the virtual
@@ -182,7 +199,7 @@ internetworking_model = "none"
 # within the guest
 # (default: true)
 # Note: The remote hypervisor has a different guest, so currently requires this to be set to true
-disable_guest_seccomp = true
+disable_guest_seccomp=true
 
 
 # Apply a custom SELinux security policy to the container process inside the VM.
@@ -191,23 +208,22 @@ disable_guest_seccomp = true
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -224,7 +240,7 @@ disable_new_netns = true
 # The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
 # The sandbox cgroup is constrained if there is no container type annotation.
 # See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
+sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
 
 # If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
 # this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
@@ -234,7 +250,7 @@ sandbox_cgroup_only = @DEFSANDBOXCGROUPONLY@
 #   does not yet support sandbox sizing annotations.
 # - When running single containers using a tool like ctr, container sizing information will be available.
 # Note: the remote hypervisor uses the peer pod config to determine the sandbox size, so requires this to be set to true
-static_sandbox_resource_mgmt = true
+static_sandbox_resource_mgmt=true
 
 # VFIO Mode
 # Determines how VFIO devices should be be presented to the container.
@@ -255,23 +271,23 @@ static_sandbox_resource_mgmt = true
 #    Using this mode requires specially built workloads that know how
 #    to locate the relevant device interfaces within the VM.
 #
-vfio_mode = "@DEFVFIOMODE@"
+vfio_mode="@DEFVFIOMODE@"
 
 # If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
 # be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
 # Note: remote hypervisor has no sharing of emptydir mounts from host to guest
-disable_guest_empty_dir = false
+disable_guest_empty_dir=false
 
 # Enabled experimental feature list, format: ["a", "b"].
 # Experimental features are features not stable enough for production,
 # they may break compatibility, and are prepared for a big version bump.
 # Supported experimental features:
 # (default: [])
-experimental = @DEFAULTEXPFEATURES@
+experimental=@DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+# enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -289,22 +305,3 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/config/configuration-stratovirt.toml.in

@@ -13,7 +13,8 @@
 [hypervisor.stratovirt]
 path = "@STRATOVIRTPATH@"
 kernel = "@KERNELPATH_STRATOVIRT@"
-image = "@IMAGEPATH@"
+#image = "@IMAGEPATH@"
+initrd = "@INITRDPATH@"
 machine_type = "@DEFMACHINETYPE_STRATOVIRT@"
 
 # rootfs filesystem type:
@@ -88,7 +89,7 @@ default_memory = @DEFMEMSZ@
 # Default memory slots per SB/VM.
 # If unspecified then it will be set @DEFMEMSLOTS@.
 # This is will determine the times that memory will be hotadded to sandbox/VM.
-memory_slots = @DEFMEMSLOTS@
+#memory_slots = @DEFMEMSLOTS@
 
 # Default maximum memory in MiB per SB / VM
 # unspecified or == 0           --> will be set to the actual amount of physical RAM
@@ -101,7 +102,7 @@ default_maxmemory = @DEFMAXMEMSZ@
 # If set block storage driver (block_device_driver) to "nvdimm",
 # should set memory_offset to the size of block device.
 # Default 0
-memory_offset = 0
+#memory_offset = 0
 
 # Disable block device from being used for a container's rootfs.
 # In case of a storage driver like devicemapper where a container's
@@ -163,17 +164,17 @@ block_device_driver = "@DEFBLOCKSTORAGEDRIVER_STRATOVIRT@"
 
 # Specifies cache-related options will be set to block devices or not.
 # Default false
-block_device_cache_set = false
+#block_device_cache_set = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
 # Default false
-block_device_cache_direct = false
+#block_device_cache_direct = true
 
 # Specifies cache-related options for block devices.
 # Denotes whether flush requests for the device are ignored.
 # Default false
-block_device_cache_noflush = false
+#block_device_cache_noflush = true
 
 # Enable huge pages for VM RAM, default false
 # Enabling this will result in the VM memory
@@ -181,25 +182,25 @@ block_device_cache_noflush = false
 # This is useful when you want to use vhost-user network
 # stacks within the container. This will automatically
 # result in memory pre allocation
-enable_hugepages = false
+#enable_hugepages = true
 
 # Enable vIOMMU, default false
 # Enabling this will result in the VM having a vIOMMU device
 # This will also add the following options to the kernel's
 # command line: intel_iommu=on,iommu=pt
-enable_iommu = false
+#enable_iommu = true
 
 # This option changes the default hypervisor and kernel parameters
 # to enable debug output where available.
 #
 # Default false
-enable_debug = false
+#enable_debug = true
 
 # Disable the customizations done in the runtime when it detects
 # that it is running on top a VMM. This will result in the runtime
 # behaving as it would when running on bare metal.
 #
-disable_nesting_checks = false
+#disable_nesting_checks = true
 
 #
 # Default entropy source.
@@ -228,8 +229,7 @@ entropy_source = "@DEFENTROPYSOURCE@"
 # https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
 # Warnings will be logged if any error is encountered while scanning for hooks,
 # but it will not abort container execution.
-# Recommended value when enabling: "/usr/share/oci/hooks"
-guest_hook_path = ""
+#guest_hook_path = "/usr/share/oci/hooks"
 
 # disable applying SELinux on the VMM process (default false)
 disable_selinux = @DEFDISABLESELINUX@
@@ -253,12 +253,12 @@ disable_guest_selinux = @DEFDISABLEGUESTSELINUX@
 # Note: Requires "initrd=" to be set ("image=" is not supported).
 #
 # Default false
-enable_template = false
+#enable_template = true
 
 [agent.@PROJECT_TYPE@]
 # If enabled, make the agent display debug-level messages.
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 
 # Enable agent tracing.
 #
@@ -272,7 +272,7 @@ enable_debug = false
 #   increasing the container shutdown time slightly.
 #
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Comma separated list of kernel modules and their parameters.
 # These modules will be loaded in the guest kernel using modprobe(8).
@@ -292,7 +292,7 @@ kernel_modules = []
 # If enabled, user can connect guest OS running inside hypervisor
 # through "kata-runtime exec <sandbox-id>" command
 
-debug_console_enabled = false
+#debug_console_enabled = true
 
 # Agent connection dialing timeout value in seconds
 # (default: 45)
@@ -300,13 +300,13 @@ dial_timeout = 45
 
 # Confidential Data Hub API timeout value in seconds
 # (default: 50)
-cdh_api_timeout = 50
+#cdh_api_timeout = 50
 
 [runtime]
 # If enabled, the runtime will log additional debug messages to the
 # system log
 # (default: disabled)
-enable_debug = false
+#enable_debug = true
 #
 # Internetworking model
 # Determines how the VM should be connected to the
@@ -336,7 +336,7 @@ disable_guest_seccomp = @DEFDISABLEGUESTSECCOMP@
 # vCPUs pinning settings
 # if enabled, each vCPU thread will be scheduled to a fixed CPU
 # qualified condition: num(vCPU threads) == num(CPUs in sandbox's CPUSet)
-enable_vcpus_pinning = true
+#enable_vcpus_pinning = false
 
 # Apply a custom SELinux security policy to the container process inside the VM.
 # This is used when you want to apply a type other than the default `container_t`,
@@ -344,23 +344,22 @@ enable_vcpus_pinning = true
 # (format: "user:role:type")
 # Note: You cannot specify MCS policy with the label because the sensitivity levels and
 # categories are determined automatically by high-level container runtimes such as containerd.
-# Example value when enabling: "system_u:system_r:container_t"
-guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
+#guest_selinux_label = "@DEFGUESTSELINUXLABEL@"
 
 # If enabled, the runtime will create opentracing.io traces and spans.
 # (See https://www.jaegertracing.io/docs/getting-started).
 # (default: disabled)
-enable_tracing = false
+#enable_tracing = true
 
 # Set the full url to the Jaeger HTTP Thrift collector.
 # The default if not set will be "http://localhost:14268/api/traces"
-jaeger_endpoint = ""
+#jaeger_endpoint = ""
 
 # Sets the username to be used if basic auth is required for Jaeger.
-jaeger_user = ""
+#jaeger_user = ""
 
 # Sets the password to be used if basic auth is required for Jaeger.
-jaeger_password = ""
+#jaeger_password = ""
 
 # If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
 # This option may have some potential impacts to your host. It should only be used when you know what you're doing.
@@ -368,7 +367,7 @@ jaeger_password = ""
 # with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
 # (like OVS) directly.
 # (default: false)
-disable_new_netns = false
+#disable_new_netns = true
 
 # if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
 # The container cgroups in the host are not created, just one single cgroup per sandbox.
@@ -400,7 +399,7 @@ experimental = @DEFAULTEXPFEATURES@
 
 # If enabled, user can run pprof tools with shim v2 process through kata-monitor.
 # (default: false)
-enable_pprof = false
+#enable_pprof = true
 
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
@@ -418,22 +417,3 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
-
-# pod_resource_api_sock specifies the unix socket for the Kubelet's
-# PodResource API endpoint. If empty, kubernetes based cold plug
-# will not be attempted. In order for this feature to work, the
-# KubeletPodResourcesGet featureGate must be enabled in Kubelet,
-# if using Kubelet older than 1.34.
-#
-# The pod resource API's socket is relative to the Kubelet's root-dir,
-# which is defined by the cluster admin, and its location is:
-# ${KubeletRootDir}/pod-resources/kubelet.sock
-#
-# cold_plug_vfio(see hypervisor config) acts as a feature gate:
-#      cold_plug_vfio = no_port (default) => no cold plug
-#      cold_plug_vfio != no_port AND pod_resource_api_sock = "" => need
-#              explicit CDI annotation for cold plug (applies mainly
-#              to non-k8s cases)
-#      cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet
-#              based cold plug.
-pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@"

src/runtime/go.mod

@@ -13,8 +13,8 @@ require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/container-orchestrated-devices/container-device-interface v0.6.0
 	github.com/containerd/cgroups v1.1.0
-	github.com/containerd/console v1.0.5
-	github.com/containerd/containerd v1.7.29
+	github.com/containerd/console v1.0.4
+	github.com/containerd/containerd v1.7.27
 	github.com/containerd/containerd/api v1.9.0
 	github.com/containerd/cri-containerd v1.19.0
 	github.com/containerd/fifo v1.1.0
@@ -35,11 +35,10 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/intel-go/cpuid v0.0.0-20210602155658-5747e5cec0d9
 	github.com/mdlayher/vsock v1.2.1
-	github.com/moby/sys/mountinfo v0.7.2
 	github.com/moby/sys/userns v0.1.0
-	github.com/opencontainers/runc v1.2.8
+	github.com/opencontainers/runc v1.2.6
 	github.com/opencontainers/runtime-spec v1.2.1
-	github.com/opencontainers/selinux v1.13.0
+	github.com/opencontainers/selinux v1.12.0
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.22.0
@@ -48,7 +47,7 @@ require (
 	github.com/prometheus/procfs v0.15.1
 	github.com/safchain/ethtool v0.5.10
 	github.com/sirupsen/logrus v1.9.3
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.10.0
 	github.com/urfave/cli v1.22.15
 	github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8
 	github.com/vishvananda/netns v0.0.5
@@ -57,18 +56,16 @@ require (
 	go.opentelemetry.io/otel/exporters/jaeger v1.0.0
 	go.opentelemetry.io/otel/sdk v1.35.0
 	go.opentelemetry.io/otel/trace v1.35.0
-	golang.org/x/oauth2 v0.30.0
-	golang.org/x/sys v0.34.0
+	golang.org/x/oauth2 v0.29.0
+	golang.org/x/sys v0.33.0
 	google.golang.org/grpc v1.72.0
 	google.golang.org/protobuf v1.36.6
 	k8s.io/apimachinery v0.33.0
 	k8s.io/cri-api v0.33.0
-	k8s.io/kubelet v0.33.0
 	tags.cncf.io/container-device-interface v1.0.1
 )
 
 require (
-	cyphar.com/go-pathrs v0.2.1 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
@@ -86,7 +83,7 @@ require (
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/containernetworking/cni v1.3.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
-	github.com/cyphar/filepath-securejoin v0.6.0 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
@@ -111,6 +108,7 @@ require (
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moby/locker v1.0.1 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
 	github.com/moby/sys/symlink v0.2.0 // indirect
@@ -131,10 +129,10 @@ require (
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect
 	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
-	golang.org/x/mod v0.26.0 // indirect
-	golang.org/x/net v0.42.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/net v0.40.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
 	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

src/runtime/go.sum

@@ -1,8 +1,6 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 code.cloudfoundry.org/bytefmt v0.0.0-20211005130812-5bb3c17173e5 h1:tM5+dn2C9xZw1RzgI6WTQW1rGqdUimKB3RFbyu4h6Hc=
 code.cloudfoundry.org/bytefmt v0.0.0-20211005130812-5bb3c17173e5/go.mod h1:v4VVB6oBMz/c9fRY6vZrwr5xKRWOH5NPDjQZlPk0Gbs=
-cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
-cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 h1:59MxjQVfjXsBpLy+dbd2/ELV5ofnUkUZBvWSC85sheA=
@@ -36,10 +34,10 @@ github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaD
 github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
 github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=
 github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
-github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc=
-github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
-github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
-github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
+github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
+github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
+github.com/containerd/containerd v1.7.27 h1:yFyEyojddO3MIGVER2xJLWoCIn+Up4GaHFquP7hsFII=
+github.com/containerd/containerd v1.7.27/go.mod h1:xZmPnl75Vc+BLGt4MIfu6bp+fy03gdHAn9bz+FreFR0=
 github.com/containerd/containerd/api v1.9.0 h1:HZ/licowTRazus+wt9fM6r/9BQO7S0vD5lMcWspGIg0=
 github.com/containerd/containerd/api v1.9.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
 github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
@@ -73,8 +71,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cri-o/cri-o v1.34.0 h1:ux2URwAyENy5e5hD9Z95tshdfy98eqatZk0fxx3rhuk=
 github.com/cri-o/cri-o v1.34.0/go.mod h1:kP40HG+1EW5CDNHjqQBFhb6dehT5dCBKcmtO5RZAm6k=
-github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is=
-github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
+github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
+github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -240,14 +238,14 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/opencontainers/runc v1.2.8 h1:RnEICeDReapbZ5lZEgHvj7E9Q3Eex9toYmaGBsbvU5Q=
-github.com/opencontainers/runc v1.2.8/go.mod h1:cC0YkmZcuvr+rtBZ6T7NBoVbMGNAdLa/21vIElJDOzI=
+github.com/opencontainers/runc v1.2.6 h1:P7Hqg40bsMvQGCS4S7DJYhUZOISMLJOB2iGX5COWiPk=
+github.com/opencontainers/runc v1.2.6/go.mod h1:dOQeFo29xZKBNeRBI0B19mJtfHv68YgCTh1X+YphA+4=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-tools v0.9.1-0.20250303011046-260e151b8552 h1:CkXngT0nixZqQUPDVfwVs3GiuhfTqCMk0V+OoHpxIvA=
 github.com/opencontainers/runtime-tools v0.9.1-0.20250303011046-260e151b8552/go.mod h1:T487Kf80NeF2i0OyVXHiylg217e0buz8pQsa0T791RA=
-github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+LGaWfbL84=
-github.com/opencontainers/selinux v1.13.0/go.mod h1:XxWTed+A/s5NNq4GmYScVy+9jzXhGBVEOAyucdRUY8s=
+github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
+github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 h1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=
@@ -289,8 +287,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/urfave/cli v1.22.15 h1:nuqt+pdC/KqswQKhETJjo7pvn/k4xMUxgW6liI7XpnM=
@@ -350,8 +348,8 @@ golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvx
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -364,18 +362,18 @@ golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
+golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -396,14 +394,14 @@ golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -413,8 +411,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
+golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -469,8 +467,6 @@ k8s.io/apimachinery v0.33.0 h1:1a6kHrJxb2hs4t8EE5wuR/WxKDwGN1FKH3JvDtA0CIQ=
 k8s.io/apimachinery v0.33.0/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
 k8s.io/cri-api v0.33.0 h1:YyGNgWmuSREqFPlP3XCstlHLilYdW898KwtKoaTYwBs=
 k8s.io/cri-api v0.33.0/go.mod h1:OLQvT45OpIA+tv91ZrpuFIGY+Y2Ho23poS7n115Aocs=
-k8s.io/kubelet v0.33.0 h1:4pJA2Ge6Rp0kDNV76KH7pTBiaV2T1a1874QHMcubuSU=
-k8s.io/kubelet v0.33.0/go.mod h1:iDnxbJQMy9DUNaML5L/WUlt3uJtNLWh7ZAe0JSp4Yi0=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=

src/runtime/pkg/containerd-shim-v2/create.go

@@ -23,6 +23,7 @@ import (
 	containerd_types "github.com/containerd/containerd/api/types"
 	"github.com/containerd/containerd/mount"
 	"github.com/containerd/typeurl/v2"
+	"github.com/kata-containers/kata-containers/src/runtime/pkg/device/config"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/utils"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/annotations"
@@ -112,12 +113,19 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con
 		if s.sandbox != nil {
 			return nil, fmt.Errorf("cannot create another sandbox in sandbox: %s", s.sandbox.ID())
 		}
+		// Here we deal with CDI devices that are cold-plugged (k8s) and
+		// for the single_container (nerdctl, podman, ...) use-case.
+		// We can provide additional directories where to search for
+		// CDI specs if needed. immutable OS's only have specific
+		// directories where applications can write too. For instance /opt/cdi
+		//
+		// _, err = withCDI(ociSpec.Annotations, []string{"/opt/cdi"}, ociSpec)
+		_, err = config.WithCDI(ociSpec.Annotations, []string{}, ociSpec)
+		if err != nil {
+			return nil, fmt.Errorf("adding CDI devices failed: %w", err)
+		}
 
 		s.config = runtimeConfig
-		err = coldPlugDevices(ctx, s, ociSpec)
-		if err != nil {
-			return nil, fmt.Errorf("device cold plug failed: %w", err)
-		}
 
 		// create tracer
 		// This is the earliest location we can create the tracer because we must wait

src/runtime/pkg/containerd-shim-v2/device_cold_plug.go

@@ -1,146 +0,0 @@
-// Copyright (c) 2025 NVIDIA CORPORATION.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package containerdshim
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"strings"
-
-	"github.com/kata-containers/kata-containers/src/runtime/pkg/device/config"
-	"github.com/opencontainers/runtime-spec/specs-go"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-	podresourcesv1 "k8s.io/kubelet/pkg/apis/podresources/v1"
-)
-
-const (
-	nameAnnotation      = "io.kubernetes.cri.sandbox-name"
-	namespaceAnnotation = "io.kubernetes.cri.sandbox-namespace"
-)
-
-// coldPlugDevices handles cold plug of CDI devices into the sandbox
-// kubelet's PodResources API is used for determining the devices to be
-// cold plugged, if so configured. Otherwise, cdi annotations can be used for
-// covering stand alone scenarios.
-func coldPlugDevices(ctx context.Context, s *service, ociSpec *specs.Spec) error {
-	if s.config.HypervisorConfig.ColdPlugVFIO == config.NoPort {
-		// device cold plug is not enabled
-		shimLog.Debug("cold_plug_vfio not enabled, skip device cold plug")
-		return nil
-	}
-
-	kubeletSock := s.config.PodResourceAPISock
-	if kubeletSock != "" {
-		return coldPlugWithAPI(ctx, s, ociSpec)
-	}
-
-	shimLog.Debug("config.PodResourceAPISock not set, skip k8s based device cold plug")
-
-	// Here we deal with CDI devices that are cold-plugged
-	// for the single_container (nerdctl, podman, ...) use-case.
-	// We can provide additional directories where to search for
-	// CDI specs if needed. immutable OS's only have specific
-	// directories where applications can write too. For instance /opt/cdi
-	_, err := config.WithCDI(ociSpec.Annotations, []string{}, ociSpec)
-	if err != nil {
-		return fmt.Errorf("CDI device injection failed: %w", err)
-	}
-	return nil
-}
-
-func coldPlugWithAPI(ctx context.Context, s *service, ociSpec *specs.Spec) error {
-	ann := ociSpec.Annotations
-	devices, err := getDeviceSpec(ctx, s.config.PodResourceAPISock, ann)
-	if err != nil {
-		return err
-	}
-
-	if len(devices) == 0 {
-		shimLog.WithField("pod", debugPodID(ann)).Debug("No devices found in Pod Resources, skip cold plug")
-		return nil
-	}
-
-	err = config.InjectCDIDevices(ociSpec, devices)
-	if err != nil {
-		return fmt.Errorf("cold plug: CDI device injection failed: %w", err)
-	}
-
-	return nil
-}
-
-// getDeviceSpec fetches the device information for the pod sandbox using
-// kubelet's pod resource api. This is necessary for cold plug because
-// the Kubelet does not pass the device information via CRI during
-// Sandbox creation.
-func getDeviceSpec(ctx context.Context, socket string, ann map[string]string) ([]string, error) {
-	podName := ann[nameAnnotation]
-	podNs := ann[namespaceAnnotation]
-
-	// create dialer for unix socket
-	dialer := func(ctx context.Context, target string) (net.Conn, error) {
-		// need this workaround to avoid duplicate prefix
-		addr := strings.TrimPrefix(target, "unix://")
-		return (&net.Dialer{}).DialContext(ctx, "unix", addr)
-	}
-
-	target := fmt.Sprintf("unix://%s", socket)
-	conn, err := grpc.NewClient(
-		target,
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithContextDialer(dialer),
-		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(16*1024*1024)),
-	)
-
-	if err != nil {
-		return nil, fmt.Errorf("cold plug: failed to connect to kubelet: %w", err)
-	}
-	defer conn.Close()
-
-	// create client
-	client := podresourcesv1.NewPodResourcesListerClient(conn)
-
-	// get all pod resources
-	prr := &podresourcesv1.GetPodResourcesRequest{
-		PodName:      podName,
-		PodNamespace: podNs,
-	}
-	resp, err := client.Get(ctx, prr)
-	if err != nil {
-		return nil, fmt.Errorf("cold plug: GetPodResources failed: %w", err)
-	}
-	podRes := resp.PodResources
-	if podRes == nil {
-		return nil, fmt.Errorf("cold plug: PodResources is nil")
-	}
-
-	// Process results
-	var devices []string
-	for _, container := range podRes.Containers {
-		for _, d := range container.Devices {
-			shimLog.WithField("container", container.Name).Debugf("Pod Resources Device: %s = %v\n",
-				d.ResourceName, d.DeviceIds)
-			cdiDevs := formatCDIDevIDs(d.ResourceName, d.DeviceIds)
-			devices = append(devices, cdiDevs...)
-		}
-	}
-
-	return devices, nil
-}
-
-// formatCDIDevIDs formats the way CDI package expects
-func formatCDIDevIDs(specName string, devIDs []string) []string {
-	var result []string
-	for _, id := range devIDs {
-		result = append(result, fmt.Sprintf("%s=%s", specName, id))
-	}
-	return result
-}
-
-func debugPodID(ann map[string]string) string {
-	return fmt.Sprintf("%s/%s", ann[namespaceAnnotation], ann[nameAnnotation])
-}

src/runtime/pkg/device/config/config.go

@@ -684,25 +684,6 @@ func WithCDI(annotations map[string]string, cdiSpecDirs []string, spec *specs.Sp
 		return spec, nil
 	}
 
-	if err = injectDevices(cdiSpecDirs, spec, devsFromAnnotations); err != nil {
-		return nil, err
-	}
-
-	// One crucial thing to keep in mind is that CDI device injection
-	// might add OCI Spec environment variables, hooks, and mounts as
-	// well. Therefore it is important that none of the corresponding
-	// OCI Spec fields are reset up in the call stack once we return.
-	return spec, nil
-}
-
-// InjectCDIDevices injects the specified devices into the oci spec.
-// Devices must be a slice of strings of the form
-// vendor.com/class=unique_name
-func InjectCDIDevices(spec *specs.Spec, devices []string) error {
-	return injectDevices(nil, spec, devices)
-}
-
-func injectDevices(cdiSpecDirs []string, spec *specs.Spec, devices []string) error {
 	var registry cdi.Registry
 	if len(cdiSpecDirs) > 0 {
 		// We can override the directories where to search for CDI specs
@@ -712,13 +693,22 @@ func injectDevices(cdiSpecDirs []string, spec *specs.Spec, devices []string) err
 		registry = cdi.GetRegistry()
 	}
 
-	if err := registry.Refresh(); err != nil {
-		return fmt.Errorf("CDI registry refresh failed: %w", err)
+	if err = registry.Refresh(); err != nil {
+		// We don't consider registry refresh failure a fatal error.
+		// For instance, a dynamically generated invalid CDI Spec file for
+		// any particular vendor shouldn't prevent injection of devices of
+		// different vendors. CDI itself knows better and it will fail the
+		// injection if necessary.
+		return nil, fmt.Errorf("CDI registry refresh failed: %w", err)
 	}
 
-	if _, err := registry.InjectDevices(spec, devices...); err != nil {
-		return fmt.Errorf("CDI device injection failed: %w", err)
+	if _, err := registry.InjectDevices(spec, devsFromAnnotations...); err != nil {
+		return nil, fmt.Errorf("CDI device injection failed: %w", err)
 	}
 
-	return nil
+	// One crucial thing to keep in mind is that CDI device injection
+	// might add OCI Spec environment variables, hooks, and mounts as
+	// well. Therefore it is important that none of the corresponding
+	// OCI Spec fields are reset up in the call stack once we return.
+	return spec, nil
 }

src/runtime/pkg/govmm/qemu/qmp.go

@@ -1101,7 +1101,7 @@ func (q *QMP) ExecuteDeviceDel(ctx context.Context, devID string) error {
 // disableModern indicates if virtio version 1.0 should be replaced by the
 // former version 0.9, as there is a KVM bug that occurs when using virtio
 // 1.0 in nested environments.
-func (q *QMP) ExecutePCIDeviceAdd(ctx context.Context, blockdevID, devID, driver, addr, bus, romfile string, queues int, shared, disableModern bool, iothreadID string) error {
+func (q *QMP) ExecutePCIDeviceAdd(ctx context.Context, blockdevID, devID, driver, addr, bus, romfile string, queues int, shared, disableModern bool) error {
 	args := map[string]interface{}{
 		"id":     devID,
 		"driver": driver,
@@ -1128,10 +1128,6 @@ func (q *QMP) ExecutePCIDeviceAdd(ctx context.Context, blockdevID, devID, driver
 		}
 	}
 
-	if iothreadID != "" {
-		args["iothread"] = iothreadID
-	}
-
 	return q.executeCommand(ctx, "device_add", args, nil)
 }