kata.runtime: 3.22.0 -> 3.23.0

nodeinstaller/internal/kataconfig/configuration-qemu-tdx.toml

@@ -67,7 +67,7 @@ valid_hypervisor_paths = ["PLACEHOLDER_FOR_DISTRO_QEMU_WITH_TDX_SUPPORT"]
 # may stop the virtual machine from booting.
 # To see the list of default parameters, enable hypervisor debug, create a
 # container and look for 'default-kernel-parameters' log entries.
-kernel_params = "cgroup_no_v1=all systemd.unified_cgroup_hierarchy=1 rootfs_verity.scheme=dm-verity rootfs_verity.hash=79cfffd61dabc19d336b31d15212db9b67637596c89325b6bdaa6195d0525ae3"
+kernel_params = "cgroup_no_v1=all systemd.unified_cgroup_hierarchy=1 rootfs_verity.scheme=dm-verity rootfs_verity.hash=c86b0e4e614d20df867de83665f7fdad7aaba397197d0daadcf00b98ed547958"
 
 # Path to the firmware.
 # If you want that qemu uses the default firmware leave this option empty

packages/by-name/kata/kernel-uvm/package.nix

@@ -57,7 +57,6 @@ let
         # 1. Add some options to enable using the kernel in NixOS. (As NixOS has a hard check on
         # whether all modules required for systemd are present, e.g.)
         substituteInPlace $config \
-          --replace-fail '# CONFIG_TMPFS_POSIX_ACL is not set' 'CONFIG_TMPFS_POSIX_ACL=y' \
           --replace-fail '# CONFIG_EFIVAR_FS is not set' 'CONFIG_EFIVAR_FS=y' \
           --replace-fail '# CONFIG_RD_ZSTD is not set' 'CONFIG_RD_ZSTD=y' \
           --replace-fail '# CONFIG_VFAT_FS is not se' 'CONFIG_VFAT_FS=y' \

packages/by-name/kata/release-tarball/package.nix

@@ -12,7 +12,7 @@ let
 in
 fetchzip {
   url = "https://github.com/kata-containers/kata-containers/releases/download/${version}/kata-static-${version}-amd64.tar.zst";
-  hash = "sha256-Hq9s43W+U52lSiWydoxqg0GLuDvFPgMxs2jFbqzELuk=";
+  hash = "sha256-Yoiejzk9NP5aDdVR3vo+STW18VvxQClzzQDH4F0/+uk=";
   stripRoot = false;
   nativeBuildInputs = [ zstd ];
 

packages/by-name/kata/runtime/0002-genpolicy-read-bundle-id-from-rootfs.patch

@@ -14,7 +14,7 @@ NOTE: fixes https://github.com/kata-containers/kata-containers/issues/10065
  1 file changed, 8 insertions(+), 21 deletions(-)
 
 diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
-index 07e0712e1cd71ed8cf17784c74caa7e78a1e4c10..c9205e2c84aba16ef5d0d332639e2f224c4a5fd8 100644
+index fa9931fc6ce81729f6e487fe7ec3032700745a58..e4bc2c6dbb917f34c058fbfaa2ed99f6e929205d 100644
 --- a/src/tools/genpolicy/rules.rego
 +++ b/src/tools/genpolicy/rules.rego
 @@ -662,9 +662,6 @@ allow_linux_sysctl(p_linux, i_linux) if {

packages/by-name/kata/runtime/0003-genpolicy-rules-remove-check-for-OCI-version.patch

@@ -9,7 +9,7 @@ Signed-off-by: Paul Meyer <[email protected]>
  1 file changed, 3 deletions(-)
 
 diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
-index c9205e2c84aba16ef5d0d332639e2f224c4a5fd8..068d77d1dd20079a25604b9ffc94c0be0f138e82 100644
+index e4bc2c6dbb917f34c058fbfaa2ed99f6e929205d..745b8e389d4c3199f917404d99a030504b6c6996 100644
 --- a/src/tools/genpolicy/rules.rego
 +++ b/src/tools/genpolicy/rules.rego
 @@ -90,9 +90,6 @@ CreateContainerRequest := {"ops": ops, "allowed": true} if {

packages/by-name/kata/runtime/0004-genpolicy-allow-image_guest_pull.patch

@@ -126,10 +126,10 @@ index 74686abf43436d9c5c5117d061f1faed79783f74..e927668e85b61c1d242c1052bf50d7a5
 -    }
 -}
 diff --git a/src/runtime/virtcontainers/kata_agent.go b/src/runtime/virtcontainers/kata_agent.go
-index 6fbf71646169348b104aa313deac32339fddaf6f..a81fcb347620f61646edf09aee3bfeaeee9f7965 100644
+index ed31e089edecb3708dcb5d4d147b217fb430f81c..027315e26bab88caf28eb5ffda80409a21edbdf2 100644
 --- a/src/runtime/virtcontainers/kata_agent.go
 +++ b/src/runtime/virtcontainers/kata_agent.go
-@@ -1694,7 +1694,7 @@ func getContainerTypeforCRI(c *Container) (string, string) {
+@@ -1719,7 +1719,7 @@ func getContainerTypeforCRI(c *Container) (string, string) {
  	return "", ""
  }
 
@@ -138,7 +138,7 @@ index 6fbf71646169348b104aa313deac32339fddaf6f..a81fcb347620f61646edf09aee3bfeae
  	container_annotations := c.GetAnnotations()
  	containerType, criContainerType := getContainerTypeforCRI(c)
 
-@@ -1727,20 +1727,9 @@ func handleImageGuestPullBlockVolume(c *Container, virtualVolumeInfo *types.Kata
+@@ -1752,20 +1752,9 @@ func handleImageGuestPullBlockVolume(c *Container, virtualVolumeInfo *types.Kata
  			return nil, fmt.Errorf("Failed to get image name from annotations")
  		}
  	}
@@ -160,7 +160,7 @@ index 6fbf71646169348b104aa313deac32339fddaf6f..a81fcb347620f61646edf09aee3bfeae
  	vol.Fstype = typeOverlayFS
  	return vol, nil
  }
-@@ -1751,7 +1740,7 @@ func handleVirtualVolumeStorageObject(c *Container, blockDeviceId string, virtVo
+@@ -1776,7 +1765,7 @@ func handleVirtualVolumeStorageObject(c *Container, blockDeviceId string, virtVo
  	if virtVolume.VolumeType == types.KataVirtualVolumeImageGuestPullType {
  		var err error
  		vol = &grpc.Storage{}
@@ -170,7 +170,7 @@ index 6fbf71646169348b104aa313deac32339fddaf6f..a81fcb347620f61646edf09aee3bfeae
  			return nil, err
  		}
 diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
-index 068d77d1dd20079a25604b9ffc94c0be0f138e82..2dac4d81f651d422b4267eb94d65417e1fcbf325 100644
+index 745b8e389d4c3199f917404d99a030504b6c6996..dd2b6ce6fc457d8e7dae256f06e96cb8a4313995 100644
 --- a/src/tools/genpolicy/rules.rego
 +++ b/src/tools/genpolicy/rules.rego
 @@ -1041,10 +1041,9 @@ allow_storages(p_storages, i_storages, bundle_id, sandbox_id) if {
@@ -250,10 +250,10 @@ index 068d77d1dd20079a25604b9ffc94c0be0f138e82..2dac4d81f651d422b4267eb94d65417e
  # ExecProcessRequest.process.Capabilities
  allow_exec_caps(i_caps) if {
 diff --git a/src/tools/genpolicy/src/yaml.rs b/src/tools/genpolicy/src/yaml.rs
-index 885d8b81962d1e29e823b1b4094d46f8791cfc05..a78c30a79addca66764f020f540efbf1f18fd8cf 100644
+index 7fb078b34043ed6c6cc04c6e4bd8596fa2d46419..c640694c22404b8501f843dfc3dcfb2ee7bd5c6d 100644
 --- a/src/tools/genpolicy/src/yaml.rs
 +++ b/src/tools/genpolicy/src/yaml.rs
-@@ -318,6 +318,17 @@ pub fn get_container_mounts_and_storages(
+@@ -321,6 +321,17 @@ pub fn get_container_mounts_and_storages(
              mount_and_storage::get_image_mount_and_storage(settings, policy_mounts, volume.0);
          }
      }

packages/by-name/kata/runtime/0006-genpolicy-support-mount-propagation-and-ro-mounts.patch

@@ -9,7 +9,7 @@ Subject: [PATCH] genpolicy: support mount propagation and ro-mounts
  2 files changed, 9 insertions(+), 2 deletions(-)
 
 diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
-index 2dac4d81f651d422b4267eb94d65417e1fcbf325..3ce3eab6e8c774de4b7de08aae9711c6314b6f1f 100644
+index dd2b6ce6fc457d8e7dae256f06e96cb8a4313995..ab644735ff5076a5dac28a786faa512adbe1e6ec 100644
 --- a/src/tools/genpolicy/rules.rego
 +++ b/src/tools/genpolicy/rules.rego
 @@ -130,7 +130,8 @@ allow_create_container_input if {

packages/by-name/kata/runtime/0009-genpolicy-support-dynamic-annotations.patch

@@ -15,7 +15,7 @@ where `XY` corresponds to a dynamic ID.
  3 files changed, 25 insertions(+), 8 deletions(-)
 
 diff --git a/src/tools/genpolicy/genpolicy-settings.json b/src/tools/genpolicy/genpolicy-settings.json
-index 8340cd33c7023d43ecfab6d34939e0b65bbe92a0..3cfe77c7d7d7f61e22f93532da33711ccb8a5e89 100644
+index f98ae153733569012bee35c8e6f197f621edb178..84e0738f4e1326babad93402eb750268238ab77e 100644
 --- a/src/tools/genpolicy/genpolicy-settings.json
 +++ b/src/tools/genpolicy/genpolicy-settings.json
 @@ -293,7 +293,10 @@
@@ -30,7 +30,7 @@ index 8340cd33c7023d43ecfab6d34939e0b65bbe92a0..3cfe77c7d7d7f61e22f93532da33711c
      },
      "kata_config": {
          "oci_version": "1.1.0",
-@@ -319,7 +322,8 @@
+@@ -321,7 +324,8 @@
                  "^AZURE_TENANT_ID=[A-Fa-f0-9-]*$",
                  "^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
                  "^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
@@ -41,7 +41,7 @@ index 8340cd33c7023d43ecfab6d34939e0b65bbe92a0..3cfe77c7d7d7f61e22f93532da33711c
          },
          "UpdateInterfaceRequest": {
 diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
-index 3ce3eab6e8c774de4b7de08aae9711c6314b6f1f..f959447cbb3fd33a8e9bc56ca1e04cab4a7fd37a 100644
+index ab644735ff5076a5dac28a786faa512adbe1e6ec..c520253f16d217e3bce3e5de32f9cfda5ece6e90 100644
 --- a/src/tools/genpolicy/rules.rego
 +++ b/src/tools/genpolicy/rules.rego
 @@ -230,18 +230,26 @@ allow_anno(p_oci, i_oci) if {
@@ -77,7 +77,7 @@ index 3ce3eab6e8c774de4b7de08aae9711c6314b6f1f..f959447cbb3fd33a8e9bc56ca1e04cab
      print("allow_anno_key 1: i key =", i_key)
 
 diff --git a/src/tools/genpolicy/src/policy.rs b/src/tools/genpolicy/src/policy.rs
-index b0a0eec25496eae534ac5a18c8683c158cf96051..f1492a768f9866a95148379c83cbd11e37c9ef97 100644
+index 107ea5c4a1522df4c62b361343dad07a4808f9a8..154fd5682767118d4cf97537935251c046a9af65 100644
 --- a/src/tools/genpolicy/src/policy.rs
 +++ b/src/tools/genpolicy/src/policy.rs
 @@ -428,9 +428,14 @@ pub struct CommonData {

packages/by-name/kata/runtime/0012-genpolicy-allow-RO-and-RW-for-sysfs-with-privileged-.patch → packages/by-name/kata/runtime/0011-genpolicy-allow-RO-and-RW-for-sysfs-with-privileged-.patch

@@ -10,7 +10,7 @@ Subject: [PATCH] genpolicy: allow RO and RW for sysfs with privileged
  2 files changed, 18 insertions(+), 1 deletion(-)
 
 diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
-index f959447cbb3fd33a8e9bc56ca1e04cab4a7fd37a..8512f840d041111e5a000615d0a63cc7d018d554 100644
+index c520253f16d217e3bce3e5de32f9cfda5ece6e90..6b9f321984254d2ef83ab9e84365bfe9097214f3 100644
 --- a/src/tools/genpolicy/rules.rego
 +++ b/src/tools/genpolicy/rules.rego
 @@ -1007,6 +1007,20 @@ check_mount(p_mount, i_mount, bundle_id, sandbox_id) if {
@@ -35,10 +35,10 @@ index f959447cbb3fd33a8e9bc56ca1e04cab4a7fd37a..8512f840d041111e5a000615d0a63cc7
  mount_source_allows(p_mount, i_mount, bundle_id, sandbox_id) if {
      regex1 := p_mount.source
 diff --git a/src/tools/genpolicy/src/policy.rs b/src/tools/genpolicy/src/policy.rs
-index f1492a768f9866a95148379c83cbd11e37c9ef97..15c71c8b39830178b4f9e2b8e77eec9a519b55c6 100644
+index 154fd5682767118d4cf97537935251c046a9af65..d93e9c3373ab779fbbf72d46cca51b20b7208444 100644
 --- a/src/tools/genpolicy/src/policy.rs
 +++ b/src/tools/genpolicy/src/policy.rs
-@@ -614,6 +614,9 @@ impl AgentPolicy {
+@@ -630,6 +630,9 @@ impl AgentPolicy {
          );
 
          let is_privileged = yaml_container.is_privileged();
@@ -48,7 +48,7 @@ index f1492a768f9866a95148379c83cbd11e37c9ef97..15c71c8b39830178b4f9e2b8e77eec9a
          let process = self.get_container_process(
              resource,
              yaml_container,
-@@ -623,7 +626,7 @@ impl AgentPolicy {
+@@ -639,7 +642,7 @@ impl AgentPolicy {
              is_privileged,
          );
 

packages/by-name/kata/runtime/0013-genpolicy-don-t-allow-mount-storage-for-declared-VOL.patch → packages/by-name/kata/runtime/0012-genpolicy-don-t-allow-mount-storage-for-declared-VOL.patch

@@ -12,7 +12,7 @@ Signed-off-by: Markus Rudy <[email protected]>
  4 files changed, 8 insertions(+), 62 deletions(-)
 
 diff --git a/src/tools/genpolicy/genpolicy-settings.json b/src/tools/genpolicy/genpolicy-settings.json
-index 3cfe77c7d7d7f61e22f93532da33711ccb8a5e89..489a50a464a3bb4b92faefed14e13c861dcfba7d 100644
+index 84e0738f4e1326babad93402eb750268238ab77e..98365292a918233a1fbb47128cca77bb0f2e1870 100644
 --- a/src/tools/genpolicy/genpolicy-settings.json
 +++ b/src/tools/genpolicy/genpolicy-settings.json
 @@ -183,18 +183,6 @@
@@ -98,7 +98,7 @@ index e3bab1e9b6d63b036221818ab5f24fa6b5c3d81c..e78e4b593d9a3eab051539d065940204
 
  /// EmptyDir volume settings loaded from genpolicy-settings.json.
 diff --git a/src/tools/genpolicy/src/yaml.rs b/src/tools/genpolicy/src/yaml.rs
-index a78c30a79addca66764f020f540efbf1f18fd8cf..e284d4e8443cff0207f7f088b5a957cb29028d1e 100644
+index c640694c22404b8501f843dfc3dcfb2ee7bd5c6d..25b67abec217316e22b337f5dfcae88f3b345034 100644
 --- a/src/tools/genpolicy/src/yaml.rs
 +++ b/src/tools/genpolicy/src/yaml.rs
 @@ -28,6 +28,7 @@ use crate::volume;
@@ -109,15 +109,15 @@ index a78c30a79addca66764f020f540efbf1f18fd8cf..e284d4e8443cff0207f7f088b5a957cb
  use log::debug;
  use protocols::agent;
  use serde::{Deserialize, Serialize};
-@@ -291,6 +292,7 @@ pub fn get_container_mounts_and_storages(
+@@ -294,6 +295,7 @@ pub fn get_container_mounts_and_storages(
      settings: &settings::Settings,
      volumes_option: &Option<Vec<volume::Volume>>,
  ) {
 +    let mut mountPaths = BTreeSet::new();
      if let Some(volumes) = volumes_option {
          if let Some(volume_mounts) = &container.volumeMounts {
              for volume in volumes {
-@@ -303,19 +305,19 @@ pub fn get_container_mounts_and_storages(
+@@ -306,19 +308,19 @@ pub fn get_container_mounts_and_storages(
                              volume,
                              volume_mount,
                          );

packages/by-name/kata/runtime/0016-agent-use-custom-implementation-for-secure-mounting.patch → packages/by-name/kata/runtime/0015-agent-use-custom-implementation-for-secure-mounting.patch

@@ -57,7 +57,7 @@ index 6a486fe183fb51670ab39cb67f5bae039640d5d6..dc31a2ddfc26509a3888a615d798d351
      Ok(())
  }
 diff --git a/src/agent/src/rpc.rs b/src/agent/src/rpc.rs
-index e7197da9d7b9ff2729ed465bf90f6558ab08c43e..e4effc42aa76fc012255b532a24a491b0fe56462 100644
+index 5c2e6c16ee055d4500497290c45732f62ef3e79b..dbaafa1ef89eb7bf664f3e8984fa8741ac2f586a 100644
 --- a/src/agent/src/rpc.rs
 +++ b/src/agent/src/rpc.rs
 @@ -107,7 +107,7 @@ use kata_types::k8s;

packages/by-name/kata/runtime/0016-genpolicy-don-t-apply-Nydus-workaround.patch

@@ -0,0 +1,77 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Markus Rudy <[email protected]>
+Date: Wed, 24 Sep 2025 09:13:07 +0200
+Subject: [PATCH] genpolicy: don't apply Nydus workaround
+
+Signed-off-by: Markus Rudy <[email protected]>
+---
+ src/tools/genpolicy/src/registry.rs | 55 +++++++++++++----------------
+ 1 file changed, 24 insertions(+), 31 deletions(-)
+
+diff --git a/src/tools/genpolicy/src/registry.rs b/src/tools/genpolicy/src/registry.rs
+index 1ba71946d420d91265c278b583f231241b92d4da..34c9285b049cc647f5e61507758fe617aabc8033 100644
+--- a/src/tools/genpolicy/src/registry.rs
++++ b/src/tools/genpolicy/src/registry.rs
+@@ -166,38 +166,31 @@ impl Container {
+         let mut passwd = String::new();
+         let mut group = String::new();
+
+-        // Nydus/guest_pull doesn't make available passwd/group files from layers properly.
+-        // See issue https://github.com/kata-containers/kata-containers/issues/11162
+-        let v1_policy = config.settings.cluster_config.pause_container_id_policy == "v1";
+-        if config.settings.cluster_config.guest_pull && (v1_policy || !is_pause_container) {
+-            info!("Guest pull is enabled, skipping passwd/group file parsing");
+-        } else {
+-            let image_layers = get_image_layers(
+-                &config.layers_cache,
+-                &mut client,
+-                &reference,
+-                &manifest,
+-                &config_layer,
+-            )
+-            .await
+-            .unwrap();
+-
+-            // Find the last layer with an /etc/* file, respecting whiteouts.
+-            info!("Parsing users and groups in image layers");
+-            for layer in &image_layers {
+-                if layer.passwd == WHITEOUT_MARKER {
+-                    passwd = String::new();
+-                } else if !layer.passwd.is_empty() {
+-                    passwd = layer.passwd.clone();
+-                    debug!("Container:new: Found in image layer passwd = \n{passwd}");
+-                }
++        let image_layers = get_image_layers(
++            &config.layers_cache,
++            &mut client,
++            &reference,
++            &manifest,
++            &config_layer,
++        )
++        .await
++        .unwrap();
++
++        // Find the last layer with an /etc/* file, respecting whiteouts.
++        info!("Parsing users and groups in image layers");
++        for layer in &image_layers {
++            if layer.passwd == WHITEOUT_MARKER {
++                passwd = String::new();
++            } else if !layer.passwd.is_empty() {
++                passwd = layer.passwd.clone();
++                debug!("Container:new: Found in image layer passwd = \n{passwd}");
++            }
+
+-                if layer.group == WHITEOUT_MARKER {
+-                    group = String::new();
+-                } else if !layer.group.is_empty() {
+-                    group = layer.group.clone();
+-                    debug!("Container:new: Found in image layer group = \n{group}");
+-                }
++            if layer.group == WHITEOUT_MARKER {
++                group = String::new();
++            } else if !layer.group.is_empty() {
++                group = layer.group.clone();
++                debug!("Container:new: Found in image layer group = \n{group}");
+             }
+         }
+