From deaa32a12634fe9353e76b5c35f8e0d1a3436d48 Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Wed, 10 Sep 2025 16:31:17 +0200
Subject: [PATCH 1/7] Bump to Kata Containers 3.20

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 .gitignore           | 2 ++
 kata-containers.spec | 7 +++++--
 test-kata-rpm.sh     | 4 ++--
 vendor-tarball.sh    | 2 +-
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index cf34e1f..a94ec42 100644
--- a/.gitignore
+++ b/.gitignore
@@ -67,3 +67,5 @@
 /kata-containers-3.18.0-vendor.tar.gz
 /kata-containers-3.19.1.tar.gz
 /kata-containers-3.19.1-vendor.tar.gz
+/kata-containers-3.20.0.tar.gz
+/kata-containers-3.20.0-vendor.tar.gz
diff --git a/kata-containers.spec b/kata-containers.spec
index cdb4a9a..de639ee 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -28,7 +28,7 @@
 %endif
 
 # https://github.com/kata-containers/kata-containers
-Version: 3.19.1
+Version: 3.20.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
@@ -56,7 +56,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
 # Unlike for RHEL, we cannot strip it down because we build all components
 # (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}.1
+Release:    1%{?rcrel}%{?dist}
 Summary:    Kata Containers version 3.x repository
 License:    Apache-2.0
 Url:        https://%{download}
@@ -390,6 +390,9 @@ fi
 
 
 %changelog
+* Wed Sep 10 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.20.0-1
+- kata-containers 3.20.0
+
 * Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 3.19.1-1.1
 - Rebuild for golang-1.25.0
 
diff --git a/test-kata-rpm.sh b/test-kata-rpm.sh
index 76c6ac3..f9e893c 100755
--- a/test-kata-rpm.sh
+++ b/test-kata-rpm.sh
@@ -1,12 +1,12 @@
 #!/bin/bash
 set -euo pipefail
 
-# Usage: ./test_kata_rpm.sh /path/to/kata-containers-3.15*.rpm
+# Usage: ./test_kata_rpm.sh /path/to/kata-containers-3.20*.rpm
 
 RPM_PATH=${1:-}
 
 if [[ -z "$RPM_PATH" ]]; then
-  echo "Usage: $0 /path/to/kata-containers-3.15*.rpm"
+  echo "Usage: $0 /path/to/kata-containers-3.20*.rpm"
   exit 1
 fi
 
diff --git a/vendor-tarball.sh b/vendor-tarball.sh
index fb6a23c..6676c88 100755
--- a/vendor-tarball.sh
+++ b/vendor-tarball.sh
@@ -2,7 +2,7 @@
 set -xeuo pipefail
 
 # Kata version
-KATA_VERSION=3.14.0
+KATA_VERSION=3.20.0
 RUST_SOURCES_TO_FIX="src/agent src/tools/kata-ctl"
 
 # Original vendor tarball downloaded from upstream

From cdc9ba8a07da9e5fe97bda732457d8212ae77cb4 Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Thu, 11 Sep 2025 14:44:16 +0200
Subject: [PATCH 2/7] Commit missing sources

Doing some experiments with Cursor, and apparently that messed up the
sources file, which was not committed correctly.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 sources | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sources b/sources
index a58f5cf..1d2d3f2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.19.1.tar.gz) = 4a8c70fead695693fc9b9978944e3131fea8e85cb01814de72920088dba8c9707da3c7df592444e32a170a18e13dc1a7a6806069f4821d7f30b0db8b221016a7
-SHA512 (kata-containers-3.19.1-vendor.tar.gz) = f4650f056999cce79bb58b37bba8e38c18fee8e98610e185d5cccf844045f38ec62503368497c84d209e788c4e47c72afaf3392f619b6f3a1f5e3779bf6139f6
+SHA512 (kata-containers-3.20.0.tar.gz) = 8864bda669fac2ae6983b940d61961c05d6d25497bb98120f0c2fd62adbaf8fbbe2473682e4d9b694c01a451ffcbdd0c9d407da8bcc82936a61912d2487db639
+SHA512 (kata-containers-3.20.0-vendor.tar.gz) = 48ed8fb337cbccb229f6b4b1beb019a92ec577a4b0ac9e3517c9b4fd1105b8bf7ad5e7424045005134afb2e5791bd6a80a8965067acc4066e5fe70346a652bf7

From be1346fa9b641e9956048edd03f5cb93a15d715a Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Thu, 25 Sep 2025 16:21:42 +0200
Subject: [PATCH 3/7] Bump to Kata 3.21.0

This matches Kata release 3.21.0
https://github.com/kata-containers/kata-containers/releases/tag/3.21.0

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 .gitignore           | 2 ++
 kata-containers.spec | 5 ++++-
 sources              | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index a94ec42..1264cb2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,3 +69,5 @@
 /kata-containers-3.19.1-vendor.tar.gz
 /kata-containers-3.20.0.tar.gz
 /kata-containers-3.20.0-vendor.tar.gz
+/kata-containers-3.21.0.tar.gz
+/kata-containers-3.21.0-vendor.tar.gz
diff --git a/kata-containers.spec b/kata-containers.spec
index de639ee..2262221 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -28,7 +28,7 @@
 %endif
 
 # https://github.com/kata-containers/kata-containers
-Version: 3.20.0
+Version: 3.21.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
@@ -390,6 +390,9 @@ fi
 
 
 %changelog
+* Thu Sep 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.21.0-1
+- kata-containers 3.21.0
+
 * Wed Sep 10 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.20.0-1
 - kata-containers 3.20.0
 
diff --git a/sources b/sources
index 1d2d3f2..dafeef3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.20.0.tar.gz) = 8864bda669fac2ae6983b940d61961c05d6d25497bb98120f0c2fd62adbaf8fbbe2473682e4d9b694c01a451ffcbdd0c9d407da8bcc82936a61912d2487db639
-SHA512 (kata-containers-3.20.0-vendor.tar.gz) = 48ed8fb337cbccb229f6b4b1beb019a92ec577a4b0ac9e3517c9b4fd1105b8bf7ad5e7424045005134afb2e5791bd6a80a8965067acc4066e5fe70346a652bf7
+SHA512 (kata-containers-3.21.0.tar.gz) = 703cf7ea73a306d190955c04041fdcecffc7de20b05c231aca3ccfae0e53ebdd7221b9a04d0f02e129c88e9084bdcca2ec8f6f440b1e5b450fd4fc5768f46615
+SHA512 (kata-containers-3.21.0-vendor.tar.gz) = d695f2c6e03402f2543daadf1506da614a032180d22855c3fa973380072166b157d19990ca9429f48379fca61801f85caff25e38b5ae27e483eda1d2692bcfec

From 6df50a355687eb078f30cc1a77490d8917501c0a Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Tue, 30 Sep 2025 16:57:51 +0200
Subject: [PATCH 4/7] Add tests for CRIO and make test for containerd more
 explicit

Add an rpm test that specifically uses crio, and make the containerd
test more specifically mention containerd both in the name and in the
description of the test.

Also, the tests now first erase any old kata-containers package so
that make sure we test a "from scratch" installation.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 ...kata-rpm.sh => test-kata-rpm-containerd.sh |  43 ++--
 test-kata-rpm-crio.sh                         | 190 ++++++++++++++++++
 2 files changed, 217 insertions(+), 16 deletions(-)
 rename test-kata-rpm.sh => test-kata-rpm-containerd.sh (57%)
 create mode 100755 test-kata-rpm-crio.sh

diff --git a/test-kata-rpm.sh b/test-kata-rpm-containerd.sh
similarity index 57%
rename from test-kata-rpm.sh
rename to test-kata-rpm-containerd.sh
index f9e893c..95f7d54 100755
--- a/test-kata-rpm.sh
+++ b/test-kata-rpm-containerd.sh
@@ -1,20 +1,23 @@
 #!/bin/bash
 set -euo pipefail
 
-# Usage: ./test_kata_rpm.sh /path/to/kata-containers-3.20*.rpm
+# Usage: ./test_kata_rpm_containerd.sh /path/to/kata-containers-*.rpm
 
 RPM_PATH=${1:-}
 
 if [[ -z "$RPM_PATH" ]]; then
-  echo "Usage: $0 /path/to/kata-containers-3.20*.rpm"
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
   exit 1
 fi
 
-# 1. Install the RPM
-echo "[1/6] Installing Kata Containers RPM: $RPM_PATH"
-sudo dnf install -y "$RPM_PATH"
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
 
-echo "[2/6] Checking installed binaries and versions..."
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
 # kata-agent is not expected on the host; it runs inside the Kata VM image.
 if command -v kata-runtime >/dev/null 2>&1; then
   kata-runtime --version
@@ -27,35 +30,43 @@ else
   echo "kata-ctl not found in PATH!"; exit 1
 fi
 
-echo "[3/6] Checking QEMU version..."
+echo "[4/7] Checking QEMU version..."
 if command -v qemu-system-x86_64 >/dev/null 2>&1; then
   qemu-system-x86_64 --version
 else
   echo "qemu-system-x86_64 not found in PATH!"; exit 1
 fi
 
-echo "[4/6] Loading vhost_net kernel module (required for Kata networking)..."
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
 sudo modprobe vhost_net
 
-# 5. Run kata-runtime check (system compatibility)
-echo "[5/6] Running kata-runtime check (system compatibility)..."
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
 if ! kata-runtime check; then
   echo "[ERROR] System is not capable of running Kata Containers."
   exit 1
 fi
 
-# 6. Run a simple Kata container using containerd (if available)
-echo "[6/6] Attempting to run a test container with Kata runtime (containerd)..."
+# 7. Run a simple Kata container using containerd (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (containerd)..."
 if command -v ctr >/dev/null 2>&1; then
+  # Clean up any existing test containers
+  echo "[Test] Cleaning up any existing test containers..."
+  sudo ctr task kill kata-test-bg 2>/dev/null || true
+  sudo ctr task rm kata-test-bg 2>/dev/null || true
+  sudo ctr container rm kata-test-bg 2>/dev/null || true
+  
   sudo ctr images pull docker.io/library/alpine:latest
   # Start a container in the background (do not use --rm so we can exec into it)
   sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300
   # Wait a moment for the container to be up
   sleep 2
-  echo "[Test] Exec into the running container and run 'ls -lR /'..."
-  sudo ctr task exec -t --exec-id kata-ls kata-test-bg ls -lR /
+  echo "[Test] Exec into the running container and run 'uname -a'..."
+  sudo ctr task exec --exec-id kata-uname kata-test-bg uname -a
   echo "[Test] Show /etc/os-release inside the container..."
-  sudo ctr task exec -t --exec-id kata-osrel kata-test-bg cat /etc/os-release
+  sudo ctr task exec --exec-id kata-osrel kata-test-bg cat /etc/os-release
+  echo "[Test] Show ls -lR /usr inside the container..."
+  sudo ctr task exec --exec-id kata-ls kata-test-bg ls -lR /usr
   # Clean up: kill the task and delete the container
   echo "[Cleanup] Deleting test container..."
   sudo ctr task kill kata-test-bg || true
@@ -77,4 +88,4 @@ else
   echo "journalctl not found, skipping log check."
 fi
 
-echo "All tests completed. If no errors above, the RPM is likely working." 
\ No newline at end of file
+echo "All tests completed. If no errors above, the RPM is likely working with containerd." 
\ No newline at end of file
diff --git a/test-kata-rpm-crio.sh b/test-kata-rpm-crio.sh
new file mode 100755
index 0000000..d02d2d8
--- /dev/null
+++ b/test-kata-rpm-crio.sh
@@ -0,0 +1,190 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage: ./test_kata_rpm_crio.sh /path/to/kata-containers-3.20*.rpm
+
+RPM_PATH=${1:-}
+
+if [[ -z "$RPM_PATH" ]]; then
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
+  exit 1
+fi
+
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
+
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
+# kata-agent is not expected on the host; it runs inside the Kata VM image.
+if command -v kata-runtime >/dev/null 2>&1; then
+  kata-runtime --version
+else
+  echo "kata-runtime not found in PATH!"; exit 1
+fi
+if command -v kata-ctl >/dev/null 2>&1; then
+  kata-ctl version
+else
+  echo "kata-ctl not found in PATH!"; exit 1
+fi
+
+echo "[4/7] Checking QEMU version..."
+if command -v qemu-system-x86_64 >/dev/null 2>&1; then
+  qemu-system-x86_64 --version
+else
+  echo "qemu-system-x86_64 not found in PATH!"; exit 1
+fi
+
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
+sudo modprobe vhost_net
+
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
+if ! kata-runtime check; then
+  echo "[ERROR] System is not capable of running Kata Containers."
+  exit 1
+fi
+
+# 7. Run a simple Kata container using CRI-O (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (CRI-O)..."
+if command -v crictl >/dev/null 2>&1; then
+  # Check if CRI-O is running, if not try to start it
+  if ! systemctl is-active --quiet crio; then
+    echo "[Test] CRI-O is not running, attempting to start it..."
+    sudo systemctl start crio || {
+      echo "[WARNING] Failed to start CRI-O, falling back to containerd test..."
+      echo "[Test] Running containerd test instead..."
+      if command -v ctr >/dev/null 2>&1; then
+        sudo ctr images pull docker.io/library/alpine:latest
+        sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test-crio-fallback uname -a || {
+          echo "Failed to run container with containerd fallback."; exit 1;
+        }
+        echo "[Test] Containerd fallback test completed."
+      else
+        echo "Neither CRI-O nor containerd available for testing."
+      fi
+      exit 0
+    }
+  fi
+  
+  # Configure crictl to use CRI-O instead of containerd
+  echo "[Test] Configuring crictl to use CRI-O..."
+  sudo crictl config --set runtime-endpoint=unix:///var/run/crio/crio.sock
+  sudo crictl config --set image-endpoint=unix:///var/run/crio/crio.sock
+  # Pull the image
+  echo "[Test] Pulling alpine image..."
+  sudo crictl pull docker.io/library/alpine:latest
+  
+  # Create temporary pod and container config files
+  echo "[Test] Creating pod and container configurations..."
+  
+  # Create pod config
+  cat > /tmp/pod-config.json << 'EOF'
+{
+  "metadata": {
+    "name": "kata-test-pod",
+    "namespace": "default",
+    "uid": "kata-test-pod-uid"
+  },
+  "log_directory": "/tmp",
+  "linux": {}
+}
+EOF
+
+  # Create container config
+  cat > /tmp/container-config.json << 'EOF'
+{
+  "metadata": {
+    "name": "kata-test-container"
+  },
+  "image": {
+    "image": "docker.io/library/alpine:latest"
+  },
+  "command": ["sleep", "300"],
+  "linux": {}
+}
+EOF
+
+  # Create pod sandbox
+  echo "[Test] Creating pod sandbox with kata runtime..."
+  POD_ID=$(sudo crictl runp --runtime kata /tmp/pod-config.json 2>/dev/null || echo "")
+  if [[ -z "$POD_ID" ]]; then
+    echo "[Test] Creating pod sandbox with default runtime..."
+    POD_ID=$(sudo crictl runp /tmp/pod-config.json 2>/dev/null || echo "")
+  fi
+  
+  if [[ -n "$POD_ID" ]]; then
+    echo "[Test] Pod created with ID: $POD_ID, waiting for it to be ready..."
+    # Wait for pod to be ready (up to 30 seconds)
+    for i in {1..30}; do
+      if sudo crictl inspectp $POD_ID >/dev/null 2>&1; then
+        echo "[Test] Pod is ready!"
+        break
+      fi
+      echo "[Test] Waiting for pod to be ready... ($i/30)"
+      sleep 1
+    done
+    
+    # Create container
+    echo "[Test] Creating container..."
+    CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    if [[ -z "$CONTAINER_ID" ]]; then
+      echo "[Test] Creating container with default runtime..."
+      CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    fi
+    
+    if [[ -n "$CONTAINER_ID" ]]; then
+      echo "[Test] Container created with ID: $CONTAINER_ID"
+      
+      # Start container
+      echo "[Test] Starting container..."
+      sudo crictl start $CONTAINER_ID
+      
+      # Wait a moment for the container to be up
+      sleep 2
+      
+      # Execute commands in the container
+      echo "[Test] Exec into the running container and run 'uname -a'..."
+      sudo crictl exec $CONTAINER_ID uname -a || echo "uname command failed"
+      
+      echo "[Test] Show /etc/os-release inside the container..."
+      sudo crictl exec $CONTAINER_ID cat /etc/os-release || echo "cat /etc/os-release failed"
+      
+      echo "[Test] Show ls -lR /usr inside the container..."
+      sudo crictl exec $CONTAINER_ID ls -lR /usr || echo "ls -lR /usr command failed"
+      
+      # Clean up
+      echo "[Cleanup] Stopping and removing container..."
+      sudo crictl stop $CONTAINER_ID || true
+      sudo crictl rm $CONTAINER_ID || true
+    else
+      echo "[ERROR] Failed to create container"
+    fi
+    
+    # Clean up pod
+    echo "[Cleanup] Removing pod sandbox..."
+    sudo crictl stopp $POD_ID || true
+    sudo crictl rmp $POD_ID || true
+  else
+    echo "[ERROR] Failed to create pod sandbox"
+  fi
+  
+  # Clean up temp files
+  rm -f /tmp/pod-config.json /tmp/container-config.json
+  
+  echo "[Test] CRI-O container test completed."
+else
+  echo "CRI-O (crictl) not found, skipping container test."
+fi
+
+# Check logs for errors
+echo "[Post-test] Checking Kata logs for errors..."
+if journalctl --version >/dev/null 2>&1; then
+  sudo journalctl -xe | grep kata || echo "No kata logs found."
+else
+  echo "journalctl not found, skipping log check."
+fi
+
+echo "All tests completed. If no errors above, the RPM is likely working with CRI-O."

From ad5b20f94cb5550a3fe96051d479c400e2af4f9f Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Tue, 30 Sep 2025 18:04:50 +0200
Subject: [PATCH 5/7] Check that we are indeed running in a VM

When running in kata containers, we should be running in a VM.
One manifestation is that the boot command line is different.
Check that and report it.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 test-kata-rpm-containerd.sh | 26 +++++++-------
 test-kata-rpm-crio.sh       | 67 +++++++++++++++++++++++--------------
 2 files changed, 55 insertions(+), 38 deletions(-)

diff --git a/test-kata-rpm-containerd.sh b/test-kata-rpm-containerd.sh
index 95f7d54..f34c27a 100755
--- a/test-kata-rpm-containerd.sh
+++ b/test-kata-rpm-containerd.sh
@@ -55,7 +55,7 @@ if command -v ctr >/dev/null 2>&1; then
   sudo ctr task kill kata-test-bg 2>/dev/null || true
   sudo ctr task rm kata-test-bg 2>/dev/null || true
   sudo ctr container rm kata-test-bg 2>/dev/null || true
-  
+
   sudo ctr images pull docker.io/library/alpine:latest
   # Start a container in the background (do not use --rm so we can exec into it)
   sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300
@@ -65,8 +65,18 @@ if command -v ctr >/dev/null 2>&1; then
   sudo ctr task exec --exec-id kata-uname kata-test-bg uname -a
   echo "[Test] Show /etc/os-release inside the container..."
   sudo ctr task exec --exec-id kata-osrel kata-test-bg cat /etc/os-release
-  echo "[Test] Show ls -lR /usr inside the container..."
-  sudo ctr task exec --exec-id kata-ls kata-test-bg ls -lR /usr
+
+  echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+  HOST_CMDLINE=$(cat /proc/cmdline)
+  GUEST_CMDLINE=$(sudo ctr task exec --exec-id kata-cmdline kata-test-bg cat /proc/cmdline)
+  echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+  echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+  if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+    echo "[ERROR] VM verification: Container cmdline is the same as host - this indicates the container is NOT running in a Kata VM!"
+    exit 1
+  else
+    echo "[SUCCESS] Kata VM isolation is working correctly!"
+  fi
   # Clean up: kill the task and delete the container
   echo "[Cleanup] Deleting test container..."
   sudo ctr task kill kata-test-bg || true
@@ -80,12 +90,4 @@ else
   echo "containerd (ctr) not found, skipping container test."
 fi
 
-# Check logs for errors
-echo "[Post-test] Checking Kata logs for errors..."
-if journalctl --version >/dev/null 2>&1; then
-  sudo journalctl -xe | grep kata || echo "No kata logs found."
-else
-  echo "journalctl not found, skipping log check."
-fi
-
-echo "All tests completed. If no errors above, the RPM is likely working with containerd." 
\ No newline at end of file
+echo "All tests completed. If no errors above, the RPM is likely working with containerd."
diff --git a/test-kata-rpm-crio.sh b/test-kata-rpm-crio.sh
index d02d2d8..357d26c 100755
--- a/test-kata-rpm-crio.sh
+++ b/test-kata-rpm-crio.sh
@@ -68,7 +68,7 @@ if command -v crictl >/dev/null 2>&1; then
       exit 0
     }
   fi
-  
+
   # Configure crictl to use CRI-O instead of containerd
   echo "[Test] Configuring crictl to use CRI-O..."
   sudo crictl config --set runtime-endpoint=unix:///var/run/crio/crio.sock
@@ -76,10 +76,10 @@ if command -v crictl >/dev/null 2>&1; then
   # Pull the image
   echo "[Test] Pulling alpine image..."
   sudo crictl pull docker.io/library/alpine:latest
-  
+
   # Create temporary pod and container config files
   echo "[Test] Creating pod and container configurations..."
-  
+
   # Create pod config
   cat > /tmp/pod-config.json << 'EOF'
 {
@@ -114,7 +114,7 @@ EOF
     echo "[Test] Creating pod sandbox with default runtime..."
     POD_ID=$(sudo crictl runp /tmp/pod-config.json 2>/dev/null || echo "")
   fi
-  
+
   if [[ -n "$POD_ID" ]]; then
     echo "[Test] Pod created with ID: $POD_ID, waiting for it to be ready..."
     # Wait for pod to be ready (up to 30 seconds)
@@ -126,7 +126,7 @@ EOF
       echo "[Test] Waiting for pod to be ready... ($i/30)"
       sleep 1
     done
-    
+
     # Create container
     echo "[Test] Creating container..."
     CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
@@ -134,35 +134,58 @@ EOF
       echo "[Test] Creating container with default runtime..."
       CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
     fi
-    
+
     if [[ -n "$CONTAINER_ID" ]]; then
       echo "[Test] Container created with ID: $CONTAINER_ID"
-      
+
       # Start container
       echo "[Test] Starting container..."
-      sudo crictl start $CONTAINER_ID
-      
+      if ! sudo crictl start $CONTAINER_ID 2>/dev/null; then
+        # Clean up and retry
+        echo "[Test] Container start failed, cleaning up and retrying..."
+        sudo crictl stop $CONTAINER_ID 2>/dev/null || true
+        sudo crictl rm $CONTAINER_ID 2>/dev/null || true
+        CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+        if [[ -z "$CONTAINER_ID" ]] || ! sudo crictl start $CONTAINER_ID; then
+          echo "[ERROR] Failed to start container after cleanup"
+          exit 1
+        fi
+      fi
+
       # Wait a moment for the container to be up
       sleep 2
-      
+
       # Execute commands in the container
       echo "[Test] Exec into the running container and run 'uname -a'..."
       sudo crictl exec $CONTAINER_ID uname -a || echo "uname command failed"
-      
+
       echo "[Test] Show /etc/os-release inside the container..."
       sudo crictl exec $CONTAINER_ID cat /etc/os-release || echo "cat /etc/os-release failed"
-      
-      echo "[Test] Show ls -lR /usr inside the container..."
-      sudo crictl exec $CONTAINER_ID ls -lR /usr || echo "ls -lR /usr command failed"
-      
+
+      echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+      HOST_CMDLINE=$(cat /proc/cmdline)
+      GUEST_CMDLINE=$(sudo crictl exec $CONTAINER_ID cat /proc/cmdline || echo "cat /proc/cmdline command failed")
+      echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+      echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] The container is NOT running in a Kata VM!"
+      else
+          echo "[SUCCESS] Kata VM isolation is working correctly!"
+      fi
+
       # Clean up
       echo "[Cleanup] Stopping and removing container..."
       sudo crictl stop $CONTAINER_ID || true
       sudo crictl rm $CONTAINER_ID || true
+
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] Container was running but not with Kata runtime"
+          exit 1
+      fi
     else
       echo "[ERROR] Failed to create container"
     fi
-    
+
     # Clean up pod
     echo "[Cleanup] Removing pod sandbox..."
     sudo crictl stopp $POD_ID || true
@@ -170,21 +193,13 @@ EOF
   else
     echo "[ERROR] Failed to create pod sandbox"
   fi
-  
+
   # Clean up temp files
   rm -f /tmp/pod-config.json /tmp/container-config.json
-  
+
   echo "[Test] CRI-O container test completed."
 else
   echo "CRI-O (crictl) not found, skipping container test."
 fi
 
-# Check logs for errors
-echo "[Post-test] Checking Kata logs for errors..."
-if journalctl --version >/dev/null 2>&1; then
-  sudo journalctl -xe | grep kata || echo "No kata logs found."
-else
-  echo "journalctl not found, skipping log check."
-fi
-
 echo "All tests completed. If no errors above, the RPM is likely working with CRI-O."

From 4fb0ac82b48440a61ef6bb654cefacd7bfed5f41 Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Mon, 3 Nov 2025 15:29:02 +0100
Subject: [PATCH 6/7] tests: Remove steps that retry with containerd

The CRIO test is specifically designed to test CRIO, so avoid falling
back to containerd if things don't work with CRIO.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 test-kata-rpm-crio.sh | 49 +++++++++++++++++++++++--------------------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/test-kata-rpm-crio.sh b/test-kata-rpm-crio.sh
index 357d26c..fc5365b 100755
--- a/test-kata-rpm-crio.sh
+++ b/test-kata-rpm-crio.sh
@@ -54,18 +54,8 @@ if command -v crictl >/dev/null 2>&1; then
   if ! systemctl is-active --quiet crio; then
     echo "[Test] CRI-O is not running, attempting to start it..."
     sudo systemctl start crio || {
-      echo "[WARNING] Failed to start CRI-O, falling back to containerd test..."
-      echo "[Test] Running containerd test instead..."
-      if command -v ctr >/dev/null 2>&1; then
-        sudo ctr images pull docker.io/library/alpine:latest
-        sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test-crio-fallback uname -a || {
-          echo "Failed to run container with containerd fallback."; exit 1;
-        }
-        echo "[Test] Containerd fallback test completed."
-      else
-        echo "Neither CRI-O nor containerd available for testing."
-      fi
-      exit 0
+      echo "[WARNING] Failed to start CRI-O..."
+      exit 1
     }
   fi
 
@@ -80,16 +70,27 @@ if command -v crictl >/dev/null 2>&1; then
   # Create temporary pod and container config files
   echo "[Test] Creating pod and container configurations..."
 
-  # Create pod config
+  # Create pod config (minimal Kata documentation config)
   cat > /tmp/pod-config.json << 'EOF'
 {
-  "metadata": {
-    "name": "kata-test-pod",
-    "namespace": "default",
-    "uid": "kata-test-pod-uid"
-  },
-  "log_directory": "/tmp",
-  "linux": {}
+    "metadata": {
+        "name": "busybox-pod",
+        "uid": "busybox-pod",
+        "namespace": "test.kata"
+    },
+    "hostname": "busybox_host",
+    "log_directory": "",
+    "dns_config": {
+    },
+    "port_mappings": [],
+    "resources": {
+    },
+    "labels": {
+    },
+    "annotations": {
+    },
+    "linux": {
+    }
 }
 EOF
 
@@ -97,7 +98,7 @@ EOF
   cat > /tmp/container-config.json << 'EOF'
 {
   "metadata": {
-    "name": "kata-test-container"
+    "name": "busybox-container"
   },
   "image": {
     "image": "docker.io/library/alpine:latest"
@@ -111,8 +112,10 @@ EOF
   echo "[Test] Creating pod sandbox with kata runtime..."
   POD_ID=$(sudo crictl runp --runtime kata /tmp/pod-config.json 2>/dev/null || echo "")
   if [[ -z "$POD_ID" ]]; then
-    echo "[Test] Creating pod sandbox with default runtime..."
-    POD_ID=$(sudo crictl runp /tmp/pod-config.json 2>/dev/null || echo "")
+    echo "[Test] Failed to create pod sandbox with Kata runtime"
+    journalctl -g kata
+    echo "[Test] Failed to create pod sandbox with Kata runtime, exiting"
+    exit 1
   fi
 
   if [[ -n "$POD_ID" ]]; then

From 91b3a1c22d726ab6805a9e09eea964d680e27415 Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Mon, 3 Nov 2025 17:10:47 +0100
Subject: [PATCH 7/7] Bump to Kata Containers 3.22

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 .gitignore           | 2 ++
 kata-containers.spec | 5 ++++-
 sources              | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 1264cb2..ad07063 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,3 +71,5 @@
 /kata-containers-3.20.0-vendor.tar.gz
 /kata-containers-3.21.0.tar.gz
 /kata-containers-3.21.0-vendor.tar.gz
+/kata-containers-3.22.0.tar.gz
+/kata-containers-3.22.0-vendor.tar.gz
diff --git a/kata-containers.spec b/kata-containers.spec
index 2262221..641d018 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -28,7 +28,7 @@
 %endif
 
 # https://github.com/kata-containers/kata-containers
-Version: 3.21.0
+Version: 3.22.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
@@ -390,6 +390,9 @@ fi
 
 
 %changelog
+* Tue Nov 04 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.22.0-1
+- kata-containers 3.22.0
+
 * Thu Sep 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.21.0-1
 - kata-containers 3.21.0
 
diff --git a/sources b/sources
index dafeef3..c82bc85 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.21.0.tar.gz) = 703cf7ea73a306d190955c04041fdcecffc7de20b05c231aca3ccfae0e53ebdd7221b9a04d0f02e129c88e9084bdcca2ec8f6f440b1e5b450fd4fc5768f46615
-SHA512 (kata-containers-3.21.0-vendor.tar.gz) = d695f2c6e03402f2543daadf1506da614a032180d22855c3fa973380072166b157d19990ca9429f48379fca61801f85caff25e38b5ae27e483eda1d2692bcfec
+SHA512 (kata-containers-3.22.0.tar.gz) = 142bc70b6455f545d534371a845980ed00985d7225b5f672f3fef046a6f0a31871bd69ee2c931ab94c10089086123fe5987ec6615d7a7308027531269c4dae48
+SHA512 (kata-containers-3.22.0-vendor.tar.gz) = 10b28d746d5176acce4abcb902213edcfb43b0b390a5d20f114b7dc4e11bc8de26098f180bdf75bcff3e6d03f2b3a31908f4386d7ca24119f9e001cd99c52060