runtime-rs Dragonball VM template cannot save image-backed PCI virtio-blk state

Environment

• Kata Containers: 4.1.0
• Runtime: runtime-rs
• Hypervisor: built-in Dragonball
• Architecture: x86_64
• Host: GKE nested KVM
• Guest rootfs: image-backed
• Rootfs driver: virtio-blk-pci
• Kubernetes: 1.35
• containerd: 2.1

Motivation

We are evaluating Dragonball VM templates for a sandbox platform. The goal is to pre-boot a clean Kata VM and restore it for new sandboxes, reducing sandbox startup latency and host memory overhead.

Expected behavior

kata-ctl factory init should create a reusable Dragonball VM template containing guest memory and VM/device state.

Actual behavior

The Dragonball VM boots successfully and the Kata Agent becomes ready, but template creation fails while saving the VM:

SaveMicrovm(Block(Virtio(InvalidInput)))

The error occurs after VM boot and Agent readiness, during block-device snapshot state capture.

Reproduction

1. Enable Dragonball VM templating:

[hypervisor.dragonball.factory]
enable_template = true
template_path = "/run/vc/vm/template"

1. Use an image-backed guest rootfs:

[hypervisor.dragonball]
image = "/opt/kata/share/kata-containers/kata-containers.img"
initrd = ""
vm_rootfs_driver = "virtio-blk-pci"

1. Run:

kata-ctl factory init

1. Observe:

failed to initialize factory
...
save template vm
...
SaveMicrovm(Block(Virtio(InvalidInput)))

Additional observations

• The same Dragonball configuration starts a normal sandbox successfully when VM templating is disabled.
• We built kata-ctl from the 4.1.0 source with the Dragonball feature enabled; the stock tools artifact did not include Dragonball factory support.
• Switching to an initrd-based guest avoided the image-backed rootfs path, but the guest did not reach Agent readiness in our Kubernetes environment, so we could not use it as a production-compatible workaround.
• The factory configuration loading issue appears related but separate: #13501 and #13594.
• Related Dragonball/block-device issue: #13630.

Questions

1. Is PCI virtio-blk snapshot state supported by Dragonball VM templates in 4.1.x?
2. Is virtio-blk-mmio the expected workaround, or should the root device be excluded from template state?
3. Does a newer release contain a fix or additional configuration requirements?
4. Are there upstream tests covering image-backed Dragonball template creation with virtio-blk-pci?