Kata runc privileged

There is another question related with '--privileged' in Kata:
In runc, '--privileged' will translate capabilities of host dev into container.
In Kata, '--privileged' will mean containers in Kata VM can access all the device in Kata guest VM(kata limitation: https://github.com/kata-containers/documentation/blob/master/Limitations.md#docker-run---privileged ).
Per my understanding, we should translate the capabilities of guest VM device into kata container instead of host device.

Host resource sharing
docker run --privileged
Privileged support in Kata is essentially different from runc containers. Kata does support docker run --privileged command, but in this case full access to the guest VM is provided in addition to some host access.

The container runs with elevated capabilities within the guest and is granted access to guest devices instead of the host devices. This is also true with using securityContext privileged=true with Kubernetes.

The container may also be granted full access to a subset of host devices (https://github.com/kata-containers/runtime/issues/1568).

See Privileged Kata Containers for how to configure some of this behavior.

Containerd and CRI
The Containerd CRI allows configuring the privileged host devices behavior for each runtime in the CRI config. This is done with the privileged_without_host_devices option. Setting this to true will disable hot plugging of the host devices into the guest, even when privileged is enabled.

Support for configuring privileged host devices behaviour was added in containerd 1.3.0 version.

See below example config:

[plugins]
  [plugins.cri]
    [plugins.cri.containerd]
       [plugins.cri.containerd.runtimes.runc]
         runtime_type = "io.containerd.runc.v1"
         privileged_without_host_devices = false
       [plugins.cri.containerd.runtimes.kata]
         runtime_type = "io.containerd.kata.v2"
         privileged_without_host_devices = true
         [plugins.cri.containerd.runtimes.kata.options]
           ConfigPath = "/opt/kata/share/defaults/kata-containers/configuration.toml"
Kata Containers with Containerd and CRI documentation
Containerd CRI config documentation