vxn: add Xen DomU container runtime with OCI image support

vxn runs OCI containers as Xen DomU guests — the VM IS the container.
No Docker/containerd runs inside the guest; the init script directly
mounts the container rootfs and execs the entrypoint via chroot.

Host-side (Dom0):
- vxn.sh: Docker-like CLI wrapper (sets HYPERVISOR=xen)
- vrunner-backend-xen.sh: Xen xl backend for vrunner
  - hv_prepare_container(): pulls OCI images via skopeo,
    resolves entrypoint from OCI config using jq on host
  - xl create for VM lifecycle (PVH on aarch64, PV on x86_64)
  - Bridge networking with iptables DNAT for port forwards
  - Console capture via xl console for ephemeral mode

Guest-side (DomU):
- vxn-init.sh: mounts container rootfs from input disk,
  extracts OCI layers, execs entrypoint via chroot
  - Supports containers with or without /bin/sh
  - grep/sed fallback for OCI config parsing (no jq needed)
  - Daemon mode with command loop on hvc1
- vcontainer-init-common.sh: hypervisor detection, head -n fix
- vcontainer-preinit.sh: init selection via vcontainer.init=

Build system:
- vxn-initramfs-create.inc: assembles boot blobs from vruntime
  multiconfig, injects vxn-init.sh into rootfs squashfs
- vxn_1.0.bb: Dom0 package with scripts + blobs
  - nostamp on install/package chain (blobs from DEPLOY_DIR
    are untracked by sstate)
- vxn.cfg: Xen PV kernel config fragment

Tested: vxn -it --no-daemon run --rm hello-world

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

9 files changed, 1860 insertions, 311 deletions

diff --git a/recipes-containers/vcontainer/files/vcontainer-init-common.sh b/recipes-containers/vcontainer/files/vcontainer-init-common.sh
index fe488ae2..ab8762b2 100755
--- a/recipes-containers/vcontainer/files/vcontainer-init-common.sh
+++ b/recipes-containers/vcontainer/files/vcontainer-init-common.sh
@@ -27,6 +27,43 @@ setup_base_environment() {
 }
 
 # ============================================================================
+# Hypervisor Detection
+# ============================================================================
+
+# Detect hypervisor type and set device prefixes accordingly.
+# Must be called after /proc and /sys are mounted.
+# Sets: HV_TYPE, BLK_PREFIX, NINE_P_TRANSPORT
+detect_hypervisor() {
+    # Check kernel cmdline for explicit block prefix (set by Xen backend)
+    local cmdline_blk=""
+    for param in $(cat /proc/cmdline 2>/dev/null); do
+        case "$param" in
+            vcontainer.blk=*) cmdline_blk="${param#vcontainer.blk=}" ;;
+        esac
+    done
+
+    if [ -n "$cmdline_blk" ]; then
+        # Explicit prefix from kernel cmdline (most reliable)
+        BLK_PREFIX="$cmdline_blk"
+        if [ "$cmdline_blk" = "xvd" ]; then
+            HV_TYPE="xen"
+            NINE_P_TRANSPORT="xen"
+        else
+            HV_TYPE="qemu"
+            NINE_P_TRANSPORT="virtio"
+        fi
+    elif [ -d /proc/xen ] || grep -q "xen" /sys/hypervisor/type 2>/dev/null; then
+        HV_TYPE="xen"
+        BLK_PREFIX="xvd"
+        NINE_P_TRANSPORT="xen"
+    else
+        HV_TYPE="qemu"
+        BLK_PREFIX="vd"
+        NINE_P_TRANSPORT="virtio"
+    fi
+}
+
+# ============================================================================
 # Filesystem Mounts
 # ============================================================================
 
@@ -40,6 +77,9 @@ mount_base_filesystems() {
     mkdir -p /dev/pts
     mountpoint -q /dev/pts || mount -t devpts devpts /dev/pts
 
+    # Detect hypervisor type now that /proc and /sys are available
+    detect_hypervisor
+
     # Enable IP forwarding (container runtimes check this)
     echo 1 > /proc/sys/net/ipv4/ip_forward
 
@@ -178,29 +218,24 @@ detect_disks() {
     log "Waiting for block devices..."
     sleep 2
 
-    log "Block devices:"
-    [ "$QUIET_BOOT" = "0" ] && ls -la /dev/vd* 2>/dev/null || log "No /dev/vd* devices"
+    log "Block devices (${HV_TYPE:-qemu}, /dev/${BLK_PREFIX}*):"
+    [ "$QUIET_BOOT" = "0" ] && ls -la /dev/${BLK_PREFIX}* 2>/dev/null || log "No /dev/${BLK_PREFIX}* devices"
 
     # Determine which disk is input and which is state
-    # Drive layout (rootfs.img is always /dev/vda, mounted by preinit as /):
-    #   /dev/vda = rootfs.img (already mounted as /)
-    #   /dev/vdb = input (if present)
-    #   /dev/vdc = state (if both input and state present)
-    #   /dev/vdb = state (if only state, no input)
+    # Drive layout (rootfs is always the first block device, mounted by preinit as /):
+    #   QEMU: /dev/vda, /dev/vdb, /dev/vdc
+    #   Xen:  /dev/xvda, /dev/xvdb, /dev/xvdc
 
     INPUT_DISK=""
     STATE_DISK=""
 
     if [ "$RUNTIME_INPUT" != "none" ] && [ "$RUNTIME_STATE" = "disk" ]; then
-        # Both present: rootfs=vda, input=vdb, state=vdc
-        INPUT_DISK="/dev/vdb"
-        STATE_DISK="/dev/vdc"
+        INPUT_DISK="/dev/${BLK_PREFIX}b"
+        STATE_DISK="/dev/${BLK_PREFIX}c"
     elif [ "$RUNTIME_STATE" = "disk" ]; then
-        # Only state: rootfs=vda, state=vdb
-        STATE_DISK="/dev/vdb"
+        STATE_DISK="/dev/${BLK_PREFIX}b"
     elif [ "$RUNTIME_INPUT" != "none" ]; then
-        # Only input: rootfs=vda, input=vdb
-        INPUT_DISK="/dev/vdb"
+        INPUT_DISK="/dev/${BLK_PREFIX}b"
     fi
 }
 
@@ -250,30 +285,56 @@ configure_networking() {
             # Bring up the interface
             ip link set "$NET_IFACE" up
 
-            # QEMU slirp provides:
-            #   Guest IP: 10.0.2.15/24
-            #   Gateway:  10.0.2.2
-            #   DNS:      10.0.2.3
-            ip addr add 10.0.2.15/24 dev "$NET_IFACE"
-            ip route add default via 10.0.2.2
+            if [ "$HV_TYPE" = "xen" ]; then
+                # Xen bridge networking: use DHCP or static config
+                # Try DHCP first if udhcpc is available
+                if command -v udhcpc >/dev/null 2>&1; then
+                    log "Requesting IP via DHCP (Xen bridge)..."
+                    udhcpc -i "$NET_IFACE" -t 5 -T 3 -q 2>/dev/null || {
+                        log "DHCP failed, using static fallback"
+                        ip addr add 10.0.0.15/24 dev "$NET_IFACE"
+                        ip route add default via 10.0.0.1
+                    }
+                else
+                    # Static fallback for Xen bridge
+                    ip addr add 10.0.0.15/24 dev "$NET_IFACE"
+                    ip route add default via 10.0.0.1
+                fi
+            else
+                # QEMU slirp provides:
+                #   Guest IP: 10.0.2.15/24
+                #   Gateway:  10.0.2.2
+                #   DNS:      10.0.2.3
+                ip addr add 10.0.2.15/24 dev "$NET_IFACE"
+                ip route add default via 10.0.2.2
+            fi
 
             # Configure DNS
             mkdir -p /etc
             rm -f /etc/resolv.conf
-            cat > /etc/resolv.conf << 'DNSEOF'
+            if [ "$HV_TYPE" = "xen" ]; then
+                cat > /etc/resolv.conf << 'DNSEOF'
+nameserver 8.8.8.8
+nameserver 1.1.1.1
+DNSEOF
+            else
+                cat > /etc/resolv.conf << 'DNSEOF'
 nameserver 10.0.2.3
 nameserver 8.8.8.8
 nameserver 1.1.1.1
 DNSEOF
+            fi
 
             sleep 1
 
             # Verify connectivity
+            local gw_ip
+            gw_ip=$(ip route | awk '/default/{print $3}' | head -n 1)
             log "Testing network connectivity..."
-            if ping -c 1 -W 3 10.0.2.2 >/dev/null 2>&1; then
-                log "  Gateway (10.0.2.2): OK"
+            if [ -n "$gw_ip" ] && ping -c 1 -W 3 "$gw_ip" >/dev/null 2>&1; then
+                log "  Gateway ($gw_ip): OK"
             else
-                log "  Gateway (10.0.2.2): FAILED"
+                log "  Gateway: FAILED"
             fi
 
             if ping -c 1 -W 3 8.8.8.8 >/dev/null 2>&1; then
@@ -282,7 +343,9 @@ DNSEOF
                 log "  External (8.8.8.8): FAILED (may be filtered)"
             fi
 
-            log "Network configured: $NET_IFACE (10.0.2.15)"
+            local my_ip
+            my_ip=$(ip -4 addr show "$NET_IFACE" 2>/dev/null | awk '/inet /{print $2}' | head -n 1)
+            log "Network configured: $NET_IFACE ($my_ip)"
             [ "$QUIET_BOOT" = "0" ] && ip addr show "$NET_IFACE"
             [ "$QUIET_BOOT" = "0" ] && ip route
             [ "$QUIET_BOOT" = "0" ] && cat /etc/resolv.conf
@@ -325,11 +388,11 @@ run_daemon_mode() {
 
     # Mount virtio-9p shared directory for file I/O
     mkdir -p /mnt/share
-    MOUNT_ERR=$(mount -t 9p -o trans=virtio,version=9p2000.L,cache=none ${VCONTAINER_SHARE_NAME} /mnt/share 2>&1)
+    MOUNT_ERR=$(mount -t 9p -o trans=${NINE_P_TRANSPORT},version=9p2000.L,cache=none ${VCONTAINER_SHARE_NAME} /mnt/share 2>&1)
     if [ $? -eq 0 ]; then
-        log "Mounted virtio-9p share at /mnt/share"
+        log "Mounted 9p share at /mnt/share (transport: ${NINE_P_TRANSPORT})"
     else
-        log "WARNING: Could not mount virtio-9p share: $MOUNT_ERR"
+        log "WARNING: Could not mount 9p share: $MOUNT_ERR"
         log "Available filesystems:"
         cat /proc/filesystems 2>/dev/null | head -20
     fi
@@ -644,7 +707,7 @@ graceful_shutdown() {
 
     # Final sync and flush
     sync
-    for dev in /dev/vd*; do
+    for dev in /dev/${BLK_PREFIX}*; do
         [ -b "$dev" ] && blockdev --flushbufs "$dev" 2>/dev/null || true
     done
     sync
diff --git a/recipes-containers/vcontainer/files/vrunner-backend-xen.sh b/recipes-containers/vcontainer/files/vrunner-backend-xen.sh
new file mode 100644
index 00000000..89e26b6b
--- /dev/null
+++ b/recipes-containers/vcontainer/files/vrunner-backend-xen.sh
@@ -0,0 +1,564 @@
+#!/bin/bash
+# SPDX-FileCopyrightText: Copyright (C) 2025 Bruce Ashfield
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# vrunner-backend-xen.sh
+# Xen hypervisor backend for vrunner.sh
+#
+# This backend implements the hypervisor interface for Xen xl toolstack.
+# It is sourced by vrunner.sh when VCONTAINER_HYPERVISOR=xen.
+#
+# This backend runs on a Xen Dom0 host and creates DomU guests using xl.
+# Key differences from QEMU backend:
+#   - Block devices appear as /dev/xvd* instead of /dev/vd*
+#   - Network uses bridge + iptables NAT instead of QEMU slirp
+#   - Console uses PV console (hvc0/hvc1) instead of virtio-serial
+#   - 9p file sharing uses trans=xen instead of trans=virtio
+#   - VM tracking uses domain name instead of PID
+
+# ============================================================================
+# Architecture Setup
+# ============================================================================
+
+hv_setup_arch() {
+    case "$TARGET_ARCH" in
+        aarch64)
+            KERNEL_IMAGE="$BLOB_DIR/aarch64/Image"
+            INITRAMFS="$BLOB_DIR/aarch64/initramfs.cpio.gz"
+            ROOTFS_IMG="$BLOB_DIR/aarch64/rootfs.img"
+            HV_CMD="xl"
+            HV_CONSOLE="hvc0"
+            ;;
+        x86_64)
+            KERNEL_IMAGE="$BLOB_DIR/x86_64/bzImage"
+            INITRAMFS="$BLOB_DIR/x86_64/initramfs.cpio.gz"
+            ROOTFS_IMG="$BLOB_DIR/x86_64/rootfs.img"
+            HV_CMD="xl"
+            HV_CONSOLE="hvc0"
+            ;;
+        *)
+            log "ERROR" "Unsupported architecture: $TARGET_ARCH"
+            exit 1
+            ;;
+    esac
+
+    # Xen domain name (unique per instance)
+    HV_DOMNAME="vxn-$$"
+    HV_VM_PID=""
+
+    # Xen domain config path (generated at runtime)
+    HV_XEN_CFG=""
+
+    # Xen-specific: pass block device prefix via kernel cmdline
+    # so preinit can find rootfs before /proc is mounted
+    HV_BLK_PREFIX="xvd"
+}
+
+hv_check_accel() {
+    # Xen IS the hypervisor - no KVM check needed
+    USE_KVM="false"
+    log "DEBUG" "Xen hypervisor (no KVM check needed)"
+}
+
+hv_skip_state_disk() {
+    # Xen DomU Docker storage lives in the guest's overlay filesystem.
+    # In daemon mode the domain stays running so storage persists naturally.
+    # No need to create a 2GB disk image on Dom0.
+    return 0
+}
+
+# ============================================================================
+# Container Image Preparation (OCI pull via skopeo)
+# ============================================================================
+
+# Pull OCI image on the host so the input disk creation code can package it.
+# Called from vrunner.sh before input disk creation. Modifies globals:
+#   INPUT_PATH  - set to the OCI layout directory
+#   INPUT_TYPE  - set to "oci"
+#   DOCKER_CMD  - rewritten to the resolved entrypoint/command
+#
+# The host resolves the OCI entrypoint using jq (available on Dom0)
+# so the guest doesn't need jq to determine what to execute.
+hv_prepare_container() {
+    # Skip if user already provided --input
+    [ -n "$INPUT_PATH" ] && return 0
+
+    # Only act on "run" commands
+    case "$DOCKER_CMD" in
+        *" run "*)  ;;
+        *)          return 0 ;;
+    esac
+
+    # Check for skopeo
+    if ! command -v skopeo >/dev/null 2>&1; then
+        log "ERROR" "skopeo not found. Install skopeo for OCI image pulling."
+        exit 1
+    fi
+
+    # Parse image name and any trailing command from "docker run [opts] <image> [cmd...]"
+    local args
+    args=$(echo "$DOCKER_CMD" | sed 's/^[a-z]* run //')
+
+    local image=""
+    local user_cmd=""
+    local skip_next=false
+    local found_image=false
+    for arg in $args; do
+        if [ "$skip_next" = "true" ]; then
+            skip_next=false
+            continue
+        fi
+        if [ "$found_image" = "true" ]; then
+            # Everything after image name is the user command
+            user_cmd="$user_cmd $arg"
+            continue
+        fi
+        case "$arg" in
+            --rm|--detach|-d|-i|--interactive|-t|--tty|--privileged|-it)
+                ;;
+            -p|--publish|-v|--volume|-e|--env|--name|--network|-w|--workdir|--entrypoint|-m|--memory|--cpus)
+                skip_next=true
+                ;;
+            --publish=*|--volume=*|--env=*|--name=*|--network=*|--workdir=*|--entrypoint=*|--dns=*|--memory=*|--cpus=*)
+                ;;
+            -*)
+                ;;
+            *)
+                image="$arg"
+                found_image=true
+                ;;
+        esac
+    done
+    user_cmd=$(echo "$user_cmd" | sed 's/^ *//')
+
+    if [ -z "$image" ]; then
+        log "DEBUG" "hv_prepare_container: no image found in DOCKER_CMD"
+        return 0
+    fi
+
+    log "INFO" "Pulling OCI image: $image"
+
+    local oci_dir="$TEMP_DIR/oci-image"
+    local skopeo_log="$TEMP_DIR/skopeo.log"
+    if skopeo copy "docker://$image" "oci:$oci_dir:latest" > "$skopeo_log" 2>&1; then
+        INPUT_PATH="$oci_dir"
+        INPUT_TYPE="oci"
+        log "INFO" "OCI image pulled to $oci_dir"
+    else
+        log "ERROR" "Failed to pull image: $image"
+        [ -f "$skopeo_log" ] && while IFS= read -r line; do
+            log "ERROR" "skopeo: $line"
+        done < "$skopeo_log"
+        exit 1
+    fi
+
+    # Resolve entrypoint from OCI config on the host (jq available here).
+    # Rewrite DOCKER_CMD so the guest receives the actual command to exec,
+    # avoiding any dependency on jq inside the minimal guest rootfs.
+    local resolved_cmd="$user_cmd"
+    if [ -z "$resolved_cmd" ] && command -v jq >/dev/null 2>&1; then
+        local entrypoint="" oci_cmd=""
+        local manifest_digest config_digest manifest_file config_file
+        manifest_digest=$(jq -r '.manifests[0].digest' "$oci_dir/index.json" 2>/dev/null)
+        manifest_file="$oci_dir/blobs/${manifest_digest/://}"
+        if [ -f "$manifest_file" ]; then
+            config_digest=$(jq -r '.config.digest' "$manifest_file" 2>/dev/null)
+            config_file="$oci_dir/blobs/${config_digest/://}"
+            if [ -f "$config_file" ]; then
+                entrypoint=$(jq -r '(.config.Entrypoint // []) | join(" ")' "$config_file" 2>/dev/null)
+                oci_cmd=$(jq -r '(.config.Cmd // []) | join(" ")' "$config_file" 2>/dev/null)
+            fi
+        fi
+        if [ -n "$entrypoint" ]; then
+            resolved_cmd="$entrypoint"
+            [ -n "$oci_cmd" ] && resolved_cmd="$resolved_cmd $oci_cmd"
+        elif [ -n "$oci_cmd" ]; then
+            resolved_cmd="$oci_cmd"
+        fi
+        log "INFO" "Resolved OCI entrypoint: $resolved_cmd"
+    fi
+
+    if [ -n "$resolved_cmd" ]; then
+        DOCKER_CMD="$resolved_cmd"
+        log "INFO" "DOCKER_CMD rewritten to: $DOCKER_CMD"
+    fi
+}
+
+hv_find_command() {
+    if ! command -v xl >/dev/null 2>&1; then
+        log "ERROR" "xl (Xen toolstack) not found. Install xen-tools-xl."
+        exit 1
+    fi
+    log "DEBUG" "Using Xen xl toolstack"
+}
+
+hv_get_console_device() {
+    echo "$HV_CONSOLE"
+}
+
+# ============================================================================
+# VM Configuration Building
+# ============================================================================
+
+# Internal: accumulate disk config entries
+_XEN_DISKS=()
+_XEN_VIF=""
+_XEN_9P=()
+
+hv_build_disk_opts() {
+    _XEN_DISKS=()
+
+    # Rootfs (read-only)
+    _XEN_DISKS+=("'format=raw,vdev=xvda,access=ro,target=$ROOTFS_IMG'")
+
+    # Input disk (if any) - check if DISK_OPTS is set (means input disk was created)
+    if [ -n "$DISK_OPTS" ]; then
+        # Extract the file path from QEMU-style DISK_OPTS
+        local input_file
+        input_file=$(echo "$DISK_OPTS" | sed -n 's/.*file=\([^,]*\).*/\1/p')
+        if [ -n "$input_file" ]; then
+            _XEN_DISKS+=("'format=raw,vdev=xvdb,access=rw,target=$input_file'")
+        fi
+    fi
+
+    # State disk (if any)
+    if [ -n "$STATE_DISK_OPTS" ]; then
+        local state_file
+        state_file=$(echo "$STATE_DISK_OPTS" | sed -n 's/.*file=\([^,]*\).*/\1/p')
+        if [ -n "$state_file" ]; then
+            _XEN_DISKS+=("'format=raw,vdev=xvdc,access=rw,target=$state_file'")
+        fi
+    fi
+}
+
+hv_build_network_opts() {
+    _XEN_VIF=""
+    if [ "$NETWORK" = "true" ]; then
+        # Use default bridge networking
+        # Xen will attach the vif to xenbr0 or the default bridge
+        _XEN_VIF="'bridge=xenbr0'"
+    fi
+    # If no network, _XEN_VIF stays empty → vif = [] in config
+}
+
+hv_build_9p_opts() {
+    local share_dir="$1"
+    local share_tag="$2"
+    # For Xen, 9p is configured in the domain config, not as a command-line option
+    # We accumulate these and include them in the config file
+    _XEN_9P+=("{ 'tag': '$share_tag', 'path': '$share_dir', 'security_model': 'none' }")
+    # Return empty string since Xen doesn't use command-line 9p options
+    echo ""
+}
+
+hv_build_daemon_opts() {
+    HV_DAEMON_OPTS=""
+    # Xen uses PV console (hvc1) for daemon command channel
+    # The init scripts already have /dev/hvc1 as a fallback for the daemon port
+    # No extra config needed - hvc1 is automatically available in PV guests
+    #
+    # For the host-side socket, we'll use xl console with a pipe
+    # The daemon socket is handled differently for Xen:
+    # We create a socat bridge between the Xen console and a unix socket
+}
+
+hv_build_vm_cmd() {
+    # For Xen, we generate a domain config file instead of a command line
+    # HV_OPTS is not used directly; the config file is written by _write_xen_config
+    HV_OPTS=""
+}
+
+# Internal: write Xen domain config file
+_write_xen_config() {
+    local kernel_append="$1"
+    local config_path="$2"
+
+    # Build disk array
+    local disk_array=""
+    for d in "${_XEN_DISKS[@]}"; do
+        if [ -n "$disk_array" ]; then
+            disk_array="$disk_array, $d"
+        else
+            disk_array="$d"
+        fi
+    done
+
+    # Build vif array
+    local vif_array=""
+    if [ -n "$_XEN_VIF" ]; then
+        vif_array="$_XEN_VIF"
+    fi
+
+    # Determine guest type per architecture:
+    #   x86_64: PV guests work (paravirtualized, no HVM needed)
+    #   aarch64: ARM Xen only supports PVH-style guests (no PV)
+    local xen_type="pv"
+    case "$TARGET_ARCH" in
+        aarch64) xen_type="pvh" ;;
+    esac
+
+    # Memory and vCPUs - configurable via environment
+    local xen_memory="${VXN_MEMORY:-512}"
+    local xen_vcpus="${VXN_VCPUS:-2}"
+
+    cat > "$config_path" <<XENEOF
+# Auto-generated Xen domain config for vxn
+name = "$HV_DOMNAME"
+type = "$xen_type"
+memory = $xen_memory
+vcpus = $xen_vcpus
+
+kernel = "$KERNEL_IMAGE"
+ramdisk = "$INITRAMFS"
+extra = "console=hvc0 quiet loglevel=0 init=/init vcontainer.blk=xvd vcontainer.init=/vxn-init.sh $kernel_append"
+
+disk = [ $disk_array ]
+vif = [ $vif_array ]
+
+on_poweroff = "destroy"
+on_reboot = "destroy"
+on_crash = "destroy"
+XENEOF
+
+    # Add 9p config if any shares were requested
+    if [ ${#_XEN_9P[@]} -gt 0 ]; then
+        local p9_array=""
+        for p in "${_XEN_9P[@]}"; do
+            if [ -n "$p9_array" ]; then
+                p9_array="$p9_array, $p"
+            else
+                p9_array="$p"
+            fi
+        done
+        echo "p9 = [ $p9_array ]" >> "$config_path"
+    fi
+
+    log "DEBUG" "Xen config written to $config_path"
+}
+
+# ============================================================================
+# VM Lifecycle
+# ============================================================================
+
+hv_start_vm_background() {
+    local kernel_append="$1"
+    local log_file="$2"
+    local timeout_val="$3"
+
+    # Write domain config
+    HV_XEN_CFG="${TEMP_DIR:-/tmp}/vxn-$$.cfg"
+    _write_xen_config "$kernel_append" "$HV_XEN_CFG"
+
+    # Create the domain
+    xl create "$HV_XEN_CFG" >> "$log_file" 2>&1
+
+    # For background monitoring, we need a PID-like concept
+    # Use the domain name as VM identifier
+    HV_VM_PID="$$"  # Use our PID as a placeholder for compatibility
+
+    if [ -n "$DAEMON_SOCKET" ]; then
+        # Daemon mode: bridge xl console (hvc1) to the daemon unix socket
+        # xl console -n 1 connects to the second PV console (hvc1)
+        socat "UNIX-LISTEN:$DAEMON_SOCKET,fork" "EXEC:xl console -n 1 $HV_DOMNAME" &
+        _XEN_SOCAT_PID=$!
+        log "DEBUG" "Console-socket bridge started (PID: $_XEN_SOCAT_PID)"
+    else
+        # Ephemeral mode: capture guest console (hvc0) to log file
+        # so the monitoring loop in vrunner.sh can see output markers
+        xl console "$HV_DOMNAME" >> "$log_file" 2>&1 &
+        _XEN_CONSOLE_PID=$!
+        log "DEBUG" "Console capture started (PID: $_XEN_CONSOLE_PID)"
+    fi
+}
+
+hv_start_vm_foreground() {
+    local kernel_append="$1"
+
+    HV_XEN_CFG="${TEMP_DIR:-/tmp}/vxn-$$.cfg"
+    _write_xen_config "$kernel_append" "$HV_XEN_CFG"
+
+    # Create domain and attach console
+    xl create -c "$HV_XEN_CFG"
+}
+
+hv_is_vm_running() {
+    xl list "$HV_DOMNAME" >/dev/null 2>&1
+}
+
+hv_wait_vm_exit() {
+    local timeout="${1:-30}"
+    for i in $(seq 1 "$timeout"); do
+        hv_is_vm_running || return 0
+        sleep 1
+    done
+    return 1
+}
+
+hv_stop_vm() {
+    log "INFO" "Shutting down Xen domain $HV_DOMNAME..."
+    xl shutdown "$HV_DOMNAME" 2>/dev/null || true
+
+    # Wait for graceful shutdown
+    hv_wait_vm_exit 15 || {
+        log "WARN" "Domain didn't shut down gracefully, destroying..."
+        hv_destroy_vm
+    }
+}
+
+hv_destroy_vm() {
+    xl destroy "$HV_DOMNAME" 2>/dev/null || true
+
+    # Clean up console capture (ephemeral mode)
+    if [ -n "${_XEN_CONSOLE_PID:-}" ]; then
+        kill $_XEN_CONSOLE_PID 2>/dev/null || true
+    fi
+
+    # Clean up console bridge (daemon mode)
+    if [ -n "${_XEN_SOCAT_PID:-}" ]; then
+        kill $_XEN_SOCAT_PID 2>/dev/null || true
+    fi
+}
+
+hv_get_vm_id() {
+    echo "$HV_DOMNAME"
+}
+
+# ============================================================================
+# Port Forwarding (iptables NAT for Xen bridge networking)
+# ============================================================================
+
+# Track iptables rules for cleanup
+_XEN_IPTABLES_RULES=()
+
+hv_setup_port_forwards() {
+    if [ ${#PORT_FORWARDS[@]} -eq 0 ]; then
+        return
+    fi
+
+    # Get guest IP from Xen network config
+    # Wait briefly for the guest to get an IP
+    local guest_ip=""
+    for attempt in $(seq 1 30); do
+        guest_ip=$(xl network-list "$HV_DOMNAME" 2>/dev/null | awk 'NR>1{print $4}' | head -1)
+        if [ -n "$guest_ip" ] && [ "$guest_ip" != "-" ]; then
+            break
+        fi
+        sleep 1
+    done
+
+    if [ -z "$guest_ip" ] || [ "$guest_ip" = "-" ]; then
+        log "WARN" "Could not determine guest IP for port forwarding"
+        return
+    fi
+
+    log "INFO" "Guest IP: $guest_ip"
+
+    for pf in "${PORT_FORWARDS[@]}"; do
+        local host_port="${pf%%:*}"
+        local rest="${pf#*:}"
+        local container_port="${rest%%/*}"
+        local proto="tcp"
+        if [[ "$rest" == */* ]]; then
+            proto="${rest##*/}"
+        fi
+
+        iptables -t nat -A PREROUTING -p "$proto" --dport "$host_port" \
+            -j DNAT --to-destination "$guest_ip:$host_port" 2>/dev/null || true
+        iptables -A FORWARD -p "$proto" -d "$guest_ip" --dport "$host_port" \
+            -j ACCEPT 2>/dev/null || true
+        _XEN_IPTABLES_RULES+=("$proto:$host_port:$guest_ip")
+        log "INFO" "Port forward: host:$host_port -> $guest_ip:$host_port ($proto)"
+    done
+}
+
+hv_cleanup_port_forwards() {
+    for rule in "${_XEN_IPTABLES_RULES[@]}"; do
+        local proto="${rule%%:*}"
+        local rest="${rule#*:}"
+        local host_port="${rest%%:*}"
+        local guest_ip="${rest#*:}"
+
+        iptables -t nat -D PREROUTING -p "$proto" --dport "$host_port" \
+            -j DNAT --to-destination "$guest_ip:$host_port" 2>/dev/null || true
+        iptables -D FORWARD -p "$proto" -d "$guest_ip" --dport "$host_port" \
+            -j ACCEPT 2>/dev/null || true
+    done
+    _XEN_IPTABLES_RULES=()
+}
+
+# ============================================================================
+# Idle Timeout
+# ============================================================================
+
+hv_idle_shutdown() {
+    # For Xen, use xl shutdown for graceful stop
+    xl shutdown "$HV_DOMNAME" 2>/dev/null || true
+}
+
+# ============================================================================
+# Daemon Lifecycle (Xen-specific overrides)
+# ============================================================================
+# Xen domains persist via xl, not as child processes. The PID saved by
+# vrunner.sh is just a placeholder. These hooks let daemon_is_running()
+# and daemon_stop() work correctly for Xen.
+
+# Persist domain name alongside PID file so we can recover it on reconnect
+_xen_domname_file() {
+    echo "${DAEMON_SOCKET_DIR:-/tmp}/daemon.domname"
+}
+
+hv_daemon_save_state() {
+    echo "$HV_DOMNAME" > "$(_xen_domname_file)"
+}
+
+hv_daemon_load_state() {
+    local f="$(_xen_domname_file)"
+    if [ -f "$f" ]; then
+        HV_DOMNAME=$(cat "$f" 2>/dev/null)
+    fi
+}
+
+hv_daemon_is_running() {
+    hv_daemon_load_state
+    [ -n "$HV_DOMNAME" ] && xl list "$HV_DOMNAME" >/dev/null 2>&1
+}
+
+hv_daemon_stop() {
+    hv_daemon_load_state
+    if [ -z "$HV_DOMNAME" ]; then
+        return 0
+    fi
+
+    log "INFO" "Shutting down Xen domain $HV_DOMNAME..."
+
+    # Send shutdown command via socket first (graceful guest shutdown)
+    if [ -S "$DAEMON_SOCKET" ]; then
+        echo "===SHUTDOWN===" | socat - "UNIX-CONNECT:$DAEMON_SOCKET" 2>/dev/null || true
+        sleep 2
+    fi
+
+    # Try graceful xl shutdown
+    if xl list "$HV_DOMNAME" >/dev/null 2>&1; then
+        xl shutdown "$HV_DOMNAME" 2>/dev/null || true
+        # Wait for domain to disappear
+        for i in $(seq 1 15); do
+            xl list "$HV_DOMNAME" >/dev/null 2>&1 || break
+            sleep 1
+        done
+    fi
+
+    # Force destroy if still running
+    if xl list "$HV_DOMNAME" >/dev/null 2>&1; then
+        log "WARN" "Domain didn't shut down gracefully, destroying..."
+        xl destroy "$HV_DOMNAME" 2>/dev/null || true
+    fi
+
+    # Clean up console bridge
+    if [ -n "${_XEN_SOCAT_PID:-}" ]; then
+        kill $_XEN_SOCAT_PID 2>/dev/null || true
+    fi
+
+    rm -f "$(_xen_domname_file)"
+    log "INFO" "Xen domain stopped"
+}
diff --git a/recipes-containers/vcontainer/files/vrunner.sh b/recipes-containers/vcontainer/files/vrunner.sh
index 22e9229a..8ad45afe 100755
--- a/recipes-containers/vcontainer/files/vrunner.sh
+++ b/recipes-containers/vcontainer/files/vrunner.sh
@@ -4,29 +4,29 @@
 # SPDX-License-Identifier: GPL-2.0-only
 #
 # vrunner.sh
-# Core runner for vdkr/vpdmn: execute container commands in QEMU-emulated environment
+# Core runner for vdkr/vpdmn/vxn: execute container commands in a hypervisor VM
 #
 # This script is runtime-agnostic and supports both Docker and Podman via --runtime.
+# It is also hypervisor-agnostic via pluggable backends (QEMU, Xen).
 #
 # Boot flow:
-# 1. QEMU loads kernel + tiny initramfs (busybox + preinit)
-# 2. preinit mounts rootfs.img (/dev/vda) and does switch_root
-# 3. Real /init runs on actual ext4 filesystem
+# 1. Hypervisor boots kernel + tiny initramfs (busybox + preinit)
+# 2. preinit mounts rootfs.img and does switch_root
+# 3. Real /init runs on actual filesystem
 # 4. Container runtime starts, executes command, outputs results
 #
 # This two-stage boot is required because runc needs pivot_root,
 # which doesn't work from initramfs (rootfs isn't a mount point).
 #
-# Drive layout:
-#   /dev/vda = rootfs.img (ro, ext4 with container tools)
-#   /dev/vdb = input disk (optional, user data)
-#   /dev/vdc = state disk (optional, persistent container storage)
+# Drive layout (device names vary by hypervisor):
+#   QEMU: /dev/vda, /dev/vdb, /dev/vdc (virtio-blk)
+#   Xen:  /dev/xvda, /dev/xvdb, /dev/xvdc (xen-blkfront)
 #
-# Version: 3.4.0
+# Version: 3.5.0
 
 set -e
 
-VERSION="3.4.0"
+VERSION="3.5.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Runtime selection: docker or podman
@@ -42,19 +42,19 @@ VERBOSE="${VDKR_VERBOSE:-${VPDMN_VERBOSE:-false}}"
 set_runtime_config() {
     case "$RUNTIME" in
         docker)
-            TOOL_NAME="vdkr"
+            TOOL_NAME="${VCONTAINER_RUNTIME_NAME:-vdkr}"
             BLOB_SUBDIR="vdkr-blobs"
             BLOB_SUBDIR_ALT="blobs"
             CMDLINE_PREFIX="docker"
-            STATE_DIR_BASE="${VDKR_STATE_DIR:-$HOME/.vdkr}"
+            STATE_DIR_BASE="${VDKR_STATE_DIR:-$HOME/.${TOOL_NAME}}"
             STATE_FILE="docker-state.img"
             ;;
         podman)
-            TOOL_NAME="vpdmn"
+            TOOL_NAME="${VCONTAINER_RUNTIME_NAME:-vpdmn}"
             BLOB_SUBDIR="vpdmn-blobs"
             BLOB_SUBDIR_ALT="blobs/vpdmn"
             CMDLINE_PREFIX="podman"
-            STATE_DIR_BASE="${VPDMN_STATE_DIR:-$HOME/.vpdmn}"
+            STATE_DIR_BASE="${VPDMN_STATE_DIR:-$HOME/.${TOOL_NAME}}"
             STATE_FILE="podman-state.img"
             ;;
         *)
@@ -417,6 +417,10 @@ while [ $# -gt 0 ]; do
             DISABLE_KVM="true"
             shift
             ;;
+        --hypervisor)
+            VCONTAINER_HYPERVISOR="$2"
+            shift 2
+            ;;
         --batch-import)
             BATCH_IMPORT="true"
             # Force storage output type for batch import
@@ -485,6 +489,18 @@ done
 set_runtime_config
 set_blob_dir
 
+# Load hypervisor backend
+VCONTAINER_HYPERVISOR="${VCONTAINER_HYPERVISOR:-qemu}"
+VCONTAINER_LIBDIR="${VCONTAINER_LIBDIR:-$SCRIPT_DIR}"
+HV_BACKEND="$VCONTAINER_LIBDIR/vrunner-backend-${VCONTAINER_HYPERVISOR}.sh"
+if [ ! -f "$HV_BACKEND" ]; then
+    echo "ERROR: Hypervisor backend not found: $HV_BACKEND" >&2
+    echo "Available backends:" >&2
+    ls "$VCONTAINER_LIBDIR"/vrunner-backend-*.sh 2>/dev/null | sed 's/.*vrunner-backend-//;s/\.sh$//' >&2
+    exit 1
+fi
+source "$HV_BACKEND"
+
 # Daemon mode handling
 # Set default socket directory based on architecture
 # If --state-dir was provided, use it for daemon files too
@@ -503,6 +519,12 @@ DAEMON_INPUT_SIZE_MB=2048  # 2GB input disk for daemon mode
 
 # Daemon helper functions
 daemon_is_running() {
+    # Use backend-specific check if available (e.g. Xen xl list)
+    if type hv_daemon_is_running >/dev/null 2>&1; then
+        hv_daemon_is_running
+        return $?
+    fi
+    # Default: check PID (works for QEMU)
     if [ -f "$DAEMON_PID_FILE" ]; then
         local pid=$(cat "$DAEMON_PID_FILE" 2>/dev/null)
         if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
@@ -514,8 +536,10 @@ daemon_is_running() {
 
 daemon_status() {
     if daemon_is_running; then
-        local pid=$(cat "$DAEMON_PID_FILE")
-        echo "Daemon running (PID: $pid)"
+        local pid=$(cat "$DAEMON_PID_FILE" 2>/dev/null)
+        local vm_id
+        vm_id=$(hv_get_vm_id 2>/dev/null || echo "$pid")
+        echo "Daemon running (VM: $vm_id)"
         echo "Socket: $DAEMON_SOCKET"
         echo "Architecture: $TARGET_ARCH"
         return 0
@@ -531,6 +555,14 @@ daemon_stop() {
         return 0
     fi
 
+    # Use backend-specific stop if available (e.g. Xen xl shutdown/destroy)
+    if type hv_daemon_stop >/dev/null 2>&1; then
+        hv_daemon_stop
+        rm -f "$DAEMON_PID_FILE" "$DAEMON_SOCKET"
+        return 0
+    fi
+
+    # Default: PID-based stop (works for QEMU)
     local pid=$(cat "$DAEMON_PID_FILE")
     log "INFO" "Stopping daemon (PID: $pid)..."
 
@@ -933,36 +965,16 @@ log "INFO" "Output type: $OUTPUT_TYPE"
 [ "$NETWORK" = "true" ] && log "INFO" "Networking: enabled (slirp)"
 [ "$INTERACTIVE" = "true" ] && log "INFO" "Interactive mode: enabled"
 
-# Find kernel, initramfs, and rootfs
-case "$TARGET_ARCH" in
-    aarch64)
-        KERNEL_IMAGE="$BLOB_DIR/aarch64/Image"
-        INITRAMFS="$BLOB_DIR/aarch64/initramfs.cpio.gz"
-        ROOTFS_IMG="$BLOB_DIR/aarch64/rootfs.img"
-        QEMU_CMD="qemu-system-aarch64"
-        QEMU_MACHINE="-M virt -cpu cortex-a57"
-        CONSOLE="ttyAMA0"
-        ;;
-    x86_64)
-        KERNEL_IMAGE="$BLOB_DIR/x86_64/bzImage"
-        INITRAMFS="$BLOB_DIR/x86_64/initramfs.cpio.gz"
-        ROOTFS_IMG="$BLOB_DIR/x86_64/rootfs.img"
-        QEMU_CMD="qemu-system-x86_64"
-        # Use q35 + Skylake-Client to match oe-core qemux86-64 machine
-        QEMU_MACHINE="-M q35 -cpu Skylake-Client"
-        CONSOLE="ttyS0"
-        ;;
-    *)
-        log "ERROR" "Unsupported architecture: $TARGET_ARCH"
-        exit 1
-        ;;
-esac
+# Initialize hypervisor backend: set arch-specific paths and commands
+hv_setup_arch
+hv_check_accel
+hv_find_command
 
 # Check for kernel
 if [ ! -f "$KERNEL_IMAGE" ]; then
     log "ERROR" "Kernel not found: $KERNEL_IMAGE"
-    log "ERROR" "Set VDKR_BLOB_DIR or --blob-dir to location of vdkr blobs"
-    log "ERROR" "Build with: MACHINE=qemuarm64 bitbake vdkr-initramfs-build"
+    log "ERROR" "Set --blob-dir to location of blobs"
+    log "ERROR" "Build with: bitbake ${TOOL_NAME}-initramfs-create"
     exit 1
 fi
 
@@ -973,61 +985,20 @@ if [ ! -f "$INITRAMFS" ]; then
     exit 1
 fi
 
-# Check for rootfs image (ext4 with Docker tools)
+# Check for rootfs image
 if [ ! -f "$ROOTFS_IMG" ]; then
     log "ERROR" "Rootfs image not found: $ROOTFS_IMG"
     log "ERROR" "Build with: MACHINE=qemuarm64 bitbake vdkr-initramfs-create"
     exit 1
 fi
 
-# Find QEMU - check PATH and common locations
-if ! command -v "$QEMU_CMD" >/dev/null 2>&1; then
-    # Try common locations
-    for path in \
-        "${STAGING_BINDIR_NATIVE:-}" \
-        "/usr/bin"; do
-        if [ -n "$path" ] && [ -x "$path/$QEMU_CMD" ]; then
-            QEMU_CMD="$path/$QEMU_CMD"
-            break
-        fi
-    done
-fi
-
-if ! command -v "$QEMU_CMD" >/dev/null 2>&1 && [ ! -x "$QEMU_CMD" ]; then
-    log "ERROR" "QEMU not found: $QEMU_CMD"
-    exit 1
-fi
-
-log "DEBUG" "Using QEMU: $QEMU_CMD"
+log "DEBUG" "Using initramfs: $INITRAMFS"
 
-# Check for KVM acceleration (when host matches target)
-USE_KVM="false"
-if [ "$DISABLE_KVM" = "true" ]; then
-    log "DEBUG" "KVM disabled by --no-kvm flag"
-else
-    HOST_ARCH=$(uname -m)
-    if [ "$HOST_ARCH" = "$TARGET_ARCH" ] || \
-       { [ "$HOST_ARCH" = "x86_64" ] && [ "$TARGET_ARCH" = "x86_64" ]; }; then
-        if [ -w /dev/kvm ]; then
-            USE_KVM="true"
-            # Use host CPU for best performance with KVM
-            case "$TARGET_ARCH" in
-                x86_64)
-                    QEMU_MACHINE="-M q35 -cpu host"
-                    ;;
-                aarch64)
-                    QEMU_MACHINE="-M virt -cpu host"
-                    ;;
-            esac
-            log "INFO" "KVM acceleration enabled"
-        else
-            log "DEBUG" "KVM not available (no write access to /dev/kvm)"
-        fi
-    fi
+# Let backend prepare container image if needed (e.g., Xen pulls OCI via skopeo)
+if type hv_prepare_container >/dev/null 2>&1; then
+    hv_prepare_container
 fi
 
-log "DEBUG" "Using initramfs: $INITRAMFS"
-
 # Create input disk image if needed
 DISK_OPTS=""
 if [ -n "$INPUT_PATH" ] && [ "$INPUT_TYPE" != "none" ]; then
@@ -1062,8 +1033,10 @@ if [ -n "$INPUT_PATH" ] && [ "$INPUT_TYPE" != "none" ]; then
 fi
 
 # Create state disk for persistent storage (--state-dir)
+# Xen backend skips this: DomU Docker storage lives in the guest's overlay
+# filesystem and persists as long as the domain is running (daemon mode).
 STATE_DISK_OPTS=""
-if [ -n "$STATE_DIR" ]; then
+if [ -n "$STATE_DIR" ] && ! type hv_skip_state_disk >/dev/null 2>&1; then
     mkdir -p "$STATE_DIR"
     STATE_IMG="$STATE_DIR/$STATE_FILE"
 
@@ -1090,6 +1063,10 @@ if [ -n "$STATE_DIR" ]; then
     # Combined with graceful shutdown wait, this ensures data integrity
     STATE_DISK_OPTS="-drive file=$STATE_IMG,if=virtio,format=raw,cache=directsync"
     log "DEBUG" "State disk: $(ls -lh "$STATE_IMG" | awk '{print $5}')"
+elif [ -n "$STATE_DIR" ]; then
+    # Backend skips state disk but we still need the directory for daemon files
+    mkdir -p "$STATE_DIR"
+    log "DEBUG" "State disk: skipped (${VCONTAINER_HYPERVISOR} backend manages guest storage)"
 fi
 
 # Create state disk from input-storage tar (--input-storage)
@@ -1147,9 +1124,9 @@ DOCKER_CMD_B64=$(echo -n "$DOCKER_CMD" | base64 -w0)
 # In interactive mode, use 'quiet' to suppress kernel boot messages
 # Use CMDLINE_PREFIX for runtime-specific parameters (docker_ or podman_)
 if [ "$INTERACTIVE" = "true" ]; then
-    KERNEL_APPEND="console=$CONSOLE,115200 quiet loglevel=0 init=/init"
+    KERNEL_APPEND="console=$(hv_get_console_device),115200 quiet loglevel=0 init=/init"
 else
-    KERNEL_APPEND="console=$CONSOLE,115200 init=/init"
+    KERNEL_APPEND="console=$(hv_get_console_device),115200 init=/init"
 fi
 # Tell init script which runtime we're using
 KERNEL_APPEND="$KERNEL_APPEND runtime=$RUNTIME"
@@ -1198,66 +1175,24 @@ if [ "$INTERACTIVE" = "true" ]; then
     KERNEL_APPEND="$KERNEL_APPEND ${CMDLINE_PREFIX}_interactive=1"
 fi
 
-# Build QEMU command
+# Build VM configuration via hypervisor backend
 # Drive ordering is important:
-#   /dev/vda = rootfs.img (read-only, ext4 with Docker tools)
-#   /dev/vdb = input disk (if any)
-#   /dev/vdc = state disk (if any)
-# The preinit script in initramfs mounts /dev/vda and does switch_root
-# Build QEMU options
-QEMU_OPTS="$QEMU_MACHINE -nographic -smp 2 -m 2048 -no-reboot"
-if [ "$USE_KVM" = "true" ]; then
-    QEMU_OPTS="$QEMU_OPTS -enable-kvm"
-fi
-QEMU_OPTS="$QEMU_OPTS -kernel $KERNEL_IMAGE"
-QEMU_OPTS="$QEMU_OPTS -initrd $INITRAMFS"
-QEMU_OPTS="$QEMU_OPTS -drive file=$ROOTFS_IMG,if=virtio,format=raw,readonly=on"
-QEMU_OPTS="$QEMU_OPTS $DISK_OPTS"
-QEMU_OPTS="$QEMU_OPTS $STATE_DISK_OPTS"
-
-# Add networking if enabled (slirp user-mode networking)
-if [ "$NETWORK" = "true" ]; then
-    # Slirp provides NAT'd outbound connectivity without root privileges
-    # Guest gets 10.0.2.15, gateway is 10.0.2.2, DNS is 10.0.2.3
-    NETDEV_OPTS="user,id=net0"
-
-    # Add port forwards - QEMU forwards host:port -> VM:port
-    # Docker's iptables handles VM:port -> container:port
-    for pf in "${PORT_FORWARDS[@]}"; do
-        # Parse host_port:container_port or host_port:container_port/protocol
-        HOST_PORT="${pf%%:*}"
-        CONTAINER_PART="${pf#*:}"
-        CONTAINER_PORT="${CONTAINER_PART%%/*}"
-
-        # Check for protocol suffix (default to tcp)
-        if [[ "$CONTAINER_PART" == */* ]]; then
-            PROTOCOL="${CONTAINER_PART##*/}"
-        else
-            PROTOCOL="tcp"
-        fi
-
-        # Forward to HOST_PORT on VM; Docker -p handles container port mapping
-        NETDEV_OPTS="$NETDEV_OPTS,hostfwd=$PROTOCOL::$HOST_PORT-:$HOST_PORT"
-        log "INFO" "Port forward: host:$HOST_PORT -> VM:$HOST_PORT (Docker maps to container:$CONTAINER_PORT)"
-    done
-
-    QEMU_OPTS="$QEMU_OPTS -netdev $NETDEV_OPTS -device virtio-net-pci,netdev=net0"
-else
-    # Explicitly disable networking
-    QEMU_OPTS="$QEMU_OPTS -nic none"
-fi
+#   rootfs.img (read-only), input disk (if any), state disk (if any)
+hv_build_disk_opts
+hv_build_network_opts
+hv_build_vm_cmd
 
-# Batch-import mode: add virtio-9p for fast output (instead of slow console base64)
+# Batch-import mode: add 9p for fast output (instead of slow console base64)
 if [ "$BATCH_IMPORT" = "true" ]; then
     BATCH_SHARE_DIR="$TEMP_DIR/share"
     mkdir -p "$BATCH_SHARE_DIR"
     SHARE_TAG="${TOOL_NAME}_share"
-    QEMU_OPTS="$QEMU_OPTS -virtfs local,path=$BATCH_SHARE_DIR,mount_tag=$SHARE_TAG,security_model=none,id=$SHARE_TAG"
+    HV_OPTS="$HV_OPTS $(hv_build_9p_opts "$BATCH_SHARE_DIR" "$SHARE_TAG")"
     KERNEL_APPEND="$KERNEL_APPEND ${CMDLINE_PREFIX}_9p=1"
-    log "INFO" "Using virtio-9p for fast storage output"
+    log "INFO" "Using 9p for fast storage output"
 fi
 
-# Daemon mode: add virtio-serial for command channel
+# Daemon mode: add serial channel for command I/O
 if [ "$DAEMON_MODE" = "start" ]; then
     # Check for required tools
     if ! command -v socat >/dev/null 2>&1; then
@@ -1275,30 +1210,18 @@ if [ "$DAEMON_MODE" = "start" ]; then
     # Create socket directory
     mkdir -p "$DAEMON_SOCKET_DIR"
 
-    # Create shared directory for file I/O (virtio-9p)
+    # Create shared directory for file I/O (9p)
     DAEMON_SHARE_DIR="$DAEMON_SOCKET_DIR/share"
     mkdir -p "$DAEMON_SHARE_DIR"
 
-    # Add virtio-9p for shared directory access
-    # Host writes to $DAEMON_SHARE_DIR, guest mounts as /mnt/share
-    # Use runtime-specific mount tag (vdkr_share or vpdmn_share)
+    # Add 9p for shared directory access
     SHARE_TAG="${TOOL_NAME}_share"
-    # Use security_model=none for simplest file sharing (no permission mapping)
-    # This allows writes from container (running as root) to propagate to host
-    QEMU_OPTS="$QEMU_OPTS -virtfs local,path=$DAEMON_SHARE_DIR,mount_tag=$SHARE_TAG,security_model=none,id=$SHARE_TAG"
-    # Tell init script to mount the share
+    HV_OPTS="$HV_OPTS $(hv_build_9p_opts "$DAEMON_SHARE_DIR" "$SHARE_TAG")"
     KERNEL_APPEND="$KERNEL_APPEND ${CMDLINE_PREFIX}_9p=1"
 
-    # Add virtio-serial device for command channel
-    # Using virtserialport creates /dev/vport0p1 in guest, host sees unix socket
-    # virtconsole would use hvc* but requires virtio_console kernel module
-    QEMU_OPTS="$QEMU_OPTS -chardev socket,id=vdkr,path=$DAEMON_SOCKET,server=on,wait=off"
-    QEMU_OPTS="$QEMU_OPTS -device virtio-serial-pci"
-    QEMU_OPTS="$QEMU_OPTS -device virtserialport,chardev=vdkr,name=vdkr"
-
-    # Add QMP socket for dynamic control (port forwarding, etc.)
-    QMP_SOCKET="$DAEMON_SOCKET_DIR/qmp.sock"
-    QEMU_OPTS="$QEMU_OPTS -qmp unix:$QMP_SOCKET,server,nowait"
+    # Add daemon command channel (backend-specific: virtio-serial or PV console)
+    hv_build_daemon_opts
+    HV_OPTS="$HV_OPTS $HV_DAEMON_OPTS"
 
     # Tell init script to run in daemon mode with idle timeout
     KERNEL_APPEND="$KERNEL_APPEND ${CMDLINE_PREFIX}_daemon=1"
@@ -1308,36 +1231,18 @@ if [ "$DAEMON_MODE" = "start" ]; then
     if [ "$NETWORK" != "true" ]; then
         log "INFO" "Enabling networking for daemon mode"
         NETWORK="true"
-        # Build netdev options with any port forwards
-        DAEMON_NETDEV="user,id=net0"
+        hv_build_network_opts
+        # Re-add network opts (they were built without port forwards initially)
+        # The rebuild includes port forwards since NETWORK is now true
+    fi
+    # Ensure port forwards are logged
+    if [ ${#PORT_FORWARDS[@]} -gt 0 ]; then
         for pf in "${PORT_FORWARDS[@]}"; do
-            # Parse host_port:container_port or host_port:container_port/protocol
             HOST_PORT="${pf%%:*}"
             CONTAINER_PART="${pf#*:}"
             CONTAINER_PORT="${CONTAINER_PART%%/*}"
-            if [[ "$CONTAINER_PART" == */* ]]; then
-                PROTOCOL="${CONTAINER_PART##*/}"
-            else
-                PROTOCOL="tcp"
-            fi
-            # Forward to HOST_PORT on VM; Docker -p handles container port mapping
-            DAEMON_NETDEV="$DAEMON_NETDEV,hostfwd=$PROTOCOL::$HOST_PORT-:$HOST_PORT"
-            log "INFO" "Port forward: host:$HOST_PORT -> VM:$HOST_PORT (Docker maps to container:$CONTAINER_PORT)"
+            log "INFO" "Port forward configured: $HOST_PORT -> $CONTAINER_PORT"
         done
-        QEMU_OPTS="$QEMU_OPTS -netdev $DAEMON_NETDEV -device virtio-net-pci,netdev=net0"
-    else
-        # NETWORK was already true, but check if we need to add port forwards
-        # that weren't included in the earlier networking setup
-        # (This happens when NETWORK was set to true before daemon mode was detected)
-        if [ ${#PORT_FORWARDS[@]} -gt 0 ]; then
-            # Port forwards should already be included from earlier networking setup
-            for pf in "${PORT_FORWARDS[@]}"; do
-                HOST_PORT="${pf%%:*}"
-                CONTAINER_PART="${pf#*:}"
-                CONTAINER_PORT="${CONTAINER_PART%%/*}"
-                log "INFO" "Port forward configured: $HOST_PORT -> $CONTAINER_PORT"
-            done
-        fi
     fi
 
     # Copy CA certificate to shared folder (too large for kernel cmdline)
@@ -1349,23 +1254,23 @@ if [ "$DAEMON_MODE" = "start" ]; then
     log "INFO" "Starting daemon..."
     log "DEBUG" "PID file: $DAEMON_PID_FILE"
     log "DEBUG" "Socket: $DAEMON_SOCKET"
-    log "DEBUG" "Command: $QEMU_CMD $QEMU_OPTS -append \"$KERNEL_APPEND\""
 
-    # Start QEMU in background
-    $QEMU_CMD $QEMU_OPTS -append "$KERNEL_APPEND" > "$DAEMON_QEMU_LOG" 2>&1 &
-    QEMU_PID=$!
-    echo "$QEMU_PID" > "$DAEMON_PID_FILE"
+    # Start VM in background via backend
+    hv_start_vm_background "$KERNEL_APPEND" "$DAEMON_QEMU_LOG" ""
+    echo "$HV_VM_PID" > "$DAEMON_PID_FILE"
 
-    log "INFO" "QEMU started (PID: $QEMU_PID)"
+    # Let backend save any extra state (e.g. Xen domain name)
+    if type hv_daemon_save_state >/dev/null 2>&1; then
+        hv_daemon_save_state
+    fi
 
-    # Wait for socket to appear (Docker starting)
-    # Docker can take 60+ seconds to start, so wait up to 120 seconds
+    log "INFO" "VM started (PID: $HV_VM_PID)"
+
+    # Wait for socket to appear (container runtime starting)
     log "INFO" "Waiting for daemon to be ready..."
     READY=false
     for i in $(seq 1 120); do
         if [ -S "$DAEMON_SOCKET" ]; then
-            # Socket exists, try to connect
-            # Keep stdin open for 3 seconds to allow response to arrive
             RESPONSE=$( { echo "===PING==="; sleep 3; } | timeout 10 socat - "UNIX-CONNECT:$DAEMON_SOCKET" 2>/dev/null || true)
             if echo "$RESPONSE" | grep -q "===PONG==="; then
                 log "DEBUG" "Got PONG response"
@@ -1376,64 +1281,54 @@ if [ "$DAEMON_MODE" = "start" ]; then
             fi
         fi
 
-        # Check if QEMU died
-        if ! kill -0 "$QEMU_PID" 2>/dev/null; then
-            log "ERROR" "QEMU process died during startup"
+        # Check if VM died
+        if ! hv_is_vm_running; then
+            log "ERROR" "VM process died during startup"
             cat "$DAEMON_QEMU_LOG" >&2
             rm -f "$DAEMON_PID_FILE"
             exit 1
         fi
 
-        log "DEBUG" "Waiting... ($i/60)"
+        log "DEBUG" "Waiting... ($i/120)"
         sleep 1
     done
 
     if [ "$READY" = "true" ]; then
         log "INFO" "Daemon is ready!"
 
+        # Set up port forwards via backend (e.g., iptables for Xen)
+        hv_setup_port_forwards
+
         # Start host-side idle watchdog if timeout is set
         if [ "$IDLE_TIMEOUT" -gt 0 ] 2>/dev/null; then
             ACTIVITY_FILE="$DAEMON_SOCKET_DIR/activity"
             touch "$ACTIVITY_FILE"
 
-            # Spawn background watchdog
             (
-                # Container status file - guest writes this via virtio-9p share
-                # This avoids sending commands through daemon socket which corrupts output
                 CONTAINER_STATUS_FILE="$DAEMON_SHARE_DIR/.containers_running"
-
-                # Scale check interval to idle timeout (check ~5 times before timeout)
                 CHECK_INTERVAL=$((IDLE_TIMEOUT / 5))
                 [ "$CHECK_INTERVAL" -lt 10 ] && CHECK_INTERVAL=10
                 [ "$CHECK_INTERVAL" -gt 60 ] && CHECK_INTERVAL=60
 
                 while true; do
                     sleep "$CHECK_INTERVAL"
-                    [ -f "$ACTIVITY_FILE" ] || exit 0  # Clean exit if file removed
-                    [ -f "$DAEMON_PID_FILE" ] || exit 0  # PID file gone
+                    [ -f "$ACTIVITY_FILE" ] || exit 0
+                    [ -f "$DAEMON_PID_FILE" ] || exit 0
 
-                    # Check if QEMU process is still running
-                    QEMU_PID=$(cat "$DAEMON_PID_FILE" 2>/dev/null)
-                    [ -n "$QEMU_PID" ] && kill -0 "$QEMU_PID" 2>/dev/null || exit 0
+                    # Check if VM is still running (backend-aware)
+                    hv_is_vm_running || exit 0
 
                     LAST_ACTIVITY=$(stat -c %Y "$ACTIVITY_FILE" 2>/dev/null || echo 0)
                     NOW=$(date +%s)
                     IDLE_SECONDS=$((NOW - LAST_ACTIVITY))
 
                     if [ "$IDLE_SECONDS" -ge "$IDLE_TIMEOUT" ]; then
-                        # Check if any containers are running via shared file
-                        # Guest-side watchdog writes container IDs to this file
                         if [ -f "$CONTAINER_STATUS_FILE" ] && [ -s "$CONTAINER_STATUS_FILE" ]; then
-                            # Containers are running - reset activity and skip shutdown
                             touch "$ACTIVITY_FILE"
                             continue
                         fi
-
-                        # No containers running - send QMP quit to gracefully stop QEMU
-                        if [ -S "$QMP_SOCKET" ]; then
-                            echo '{"execute":"qmp_capabilities"}{"execute":"quit"}' | \
-                                socat - "UNIX-CONNECT:$QMP_SOCKET" >/dev/null 2>&1 || true
-                        fi
+                        # Use backend-specific idle shutdown
+                        hv_idle_shutdown
                         rm -f "$ACTIVITY_FILE"
                         exit 0
                     fi
@@ -1442,119 +1337,103 @@ if [ "$DAEMON_MODE" = "start" ]; then
             log "DEBUG" "Started host-side idle watchdog (timeout: ${IDLE_TIMEOUT}s)"
         fi
 
-        echo "Daemon running (PID: $QEMU_PID)"
+        echo "Daemon running (PID: $HV_VM_PID)"
         echo "Socket: $DAEMON_SOCKET"
         exit 0
     else
         log "ERROR" "Daemon failed to become ready within 120 seconds"
         cat "$DAEMON_QEMU_LOG" >&2
-        kill "$QEMU_PID" 2>/dev/null || true
+        hv_destroy_vm
         rm -f "$DAEMON_PID_FILE" "$DAEMON_SOCKET"
         exit 1
     fi
 fi
 
-# For non-daemon mode with CA cert, we need virtio-9p to pass the cert
-# (kernel cmdline is too small for base64-encoded certs)
+# For non-daemon mode with CA cert, we need 9p to pass the cert
 if [ -n "$CA_CERT" ] && [ -f "$CA_CERT" ]; then
-    # Create temp share dir for CA cert
     CA_SHARE_DIR="$TEMP_DIR/ca_share"
     mkdir -p "$CA_SHARE_DIR"
     cp "$CA_CERT" "$CA_SHARE_DIR/ca.crt"
 
-    # Add virtio-9p mount for CA cert
     SHARE_TAG="${TOOL_NAME}_share"
-    QEMU_OPTS="$QEMU_OPTS -virtfs local,path=$CA_SHARE_DIR,mount_tag=$SHARE_TAG,security_model=none,readonly=on,id=cashare"
+    HV_OPTS="$HV_OPTS $(hv_build_9p_opts "$CA_SHARE_DIR" "$SHARE_TAG" "readonly=on")"
     KERNEL_APPEND="$KERNEL_APPEND ${CMDLINE_PREFIX}_9p=1"
-    log "DEBUG" "CA certificate available via virtio-9p"
+    log "DEBUG" "CA certificate available via 9p"
 fi
 
-log "INFO" "Starting QEMU..."
-log "DEBUG" "Command: $QEMU_CMD $QEMU_OPTS -append \"$KERNEL_APPEND\""
+log "INFO" "Starting VM ($VCONTAINER_HYPERVISOR)..."
 
-# Interactive mode runs QEMU in foreground with stdio connected
+# Interactive mode runs VM in foreground with stdio connected
 if [ "$INTERACTIVE" = "true" ]; then
-    # Check if stdin is a terminal
     if [ ! -t 0 ]; then
         log "WARN" "Interactive mode requested but stdin is not a terminal"
     fi
 
-    # Show a starting message
-    # The init script will clear this line when the container is ready
     if [ -t 1 ]; then
-        printf "\r\033[0;36m[vdkr]\033[0m Starting container... \r"
+        printf "\r\033[0;36m[${TOOL_NAME}]\033[0m Starting container... \r"
     fi
 
-    # Save terminal settings to restore later
     if [ -t 0 ]; then
         SAVED_STTY=$(stty -g)
-        # Put terminal in raw mode so Ctrl+C etc go to guest
         stty raw -echo
     fi
 
-    # Run QEMU with stdio (not in background)
-    # The -serial mon:stdio connects the serial console to our terminal
-    $QEMU_CMD $QEMU_OPTS -append "$KERNEL_APPEND"
-    QEMU_EXIT=$?
+    hv_start_vm_foreground "$KERNEL_APPEND"
+    VM_EXIT=$?
 
-    # Restore terminal settings
     if [ -t 0 ]; then
         stty "$SAVED_STTY"
     fi
 
     echo ""
-    log "INFO" "Interactive session ended (exit code: $QEMU_EXIT)"
-    exit $QEMU_EXIT
+    log "INFO" "Interactive session ended (exit code: $VM_EXIT)"
+    exit $VM_EXIT
 fi
 
-# Non-interactive mode: run QEMU in background and capture output
-QEMU_OUTPUT="$TEMP_DIR/qemu_output.txt"
-timeout $TIMEOUT $QEMU_CMD $QEMU_OPTS -append "$KERNEL_APPEND" > "$QEMU_OUTPUT" 2>&1 &
-QEMU_PID=$!
+# Non-interactive mode: run VM in background and capture output
+VM_OUTPUT="$TEMP_DIR/vm_output.txt"
+hv_start_vm_background "$KERNEL_APPEND" "$VM_OUTPUT" "$TIMEOUT"
 
 # Monitor for completion
 COMPLETE=false
 for i in $(seq 1 $TIMEOUT); do
-    if [ ! -d "/proc/$QEMU_PID" ]; then
-        log "DEBUG" "QEMU ended after $i seconds"
+    if ! hv_is_vm_running; then
+        log "DEBUG" "VM ended after $i seconds"
         break
     fi
 
     # Check for completion markers based on output type
     case "$OUTPUT_TYPE" in
         text)
-            if grep -q "===OUTPUT_END===" "$QEMU_OUTPUT" 2>/dev/null; then
+            if grep -q "===OUTPUT_END===" "$VM_OUTPUT" 2>/dev/null; then
                 COMPLETE=true
                 break
             fi
             ;;
         tar)
-            if grep -q "===TAR_END===" "$QEMU_OUTPUT" 2>/dev/null; then
+            if grep -q "===TAR_END===" "$VM_OUTPUT" 2>/dev/null; then
                 COMPLETE=true
                 break
             fi
             ;;
         storage)
-            # Check for both console (STORAGE_END) and virtio-9p (9P_STORAGE_DONE) markers
-            if grep -qE "===STORAGE_END===|===9P_STORAGE_DONE===" "$QEMU_OUTPUT" 2>/dev/null; then
+            if grep -qE "===STORAGE_END===|===9P_STORAGE_DONE===" "$VM_OUTPUT" 2>/dev/null; then
                 COMPLETE=true
                 break
             fi
             ;;
     esac
 
-    # Check for error
-    if grep -q "===ERROR===" "$QEMU_OUTPUT" 2>/dev/null; then
-        log "ERROR" "Error in QEMU:"
-        grep -A10 "===ERROR===" "$QEMU_OUTPUT"
+    if grep -q "===ERROR===" "$VM_OUTPUT" 2>/dev/null; then
+        log "ERROR" "Error in VM:"
+        grep -A10 "===ERROR===" "$VM_OUTPUT"
         break
     fi
 
-    # Progress indicator
     if [ $((i % 30)) -eq 0 ]; then
-        if grep -q "Docker daemon is ready" "$QEMU_OUTPUT" 2>/dev/null; then
+        if grep -q "Docker daemon is ready" "$VM_OUTPUT" 2>/dev/null; then
             log "INFO" "Docker is running, executing command..."
-        elif grep -q "Starting Docker" "$QEMU_OUTPUT" 2>/dev/null; then
+        elif grep -q "Starting Docker" "$VM_OUTPUT" 2>/dev/null; then
             log "INFO" "Docker is starting..."
         fi
     fi
@@ -1562,38 +1441,28 @@ for i in $(seq 1 $TIMEOUT); do
     sleep 1
 done
 
-# Wait for QEMU to exit gracefully (poweroff from inside flushes disks properly)
-# Only kill if it hangs after seeing completion marker
-if [ "$COMPLETE" = "true" ] && [ -d "/proc/$QEMU_PID" ]; then
-    log "DEBUG" "Waiting for QEMU to complete graceful shutdown..."
-    # Give QEMU up to 30 seconds to poweroff after command completes
-    for wait_i in $(seq 1 30); do
-        if [ ! -d "/proc/$QEMU_PID" ]; then
-            log "DEBUG" "QEMU shutdown complete"
-            break
-        fi
-        sleep 1
-    done
+# Wait for VM to exit gracefully (poweroff from inside flushes disks properly)
+if [ "$COMPLETE" = "true" ] && hv_is_vm_running; then
+    log "DEBUG" "Waiting for VM to complete graceful shutdown..."
+    hv_wait_vm_exit 30 && log "DEBUG" "VM shutdown complete"
 fi
 
-# Force kill QEMU only if still running after grace period
-if [ -d "/proc/$QEMU_PID" ]; then
-    log "WARN" "QEMU still running, forcing termination..."
-    kill $QEMU_PID 2>/dev/null || true
-    wait $QEMU_PID 2>/dev/null || true
+# Force kill VM only if still running after grace period
+if hv_is_vm_running; then
+    hv_stop_vm
 fi
 
 # Extract results
 if [ "$COMPLETE" = "true" ]; then
     # Get exit code
-    EXIT_CODE=$(grep -oP '===EXIT_CODE=\K[0-9]+' "$QEMU_OUTPUT" | head -1)
+    EXIT_CODE=$(grep -oP '===EXIT_CODE=\K[0-9]+' "$VM_OUTPUT" | head -1)
     EXIT_CODE="${EXIT_CODE:-0}"
 
     case "$OUTPUT_TYPE" in
         text)
             log "INFO" "=== Command Output ==="
             # Use awk for precise extraction between markers
-            awk '/===OUTPUT_START===/{capture=1; next} /===OUTPUT_END===/{capture=0} capture' "$QEMU_OUTPUT"
+            awk '/===OUTPUT_START===/{capture=1; next} /===OUTPUT_END===/{capture=0} capture' "$VM_OUTPUT"
             log "INFO" "=== Exit Code: $EXIT_CODE ==="
             ;;
 
@@ -1601,7 +1470,7 @@ if [ "$COMPLETE" = "true" ]; then
             log "INFO" "Extracting tar output..."
             # Use awk for precise extraction between markers
             # Strip ANSI escape codes and non-base64 characters from serial console output
-            awk '/===TAR_START===/{capture=1; next} /===TAR_END===/{capture=0} capture' "$QEMU_OUTPUT" | \
+            awk '/===TAR_START===/{capture=1; next} /===TAR_END===/{capture=0} capture' "$VM_OUTPUT" | \
                 tr -d '\r' | sed 's/\x1b\[[0-9;]*m//g' | tr -cd 'A-Za-z0-9+/=\n' | base64 -d > "$OUTPUT_FILE" 2>"${TEMP_DIR}/b64_errors.txt"
 
             if [ -s "${TEMP_DIR}/b64_errors.txt" ]; then
@@ -1634,7 +1503,7 @@ if [ "$COMPLETE" = "true" ]; then
                 # 3. sed: remove ANSI escape codes
                 # 4. grep -v: remove kernel log messages (lines starting with [ followed by timestamp)
                 # 5. tr -cd: keep only valid base64 characters
-                awk '/===STORAGE_START===/{capture=1; next} /===STORAGE_END===/{capture=0} capture' "$QEMU_OUTPUT" | \
+                awk '/===STORAGE_START===/{capture=1; next} /===STORAGE_END===/{capture=0} capture' "$VM_OUTPUT" | \
                     tr -d '\r' | \
                     sed 's/\x1b\[[0-9;]*m//g' | \
                     grep -v '^\[[[:space:]]*[0-9]' | \
@@ -1675,11 +1544,11 @@ if [ "$COMPLETE" = "true" ]; then
     exit "${EXIT_CODE:-0}"
 else
     log "ERROR" "Command execution failed or timed out"
-    log "ERROR" "QEMU output saved to: $QEMU_OUTPUT"
+    log "ERROR" "QEMU output saved to: $VM_OUTPUT"
 
     if [ "$VERBOSE" = "true" ]; then
         log "DEBUG" "=== Last 50 lines of QEMU output ==="
-        tail -50 "$QEMU_OUTPUT"
+        tail -50 "$VM_OUTPUT"
     fi
 
     exit 1
diff --git a/recipes-containers/vcontainer/files/vxn-init.sh b/recipes-containers/vcontainer/files/vxn-init.sh
new file mode 100755
index 00000000..93e631e1
--- /dev/null
+++ b/recipes-containers/vcontainer/files/vxn-init.sh
@@ -0,0 +1,545 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: Copyright (C) 2025 Bruce Ashfield
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# vxn-init.sh
+# Init script for vxn: execute container entrypoint directly in Xen DomU
+#
+# This script runs on a real filesystem after switch_root from initramfs.
+# Unlike vdkr-init.sh which starts Docker, this script directly mounts
+# the container's rootfs and executes the entrypoint via chroot.
+#
+# The VM IS the container — no container runtime runs inside the guest.
+#
+# Drive layout:
+#   /dev/xvda = rootfs.img (this script runs from here, mounted as /)
+#   /dev/xvdb = container rootfs (OCI image, passed from host)
+#
+# Kernel parameters (reuses docker_ prefix for frontend compatibility):
+#   docker_cmd=<base64>    Base64-encoded entrypoint command
+#   docker_input=<type>    Input type: none, oci, rootfs (default: none)
+#   docker_output=<type>   Output type: text (default: text)
+#   docker_network=1       Enable networking
+#   docker_interactive=1   Interactive mode (suppress boot messages)
+#   docker_daemon=1        Daemon mode (command loop on hvc1)
+#
+# Version: 1.0.0
+
+# Set runtime-specific parameters before sourcing common code
+VCONTAINER_RUNTIME_NAME="vxn"
+VCONTAINER_RUNTIME_CMD="chroot"
+VCONTAINER_RUNTIME_PREFIX="docker"
+VCONTAINER_STATE_DIR="/var/lib/vxn"
+VCONTAINER_SHARE_NAME="vxn_share"
+VCONTAINER_VERSION="1.0.0"
+
+# Source common init functions
+. /vcontainer-init-common.sh
+
+# ============================================================================
+# Container Rootfs Handling
+# ============================================================================
+
+# Find the container rootfs directory from the input disk.
+# Sets CONTAINER_ROOT to the path of the extracted rootfs.
+find_container_rootfs() {
+    CONTAINER_ROOT=""
+
+    if [ ! -d /mnt/input ] || [ -z "$(ls -A /mnt/input 2>/dev/null)" ]; then
+        log "WARNING: No container rootfs found on input disk"
+        return 1
+    fi
+
+    # Check if the input disk IS the rootfs (has typical Linux dirs)
+    if [ -d /mnt/input/bin ] || [ -d /mnt/input/usr ]; then
+        CONTAINER_ROOT="/mnt/input"
+        log "Container rootfs: direct mount (/mnt/input)"
+        return 0
+    fi
+
+    # Check for OCI layout (index.json + blobs/)
+    if [ -f /mnt/input/index.json ] || [ -f /mnt/input/oci-layout ]; then
+        log "Found OCI layout on input disk, extracting layers..."
+        extract_oci_rootfs /mnt/input /mnt/container
+        CONTAINER_ROOT="/mnt/container"
+        return 0
+    fi
+
+    # Check for rootfs/ subdirectory
+    if [ -d /mnt/input/rootfs ]; then
+        CONTAINER_ROOT="/mnt/input/rootfs"
+        log "Container rootfs: /mnt/input/rootfs"
+        return 0
+    fi
+
+    log "WARNING: Could not determine rootfs layout in /mnt/input"
+    [ "$QUIET_BOOT" = "0" ] && ls -la /mnt/input/
+    return 1
+}
+
+# Extract OCI image layers into a flat rootfs.
+# Usage: extract_oci_rootfs <oci_dir> <target_dir>
+extract_oci_rootfs() {
+    local oci_dir="$1"
+    local target_dir="$2"
+
+    mkdir -p "$target_dir"
+
+    if [ ! -f "$oci_dir/index.json" ]; then
+        log "ERROR: No index.json in OCI layout"
+        return 1
+    fi
+
+    if command -v jq >/dev/null 2>&1; then
+        local manifest_digest=$(jq -r '.manifests[0].digest' "$oci_dir/index.json")
+        local manifest_file="$oci_dir/blobs/${manifest_digest/://}"
+
+        if [ -f "$manifest_file" ]; then
+            # Extract layer digests from manifest (in order, bottom to top)
+            local layers=$(jq -r '.layers[].digest' "$manifest_file")
+            for layer_digest in $layers; do
+                local layer_file="$oci_dir/blobs/${layer_digest/://}"
+                if [ -f "$layer_file" ]; then
+                    log "Extracting layer: ${layer_digest#sha256:}"
+                    tar -xf "$layer_file" -C "$target_dir" 2>/dev/null || true
+                fi
+            done
+        fi
+    else
+        # Fallback: find and extract all blobs that look like tarballs
+        log "No jq available, extracting all blob layers..."
+        for blob in "$oci_dir"/blobs/sha256/*; do
+            if [ -f "$blob" ]; then
+                tar -xf "$blob" -C "$target_dir" 2>/dev/null || true
+            fi
+        done
+    fi
+
+    if [ -d "$target_dir/bin" ] || [ -d "$target_dir/usr" ] || [ -f "$target_dir/hello" ]; then
+        log "OCI rootfs extracted to $target_dir"
+        return 0
+    else
+        log "WARNING: Extracted OCI rootfs may be incomplete"
+        [ "$QUIET_BOOT" = "0" ] && ls -la "$target_dir/"
+        return 0
+    fi
+}
+
+# Parse OCI config for environment, entrypoint, cmd, workdir.
+# Sets: OCI_ENTRYPOINT, OCI_CMD, OCI_ENV, OCI_WORKDIR
+parse_oci_config() {
+    OCI_ENTRYPOINT=""
+    OCI_CMD=""
+    OCI_ENV=""
+    OCI_WORKDIR=""
+
+    local config_file=""
+
+    # Look for config in OCI layout on input disk
+    if [ -f /mnt/input/index.json ]; then
+        config_file=$(oci_find_config_blob /mnt/input)
+    fi
+
+    # Check for standalone config.json
+    [ -z "$config_file" ] && [ -f /mnt/input/config.json ] && config_file="/mnt/input/config.json"
+
+    if [ -z "$config_file" ] || [ ! -f "$config_file" ]; then
+        log "No OCI config found (using command from kernel cmdline)"
+        return
+    fi
+
+    log "Parsing OCI config: $config_file"
+
+    if command -v jq >/dev/null 2>&1; then
+        OCI_ENTRYPOINT=$(jq -r '(.config.Entrypoint // []) | join(" ")' "$config_file" 2>/dev/null)
+        OCI_CMD=$(jq -r '(.config.Cmd // []) | join(" ")' "$config_file" 2>/dev/null)
+        OCI_WORKDIR=$(jq -r '.config.WorkingDir // ""' "$config_file" 2>/dev/null)
+        OCI_ENV=$(jq -r '(.config.Env // []) | .[]' "$config_file" 2>/dev/null)
+    else
+        # Fallback: parse OCI config JSON with grep/sed (no jq in minimal rootfs)
+        log "Using grep/sed fallback for OCI config parsing"
+        OCI_ENTRYPOINT=$(oci_grep_json_array "Entrypoint" "$config_file")
+        OCI_CMD=$(oci_grep_json_array "Cmd" "$config_file")
+        OCI_WORKDIR=$(grep -o '"WorkingDir":"[^"]*"' "$config_file" 2>/dev/null | sed 's/"WorkingDir":"//;s/"$//')
+        OCI_ENV=$(grep -o '"Env":\[[^]]*\]' "$config_file" 2>/dev/null | \
+            sed 's/"Env":\[//;s/\]$//' | tr ',' '\n' | sed 's/^ *"//;s/"$//')
+    fi
+
+    log "OCI config: entrypoint='$OCI_ENTRYPOINT' cmd='$OCI_CMD' workdir='$OCI_WORKDIR'"
+}
+
+# Follow OCI index.json → manifest → config blob using grep/sed.
+# Works with or without jq.
+oci_find_config_blob() {
+    local oci_dir="$1"
+    local digest=""
+    local blob_file=""
+
+    if command -v jq >/dev/null 2>&1; then
+        digest=$(jq -r '.manifests[0].digest' "$oci_dir/index.json" 2>/dev/null)
+        blob_file="$oci_dir/blobs/${digest/://}"
+        [ -f "$blob_file" ] && digest=$(jq -r '.config.digest' "$blob_file" 2>/dev/null)
+        blob_file="$oci_dir/blobs/${digest/://}"
+    else
+        # grep fallback: extract first digest from index.json
+        digest=$(grep -o '"digest":"sha256:[a-f0-9]*"' "$oci_dir/index.json" 2>/dev/null | \
+            head -n 1 | sed 's/"digest":"//;s/"$//')
+        blob_file="$oci_dir/blobs/${digest/://}"
+        if [ -f "$blob_file" ]; then
+            # Extract config digest from manifest (mediaType contains "config")
+            digest=$(grep -o '"config":{[^}]*}' "$blob_file" 2>/dev/null | \
+                grep -o '"digest":"sha256:[a-f0-9]*"' | sed 's/"digest":"//;s/"$//')
+            blob_file="$oci_dir/blobs/${digest/://}"
+        fi
+    fi
+
+    [ -f "$blob_file" ] && echo "$blob_file"
+}
+
+# Extract a JSON array value as a space-separated string using grep/sed.
+# Usage: oci_grep_json_array "Entrypoint" config_file
+# Handles: "Entrypoint":["/hello"], "Cmd":["/bin/sh","-c","echo hi"]
+oci_grep_json_array() {
+    local key="$1"
+    local file="$2"
+    grep -o "\"$key\":\\[[^]]*\\]" "$file" 2>/dev/null | \
+        sed "s/\"$key\":\\[//;s/\\]$//" | \
+        tr ',' '\n' | sed 's/^ *"//;s/"$//' | tr '\n' ' ' | sed 's/ $//'
+}
+
+# ============================================================================
+# Command Resolution
+# ============================================================================
+
+# Parse a "docker run" command to extract the container command (after image name).
+# "docker run --rm hello-world" → "" (no cmd, use OCI defaults)
+# "docker run --rm hello-world /bin/sh" → "/bin/sh"
+parse_docker_run_cmd() {
+    local full_cmd="$1"
+    local found_image=false
+    local container_cmd=""
+    local skip_next=false
+
+    # Strip "docker run" or "podman run" prefix
+    local args=$(echo "$full_cmd" | sed 's/^[a-z]* run //')
+
+    for arg in $args; do
+        if [ "$found_image" = "true" ]; then
+            container_cmd="$container_cmd $arg"
+            continue
+        fi
+
+        if [ "$skip_next" = "true" ]; then
+            skip_next=false
+            continue
+        fi
+
+        case "$arg" in
+            --rm|--detach|-d|-i|--interactive|-t|--tty|--privileged)
+                ;;
+            -p|--publish|-v|--volume|-e|--env|--name|--network|-w|--workdir|--entrypoint|-m|--memory|--cpus)
+                skip_next=true
+                ;;
+            -p=*|--publish=*|-v=*|--volume=*|-e=*|--env=*|--name=*|--network=*|-w=*|--workdir=*|--entrypoint=*)
+                ;;
+            -*)
+                ;;
+            *)
+                # First non-option argument is the image name — skip it
+                found_image=true
+                ;;
+        esac
+    done
+
+    echo "$container_cmd" | sed 's/^ *//'
+}
+
+# Determine the command to execute inside the container.
+# Priority: 1) explicit command from docker run args, 2) RUNTIME_CMD as raw command,
+#           3) OCI entrypoint + cmd, 4) /bin/sh fallback
+determine_exec_command() {
+    local cmd=""
+
+    if [ -n "$RUNTIME_CMD" ]; then
+        # Check if this is a "docker run" wrapper command
+        if echo "$RUNTIME_CMD" | grep -qE '^(docker|podman) run '; then
+            cmd=$(parse_docker_run_cmd "$RUNTIME_CMD")
+            # If no command after image name, fall through to OCI config
+        else
+            # Raw command — use as-is
+            cmd="$RUNTIME_CMD"
+        fi
+    fi
+
+    # If no explicit command, use OCI config
+    if [ -z "$cmd" ]; then
+        if [ -n "$OCI_ENTRYPOINT" ]; then
+            cmd="$OCI_ENTRYPOINT"
+            [ -n "$OCI_CMD" ] && cmd="$cmd $OCI_CMD"
+        elif [ -n "$OCI_CMD" ]; then
+            cmd="$OCI_CMD"
+        fi
+    fi
+
+    # Final fallback
+    if [ -z "$cmd" ]; then
+        cmd="/bin/sh"
+        log "No command specified, defaulting to /bin/sh"
+    fi
+
+    echo "$cmd"
+}
+
+# ============================================================================
+# Container Execution
+# ============================================================================
+
+# Set up environment variables for the container
+setup_container_env() {
+    # Apply OCI environment variables
+    if [ -n "$OCI_ENV" ]; then
+        echo "$OCI_ENV" | while IFS= read -r env_line; do
+            [ -n "$env_line" ] && export "$env_line" 2>/dev/null || true
+        done
+    fi
+
+    # Ensure basic environment
+    export PATH="${PATH:-/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}"
+    export HOME="${HOME:-/root}"
+    export TERM="${TERM:-linux}"
+}
+
+# Execute a command inside the container rootfs via chroot.
+# Mounts /proc, /sys, /dev inside the container and copies DNS config.
+exec_in_container() {
+    local rootfs="$1"
+    local cmd="$2"
+    local workdir="${OCI_WORKDIR:-/}"
+
+    # Mount essential filesystems inside the container rootfs
+    mkdir -p "$rootfs/proc" "$rootfs/sys" "$rootfs/dev" "$rootfs/tmp" 2>/dev/null || true
+    mount -t proc proc "$rootfs/proc" 2>/dev/null || true
+    mount -t sysfs sysfs "$rootfs/sys" 2>/dev/null || true
+    mount --bind /dev "$rootfs/dev" 2>/dev/null || true
+
+    # Copy resolv.conf for DNS
+    if [ -f /etc/resolv.conf ]; then
+        mkdir -p "$rootfs/etc" 2>/dev/null || true
+        cp /etc/resolv.conf "$rootfs/etc/resolv.conf" 2>/dev/null || true
+    fi
+
+    log "Executing in container: $cmd"
+    log "Working directory: $workdir"
+
+    # Determine how to exec: use /bin/sh if available, otherwise direct exec
+    local use_sh=true
+    if [ ! -x "$rootfs/bin/sh" ]; then
+        use_sh=false
+        log "No /bin/sh in container, using direct exec"
+    fi
+
+    if [ "$RUNTIME_INTERACTIVE" = "1" ]; then
+        # Interactive mode: connect stdin/stdout directly
+        export TERM=linux
+        printf '\r\033[K'
+        if [ "$use_sh" = "true" ]; then
+            chroot "$rootfs" /bin/sh -c "cd '$workdir' 2>/dev/null; exec $cmd"
+        else
+            chroot "$rootfs" $cmd
+        fi
+        EXEC_EXIT_CODE=$?
+    else
+        # Non-interactive: capture output
+        EXEC_OUTPUT="/tmp/container_output.txt"
+        EXEC_EXIT_CODE=0
+        if [ "$use_sh" = "true" ]; then
+            chroot "$rootfs" /bin/sh -c "cd '$workdir' 2>/dev/null; exec $cmd" \
+                > "$EXEC_OUTPUT" 2>&1 || EXEC_EXIT_CODE=$?
+        else
+            chroot "$rootfs" $cmd \
+                > "$EXEC_OUTPUT" 2>&1 || EXEC_EXIT_CODE=$?
+        fi
+
+        log "Exit code: $EXEC_EXIT_CODE"
+
+        echo "===OUTPUT_START==="
+        cat "$EXEC_OUTPUT"
+        echo "===OUTPUT_END==="
+        echo "===EXIT_CODE=$EXEC_EXIT_CODE==="
+    fi
+
+    # Cleanup mounts inside container
+    umount "$rootfs/proc" 2>/dev/null || true
+    umount "$rootfs/sys" 2>/dev/null || true
+    umount "$rootfs/dev" 2>/dev/null || true
+}
+
+# ============================================================================
+# Daemon Mode (vxn-specific)
+# ============================================================================
+
+# In daemon mode, commands come via the hvc1 console channel
+# and are executed in the container rootfs via chroot.
+run_vxn_daemon_mode() {
+    log "=== vxn Daemon Mode ==="
+    log "Container rootfs: ${CONTAINER_ROOT:-(none)}"
+    log "Idle timeout: ${RUNTIME_IDLE_TIMEOUT}s"
+
+    # Find the command channel (prefer hvc1 for Xen)
+    DAEMON_PORT=""
+    for port in /dev/hvc1 /dev/vport0p1 /dev/vport1p1 /dev/virtio-ports/vxn; do
+        if [ -c "$port" ]; then
+            DAEMON_PORT="$port"
+            log "Found command channel: $port"
+            break
+        fi
+    done
+
+    if [ -z "$DAEMON_PORT" ]; then
+        log "ERROR: No command channel for daemon mode"
+        ls -la /dev/hvc* /dev/vport* /dev/virtio-ports/ 2>/dev/null || true
+        sleep 5
+        reboot -f
+    fi
+
+    # Open bidirectional FD
+    exec 3<>"$DAEMON_PORT"
+
+    log "Daemon ready, waiting for commands..."
+
+    ACTIVITY_FILE="/tmp/.daemon_activity"
+    touch "$ACTIVITY_FILE"
+    DAEMON_PID=$$
+
+    trap 'log "Shutdown signal"; sync; reboot -f' TERM
+    trap 'rm -f "$ACTIVITY_FILE"; exit' INT
+
+    # Command loop
+    while true; do
+        CMD_B64=""
+        read -r CMD_B64 <&3
+        READ_EXIT=$?
+
+        if [ $READ_EXIT -eq 0 ] && [ -n "$CMD_B64" ]; then
+            touch "$ACTIVITY_FILE"
+
+            case "$CMD_B64" in
+                "===PING===")
+                    echo "===PONG===" | cat >&3
+                    continue
+                    ;;
+                "===SHUTDOWN===")
+                    log "Received shutdown command"
+                    echo "===SHUTTING_DOWN===" | cat >&3
+                    break
+                    ;;
+            esac
+
+            # Decode command
+            CMD=$(echo "$CMD_B64" | base64 -d 2>/dev/null)
+            if [ -z "$CMD" ]; then
+                printf "===ERROR===\nFailed to decode command\n===END===\n" | cat >&3
+                continue
+            fi
+
+            log "Executing: $CMD"
+
+            # Execute command in container rootfs (or host rootfs if no container)
+            EXEC_OUTPUT="/tmp/daemon_output.txt"
+            EXEC_EXIT_CODE=0
+            if [ -n "$CONTAINER_ROOT" ]; then
+                chroot "$CONTAINER_ROOT" /bin/sh -c "$CMD" \
+                    > "$EXEC_OUTPUT" 2>&1 || EXEC_EXIT_CODE=$?
+            else
+                eval "$CMD" > "$EXEC_OUTPUT" 2>&1 || EXEC_EXIT_CODE=$?
+            fi
+
+            {
+                echo "===OUTPUT_START==="
+                cat "$EXEC_OUTPUT"
+                echo "===OUTPUT_END==="
+                echo "===EXIT_CODE=$EXEC_EXIT_CODE==="
+                echo "===END==="
+            } | cat >&3
+
+            log "Command completed (exit code: $EXEC_EXIT_CODE)"
+        else
+            sleep 0.1
+        fi
+    done
+
+    exec 3>&-
+    log "Daemon shutting down..."
+}
+
+# ============================================================================
+# Main
+# ============================================================================
+
+# Initialize base environment
+setup_base_environment
+mount_base_filesystems
+
+# Check for quiet boot mode
+check_quiet_boot
+
+log "=== vxn Init ==="
+log "Version: $VCONTAINER_VERSION"
+
+# Mount tmpfs directories and cgroups
+mount_tmpfs_dirs
+setup_cgroups
+
+# Parse kernel command line
+parse_cmdline
+
+# Detect and configure disks
+detect_disks
+
+# Mount input disk (container rootfs from host)
+mount_input_disk
+
+# Configure networking
+configure_networking
+
+# Find the container rootfs on the input disk
+if ! find_container_rootfs; then
+    if [ "$RUNTIME_DAEMON" = "1" ]; then
+        log "No container rootfs, daemon mode will execute on host rootfs"
+        CONTAINER_ROOT=""
+    else
+        echo "===ERROR==="
+        echo "No container rootfs found on input disk"
+        echo "Contents of /mnt/input:"
+        ls -la /mnt/input/ 2>/dev/null || echo "(empty)"
+        sleep 2
+        reboot -f
+    fi
+fi
+
+# Parse OCI config for entrypoint/env/workdir
+parse_oci_config
+
+# Set up container environment
+setup_container_env
+
+if [ "$RUNTIME_DAEMON" = "1" ]; then
+    run_vxn_daemon_mode
+else
+    # Determine command to execute
+    EXEC_CMD=$(determine_exec_command)
+
+    if [ -z "$EXEC_CMD" ]; then
+        echo "===ERROR==="
+        echo "No command to execute"
+        sleep 2
+        reboot -f
+    fi
+
+    # Execute in container rootfs
+    exec_in_container "$CONTAINER_ROOT" "$EXEC_CMD"
+fi
+
+# Graceful shutdown
+graceful_shutdown
diff --git a/recipes-containers/vcontainer/files/vxn.sh b/recipes-containers/vcontainer/files/vxn.sh
new file mode 100644
index 00000000..43693438
--- /dev/null
+++ b/recipes-containers/vcontainer/files/vxn.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+# SPDX-FileCopyrightText: Copyright (C) 2025 Bruce Ashfield
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# vxn: Docker CLI for Xen-based container execution
+#
+# This provides a familiar docker-like CLI that executes commands inside
+# a Xen DomU guest with the target architecture's Docker.
+#
+# This is the Xen equivalent of vdkr (QEMU). It uses the same rootfs
+# images and init scripts, but boots as a Xen PV guest instead of QEMU.
+#
+# Requires: Xen Dom0 with xl toolstack
+
+# Set runtime-specific parameters before sourcing common code
+VCONTAINER_RUNTIME_NAME="vxn"
+VCONTAINER_RUNTIME_CMD="docker"
+VCONTAINER_RUNTIME_PREFIX="VXN"
+VCONTAINER_IMPORT_TARGET="docker-daemon:"
+VCONTAINER_STATE_FILE="docker-state.img"
+VCONTAINER_OTHER_PREFIX="VDKR"
+VCONTAINER_VERSION="1.0.0"
+
+# Select Xen hypervisor backend
+export VCONTAINER_HYPERVISOR="xen"
+
+# Set blob directory for target install (/usr/share/vxn has kernel, initramfs, rootfs)
+# Use VXN_BLOB_DIR which _get_env_var() in vcontainer-common.sh will find
+# via ${VCONTAINER_RUNTIME_PREFIX}_BLOB_DIR
+if [ -z "${VXN_BLOB_DIR:-}" ]; then
+    if [ -d "/usr/share/vxn" ]; then
+        export VXN_BLOB_DIR="/usr/share/vxn"
+    fi
+fi
+
+# Export runtime name so vrunner.sh (separate process) sees it
+export VCONTAINER_RUNTIME_NAME
+
+# Locate shared scripts - check script directory first, then /usr/lib/vxn
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+if [ -f "${SCRIPT_DIR}/vcontainer-common.sh" ]; then
+    export VCONTAINER_LIBDIR="${SCRIPT_DIR}"
+    source "${SCRIPT_DIR}/vcontainer-common.sh" "$@"
+elif [ -f "/usr/lib/vxn/vcontainer-common.sh" ]; then
+    export VCONTAINER_LIBDIR="/usr/lib/vxn"
+    source "/usr/lib/vxn/vcontainer-common.sh" "$@"
+else
+    echo "Error: vcontainer-common.sh not found" >&2
+    exit 1
+fi
diff --git a/recipes-core/vxn/vxn-initramfs-create.inc b/recipes-core/vxn/vxn-initramfs-create.inc
new file mode 100644
index 00000000..bde8bba9
--- /dev/null
+++ b/recipes-core/vxn/vxn-initramfs-create.inc
@@ -0,0 +1,223 @@
+# SPDX-FileCopyrightText: Copyright (C) 2025 Bruce Ashfield
+#
+# SPDX-License-Identifier: MIT
+#
+# vxn-initramfs-create.inc
+# ===========================================================================
+# Shared code for building Xen DomU boot blobs for vxn
+# ===========================================================================
+#
+# This .inc file packages boot blobs for vxn (vcontainer on Xen).
+# It reuses the same initramfs and rootfs images built by vruntime
+# multiconfig (same images as vdkr/vpdmn), since the init scripts
+# detect the hypervisor at boot time.
+#
+# The kernel from vruntime already includes Xen PV support via vxn.cfg
+# fragment (added to DISTRO_FEATURES in vruntime.conf).
+#
+# Required variables from including recipe:
+#   VXN_RUNTIME - runtime to source blobs from ("vdkr" or "vpdmn")
+#
+# Boot flow on Xen Dom0:
+#   xl create <domain.cfg>
+#   -> Xen boots kernel + tiny initramfs in DomU
+#   -> preinit mounts rootfs.img from /dev/xvda
+#   -> switch_root into rootfs.img
+#   -> init detects Xen, uses /dev/xvd* and trans=xen
+#
+# ===========================================================================
+
+HOMEPAGE = "https://git.yoctoproject.org/meta-virtualization/"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+inherit deploy
+
+EXCLUDE_FROM_WORLD = "1"
+DEPENDS = "squashfs-tools-native"
+
+# Default to vdkr (Docker) as the source runtime
+VXN_RUNTIME ?= "vdkr"
+
+# Always rebuild - init script injection must not be sstate-cached
+# because the rootfs.img content comes from the deploy dir (untracked)
+SSTATE_SKIP_CREATION = "1"
+do_compile[nostamp] = "1"
+do_deploy[nostamp] = "1"
+
+python () {
+
+    mc = d.getVar('VXN_MULTICONFIG')
+    runtime = d.getVar('VXN_RUNTIME')
+    bbmulticonfig = (d.getVar('BBMULTICONFIG') or "").split()
+    if mc in bbmulticonfig:
+        # All blobs come from the vruntime multiconfig - kernel, initramfs, rootfs
+        mcdeps = ' '.join([
+            'mc::%s:%s-tiny-initramfs-image:do_image_complete' % (mc, runtime),
+            'mc::%s:%s-rootfs-image:do_image_complete' % (mc, runtime),
+            'mc::%s:virtual/kernel:do_deploy' % mc,
+        ])
+        d.setVarFlag('do_compile', 'mcdepends', mcdeps)
+}
+
+INHIBIT_DEFAULT_DEPS = "1"
+
+# Init scripts to inject into the rootfs squashfs
+FILESEXTRAPATHS:prepend := "${THISDIR}/../../recipes-containers/vcontainer/files:"
+SRC_URI = "\
+    file://vxn-init.sh \
+    file://vcontainer-init-common.sh \
+"
+
+S = "${UNPACKDIR}"
+B = "${WORKDIR}/build"
+
+def vxn_get_kernel_image_name(d):
+    arch = d.getVar('TARGET_ARCH')
+    if arch == 'aarch64':
+        return 'Image'
+    elif arch in ['x86_64', 'i686', 'i586']:
+        return 'bzImage'
+    elif arch == 'arm':
+        return 'zImage'
+    return 'Image'
+
+def vxn_get_multiconfig_name(d):
+    arch = d.getVar('TARGET_ARCH')
+    if arch == 'aarch64':
+        return 'vruntime-aarch64'
+    elif arch in ['x86_64', 'i686', 'i586']:
+        return 'vruntime-x86-64'
+    return 'vruntime-aarch64'
+
+def vxn_get_blob_arch(d):
+    arch = d.getVar('TARGET_ARCH')
+    if arch == 'aarch64':
+        return 'aarch64'
+    elif arch in ['x86_64', 'i686', 'i586']:
+        return 'x86_64'
+    return 'aarch64'
+
+KERNEL_IMAGETYPE_INITRAMFS = "${@vxn_get_kernel_image_name(d)}"
+VXN_MULTICONFIG = "${@vxn_get_multiconfig_name(d)}"
+BLOB_ARCH = "${@vxn_get_blob_arch(d)}"
+
+VXN_MC_DEPLOY = "${TOPDIR}/tmp-${VXN_MULTICONFIG}/deploy/images/${MACHINE}"
+
+do_compile() {
+    mkdir -p ${B}
+
+    MC_TMPDIR="${TOPDIR}/tmp-${VXN_MULTICONFIG}"
+    MC_DEPLOY="${MC_TMPDIR}/deploy/images/${MACHINE}"
+
+    # =========================================================================
+    # PART 1: COPY TINY INITRAMFS (same as vdkr/vpdmn)
+    # =========================================================================
+    bbnote "Copying tiny initramfs from image build..."
+
+    INITRAMFS_SRC="${MC_DEPLOY}/${VXN_RUNTIME}-tiny-initramfs-image-${MACHINE}.cpio.gz"
+
+    if [ ! -f "${INITRAMFS_SRC}" ]; then
+        bbfatal "Initramfs not found at ${INITRAMFS_SRC}. Build it first with: bitbake mc:${VXN_MULTICONFIG}:${VXN_RUNTIME}-tiny-initramfs-image"
+    fi
+
+    cp "${INITRAMFS_SRC}" ${B}/initramfs.cpio.gz
+    INITRAMFS_SIZE=$(stat -c%s ${B}/initramfs.cpio.gz)
+    bbnote "Initramfs copied: ${INITRAMFS_SIZE} bytes ($(expr ${INITRAMFS_SIZE} / 1024)KB)"
+
+    # =========================================================================
+    # PART 2: COPY ROOTFS (same squashfs, works under both QEMU and Xen)
+    # =========================================================================
+    bbnote "Copying rootfs from image build..."
+
+    ROOTFS_SRC="${MC_DEPLOY}/${VXN_RUNTIME}-rootfs-image-${MACHINE}.rootfs.squashfs"
+
+    if [ ! -f "${ROOTFS_SRC}" ]; then
+        bbfatal "Rootfs image not found at ${ROOTFS_SRC}. Build it first with: bitbake mc:${VXN_MULTICONFIG}:${VXN_RUNTIME}-rootfs-image"
+    fi
+
+    cp "${ROOTFS_SRC}" ${B}/rootfs.img
+    ROOTFS_SIZE=$(stat -c%s ${B}/rootfs.img)
+    bbnote "Rootfs image copied: ${ROOTFS_SIZE} bytes ($(expr ${ROOTFS_SIZE} / 1024 / 1024)MB)"
+
+    # Inject vxn init scripts into the rootfs squashfs
+    bbnote "Injecting vxn init scripts into rootfs..."
+    UNSQUASH_DIR="${B}/rootfs-unsquash"
+    rm -rf "${UNSQUASH_DIR}"
+    unsquashfs -d "${UNSQUASH_DIR}" ${B}/rootfs.img
+    install -m 0755 ${S}/vxn-init.sh ${UNSQUASH_DIR}/vxn-init.sh
+    install -m 0755 ${S}/vcontainer-init-common.sh ${UNSQUASH_DIR}/vcontainer-init-common.sh
+    rm -f ${B}/rootfs.img
+    mksquashfs "${UNSQUASH_DIR}" ${B}/rootfs.img -noappend -comp xz
+    rm -rf "${UNSQUASH_DIR}"
+    ROOTFS_SIZE=$(stat -c%s ${B}/rootfs.img)
+    bbnote "Rootfs with vxn init scripts: ${ROOTFS_SIZE} bytes ($(expr ${ROOTFS_SIZE} / 1024 / 1024)MB)"
+
+    # =========================================================================
+    # PART 3: COPY KERNEL (Xen PV-capable via vxn.cfg fragment)
+    # =========================================================================
+    bbnote "Copying kernel image..."
+    KERNEL_FILE="${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE_INITRAMFS}"
+    if [ -f "${KERNEL_FILE}" ]; then
+        cp "${KERNEL_FILE}" ${B}/kernel
+        KERNEL_SIZE=$(stat -c%s ${B}/kernel)
+        bbnote "Kernel copied: ${KERNEL_SIZE} bytes ($(expr ${KERNEL_SIZE} / 1024 / 1024)MB)"
+    else
+        bbwarn "Kernel not found at ${KERNEL_FILE}"
+    fi
+}
+
+# This is a deploy-only recipe - no packages produced.
+# PACKAGES="" prevents the rootfs task from looking for package manifests.
+PACKAGES = ""
+do_install[noexec] = "1"
+do_package[noexec] = "1"
+do_packagedata[noexec] = "1"
+do_package_write_rpm[noexec] = "1"
+do_package_write_ipk[noexec] = "1"
+do_package_write_deb[noexec] = "1"
+do_populate_sysroot[noexec] = "1"
+
+do_deploy() {
+    install -d ${DEPLOYDIR}/vxn/${BLOB_ARCH}
+
+    if [ -f ${B}/initramfs.cpio.gz ]; then
+        install -m 0644 ${B}/initramfs.cpio.gz ${DEPLOYDIR}/vxn/${BLOB_ARCH}/
+        bbnote "Deployed initramfs.cpio.gz to vxn/${BLOB_ARCH}/"
+    fi
+
+    if [ -f ${B}/rootfs.img ]; then
+        install -m 0644 ${B}/rootfs.img ${DEPLOYDIR}/vxn/${BLOB_ARCH}/
+        bbnote "Deployed rootfs.img to vxn/${BLOB_ARCH}/"
+    fi
+
+    if [ -f ${B}/kernel ]; then
+        install -m 0644 ${B}/kernel ${DEPLOYDIR}/vxn/${BLOB_ARCH}/${KERNEL_IMAGETYPE_INITRAMFS}
+        bbnote "Deployed kernel as vxn/${BLOB_ARCH}/${KERNEL_IMAGETYPE_INITRAMFS}"
+    fi
+
+    cat > ${DEPLOYDIR}/vxn/${BLOB_ARCH}/README << EOF
+vxn Boot Blobs (Xen DomU)
+==========================
+
+Built for: ${TARGET_ARCH}
+Machine: ${MACHINE}
+Multiconfig: ${VXN_MULTICONFIG}
+Source runtime: ${VXN_RUNTIME}
+Date: $(date)
+
+Files:
+  ${KERNEL_IMAGETYPE_INITRAMFS}  - Kernel image (Xen PV-capable)
+  initramfs.cpio.gz              - Tiny initramfs (busybox + preinit)
+  rootfs.img                     - Root filesystem with container tools
+
+Boot flow:
+  xl create <domain.cfg>
+  -> Xen boots kernel + initramfs in DomU
+  -> preinit detects Xen, mounts rootfs.img from /dev/xvda
+  -> switch_root into rootfs.img
+  -> init script runs container commands
+EOF
+}
+
+addtask deploy after do_compile before do_build
diff --git a/recipes-core/vxn/vxn-initramfs-create_1.0.bb b/recipes-core/vxn/vxn-initramfs-create_1.0.bb
new file mode 100644
index 00000000..edbef12f
--- /dev/null
+++ b/recipes-core/vxn/vxn-initramfs-create_1.0.bb
@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: Copyright (C) 2025 Bruce Ashfield
+#
+# SPDX-License-Identifier: MIT
+#
+# vxn-initramfs-create_1.0.bb
+# ===========================================================================
+# Builds Xen DomU boot blobs for vxn
+# ===========================================================================
+#
+# This recipe packages boot blobs for vxn (vcontainer on Xen):
+# - A tiny initramfs (reused from vdkr/vpdmn build)
+# - The rootfs.img squashfs (same as vdkr, with HV detection in init)
+# - The kernel (Xen PV-capable via vxn.cfg fragment in vruntime)
+#
+# Boot flow on Xen Dom0:
+#   xl create domain.cfg
+#   -> Xen boots kernel + tiny initramfs in DomU
+#   -> preinit detects Xen block prefix, mounts rootfs.img from /dev/xvda
+#   -> switch_root into rootfs.img
+#   -> vdkr-init.sh detects Xen via /proc/xen, uses xvd* devices
+#
+# ===========================================================================
+# BUILD INSTRUCTIONS
+# ===========================================================================
+#
+# For aarch64:
+#   MACHINE=qemuarm64 bitbake vxn-initramfs-create
+#
+# For x86_64:
+#   MACHINE=qemux86-64 bitbake vxn-initramfs-create
+#
+# Blobs are deployed to: tmp/deploy/images/${MACHINE}/vxn/
+#
+# ===========================================================================
+
+SUMMARY = "Build Xen DomU boot blobs for vxn"
+DESCRIPTION = "Packages kernel, initramfs and rootfs for running \
+               vcontainer workloads as Xen DomU guests."
+
+# Source blobs from vdkr (Docker) build - same rootfs works under Xen
+VXN_RUNTIME = "vdkr"
+
+require vxn-initramfs-create.inc
diff --git a/recipes-core/vxn/vxn_1.0.bb b/recipes-core/vxn/vxn_1.0.bb
new file mode 100644
index 00000000..2a36274a
--- /dev/null
+++ b/recipes-core/vxn/vxn_1.0.bb
@@ -0,0 +1,167 @@
+# SPDX-FileCopyrightText: Copyright (C) 2025 Bruce Ashfield
+#
+# SPDX-License-Identifier: MIT
+#
+# vxn_1.0.bb
+# ===========================================================================
+# Target integration package for vxn (vcontainer on Xen)
+# ===========================================================================
+#
+# This recipe installs vxn onto a Xen Dom0 target. It provides:
+# - vxn CLI wrapper (docker-like interface for Xen DomU containers)
+# - vrunner.sh (hypervisor-agnostic VM runner)
+# - vrunner-backend-xen.sh (Xen xl backend)
+# - vcontainer-common.sh (shared CLI code)
+# - Kernel, initramfs, and rootfs blobs for booting DomU guests
+#
+# The blobs are sourced from the vxn-initramfs-create recipe which
+# reuses the same rootfs images built by vdkr/vpdmn (the init scripts
+# detect the hypervisor at boot time).
+#
+# ===========================================================================
+# BUILD INSTRUCTIONS
+# ===========================================================================
+#
+# For aarch64 Dom0:
+#   MACHINE=qemuarm64 bitbake vxn
+#
+# For x86_64 Dom0:
+#   MACHINE=qemux86-64 bitbake vxn
+#
+# Add to a Dom0 image:
+#   IMAGE_INSTALL:append = " vxn"
+#
+# Usage on Dom0:
+#   vxn run hello-world           # Run OCI container as Xen DomU
+#   vxn vmemres start             # Start persistent DomU (daemon mode)
+#   vxn vexpose                   # Expose Docker API on Dom0
+#
+# ===========================================================================
+
+SUMMARY = "Docker CLI for Xen-based container execution"
+DESCRIPTION = "vxn provides a familiar docker-like CLI that executes commands \
+               inside a Xen DomU guest with Docker. It uses the vcontainer \
+               infrastructure with a Xen hypervisor backend."
+HOMEPAGE = "https://git.yoctoproject.org/meta-virtualization/"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+inherit features_check
+REQUIRED_DISTRO_FEATURES = "xen"
+
+SRC_URI = "\
+    file://vxn.sh \
+    file://vrunner.sh \
+    file://vrunner-backend-xen.sh \
+    file://vrunner-backend-qemu.sh \
+    file://vcontainer-common.sh \
+"
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/../../recipes-containers/vcontainer/files:"
+
+S = "${UNPACKDIR}"
+
+# Runtime dependencies on Dom0
+RDEPENDS:${PN} = "\
+    xen-tools-xl \
+    bash \
+    jq \
+    socat \
+    coreutils \
+    util-linux \
+    e2fsprogs \
+    skopeo \
+"
+
+# Blobs are sourced from vxn-initramfs-create deploy output.
+# Build blobs first: bitbake vxn-initramfs-create
+# No task dependency here - vxn-initramfs-create is deploy-only (no packages).
+# Adding any dependency from a packaged recipe to a deploy-only recipe
+# breaks do_rootfs (sstate manifest not found for package_write_rpm).
+
+# Blobs come from DEPLOY_DIR which is untracked by sstate hash.
+# nostamp on do_install alone is insufficient — do_package and
+# do_package_write_rpm have unchanged sstate hashes so they restore
+# the OLD RPM from cache, discarding the fresh do_install output.
+# Force the entire install→package→RPM chain to always re-run.
+do_install[nostamp] = "1"
+do_package[nostamp] = "1"
+do_packagedata[nostamp] = "1"
+do_package_write_rpm[nostamp] = "1"
+do_package_write_ipk[nostamp] = "1"
+do_package_write_deb[nostamp] = "1"
+
+def vxn_get_blob_arch(d):
+    arch = d.getVar('TARGET_ARCH')
+    if arch == 'aarch64':
+        return 'aarch64'
+    elif arch in ['x86_64', 'i686', 'i586']:
+        return 'x86_64'
+    return 'aarch64'
+
+def vxn_get_kernel_image_name(d):
+    arch = d.getVar('TARGET_ARCH')
+    if arch == 'aarch64':
+        return 'Image'
+    elif arch in ['x86_64', 'i686', 'i586']:
+        return 'bzImage'
+    elif arch == 'arm':
+        return 'zImage'
+    return 'Image'
+
+BLOB_ARCH = "${@vxn_get_blob_arch(d)}"
+KERNEL_IMAGETYPE_VXN = "${@vxn_get_kernel_image_name(d)}"
+
+VXN_DEPLOY = "${DEPLOY_DIR_IMAGE}"
+
+do_install() {
+    # Install CLI wrapper
+    install -d ${D}${bindir}
+    install -m 0755 ${S}/vxn.sh ${D}${bindir}/vxn
+
+    # Install shared scripts into libdir
+    install -d ${D}${libdir}/vxn
+    install -m 0755 ${S}/vrunner.sh ${D}${libdir}/vxn/
+    install -m 0755 ${S}/vrunner-backend-xen.sh ${D}${libdir}/vxn/
+    install -m 0755 ${S}/vrunner-backend-qemu.sh ${D}${libdir}/vxn/
+    install -m 0644 ${S}/vcontainer-common.sh ${D}${libdir}/vxn/
+
+    # Install blobs from vxn-initramfs-create deployment
+    # Layout must match what vrunner backends expect: $BLOB_DIR/<arch>/{Image,initramfs.cpio.gz,rootfs.img}
+    install -d ${D}${datadir}/vxn/${BLOB_ARCH}
+
+    VXN_BLOB_SRC="${VXN_DEPLOY}/vxn/${BLOB_ARCH}"
+    if [ -d "${VXN_BLOB_SRC}" ]; then
+        if [ -f "${VXN_BLOB_SRC}/${KERNEL_IMAGETYPE_VXN}" ]; then
+            install -m 0644 "${VXN_BLOB_SRC}/${KERNEL_IMAGETYPE_VXN}" ${D}${datadir}/vxn/${BLOB_ARCH}/
+            bbnote "Installed kernel ${KERNEL_IMAGETYPE_VXN}"
+        else
+            bbwarn "Kernel not found at ${VXN_BLOB_SRC}/${KERNEL_IMAGETYPE_VXN}"
+        fi
+
+        if [ -f "${VXN_BLOB_SRC}/initramfs.cpio.gz" ]; then
+            install -m 0644 "${VXN_BLOB_SRC}/initramfs.cpio.gz" ${D}${datadir}/vxn/${BLOB_ARCH}/
+            bbnote "Installed initramfs"
+        else
+            bbwarn "Initramfs not found at ${VXN_BLOB_SRC}/initramfs.cpio.gz"
+        fi
+
+        if [ -f "${VXN_BLOB_SRC}/rootfs.img" ]; then
+            install -m 0644 "${VXN_BLOB_SRC}/rootfs.img" ${D}${datadir}/vxn/${BLOB_ARCH}/
+            bbnote "Installed rootfs.img"
+        else
+            bbwarn "Rootfs not found at ${VXN_BLOB_SRC}/rootfs.img"
+        fi
+    else
+        bbwarn "VXN blob directory not found at ${VXN_BLOB_SRC}. Build with: bitbake vxn-initramfs-create"
+    fi
+}
+
+FILES:${PN} = "\
+    ${bindir}/vxn \
+    ${libdir}/vxn/ \
+    ${datadir}/vxn/ \
+"
+
+# Blobs are large binary files
+INSANE_SKIP:${PN} += "already-stripped"
diff --git a/recipes-kernel/linux/linux-yocto/vxn.cfg b/recipes-kernel/linux/linux-yocto/vxn.cfg
new file mode 100644
index 00000000..932732dc
--- /dev/null
+++ b/recipes-kernel/linux/linux-yocto/vxn.cfg
@@ -0,0 +1,24 @@
+# Xen PV guest support for vxn (vcontainer on Xen)
+# These configs enable a kernel to run as a Xen PV or PVHVM guest
+# with virtio-equivalent functionality via Xen paravirtualized drivers.
+
+# Core Xen guest support
+CONFIG_XEN=y
+CONFIG_XEN_PV=y
+CONFIG_XEN_PVHVM=y
+
+# Block device frontend (guest sees /dev/xvd*)
+CONFIG_XEN_BLKDEV_FRONTEND=y
+
+# Network frontend (guest sees eth0 via xennet)
+CONFIG_XEN_NETDEV_FRONTEND=y
+
+# PV console (guest sees /dev/hvc0, /dev/hvc1)
+CONFIG_HVC_XEN=y
+CONFIG_HVC_XEN_FRONTEND=y
+
+# Framebuffer frontend (not strictly required but useful)
+CONFIG_XEN_FBDEV_FRONTEND=y
+
+# 9pfs frontend for file sharing (trans=xen)
+CONFIG_XEN_9PFS_FRONTEND=y