14 files changed, 2744 insertions, 301 deletions

diff --git a/tests/conftest.py b/tests/conftest.py
index 22c47d17..6258611b 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -259,6 +259,13 @@ def pytest_addoption(parser):
         default=False,
         help="Run secure registry tests (requires openssl, htpasswd)",
     )
+    # Container cross-install coverage options
+    parser.addoption(
+        "--container-profiles",
+        action="store",
+        default="docker,podman",
+        help="Comma-separated container profiles to test (default: docker,podman)",
+    )
 
 
 def _cleanup_stale_test_state():
@@ -501,10 +508,17 @@ class VdkrRunner:
         result = self.memres_status()
         return result.returncode == 0 and "running" in result.stdout.lower()
 
-    def ensure_memres(self, timeout=180):
-        """Ensure memres is running, starting it if needed."""
+    def ensure_memres(self, timeout=180, no_registry=True):
+        """Ensure memres is running, starting it if needed.
+
+        Args:
+            timeout: Timeout for memres start
+            no_registry: Disable baked-in registry (default True for tests
+                so that pulled images use short names like alpine:latest
+                rather than registry-prefixed names)
+        """
         if not self.is_memres_running():
-            result = self.memres_start(timeout=timeout)
+            result = self.memres_start(timeout=timeout, no_registry=no_registry)
             if result.returncode != 0:
                 raise RuntimeError(f"Failed to start memres: {result.stderr}")
 
@@ -640,6 +654,9 @@ def pytest_configure(config):
         "markers", "boot: marks tests that boot a QEMU image (requires built image)"
     )
     config.addinivalue_line(
+        "markers", "container_profile: marks tests parametrized over container profiles"
+    )
+    config.addinivalue_line(
         "markers", "k3s: marks k3s runtime tests"
     )
     config.addinivalue_line(
@@ -790,10 +807,17 @@ class VpdmnRunner:
         result = self.memres_status()
         return result.returncode == 0 and "running" in result.stdout.lower()
 
-    def ensure_memres(self, timeout=180):
-        """Ensure memres is running, starting it if needed."""
+    def ensure_memres(self, timeout=180, no_registry=True):
+        """Ensure memres is running, starting it if needed.
+
+        Args:
+            timeout: Timeout for memres start
+            no_registry: Disable baked-in registry (default True for tests
+                so that pulled images use short names like alpine:latest
+                rather than registry-prefixed names)
+        """
         if not self.is_memres_running():
-            result = self.memres_start(timeout=timeout)
+            result = self.memres_start(timeout=timeout, no_registry=no_registry)
             if result.returncode != 0:
                 raise RuntimeError(f"Failed to start memres: {result.stderr}")
 
diff --git a/tests/pytest.ini b/tests/pytest.ini
index 6d756a28..6e72e447 100644
--- a/tests/pytest.ini
+++ b/tests/pytest.ini
@@ -12,6 +12,7 @@ markers =
     boot: marks tests that boot a full QEMU image (requires pexpect)
     incus: marks incus runtime tests
     k3s: marks k3s runtime tests
+    lxc: marks lxc runtime tests
 
 # Default options - include junit xml for CI and detailed output
 addopts = -v --tb=short --junitxml=/tmp/pytest-results.xml
diff --git a/tests/requirements.txt b/tests/requirements.txt
new file mode 100644
index 00000000..b0ac705f
--- /dev/null
+++ b/tests/requirements.txt
@@ -0,0 +1,3 @@
+pytest>=9.0.3,<10
+pytest-timeout>=2.4.0,<3
+pexpect>=4.9.0,<5 
diff --git a/tests/test_container_cross_install.py b/tests/test_container_cross_install.py
index ceb8b874..52eceb0d 100644
--- a/tests/test_container_cross_install.py
+++ b/tests/test_container_cross_install.py
@@ -8,17 +8,22 @@ These tests verify that container-cross-install correctly bundles
 OCI containers into Yocto images.
 
 Run with:
-    pytest tests/test_container_cross_install.py -v
+    pytest tests/test_container_cross_install.py -v --poky-dir /opt/bruce/poky
 
-Run boot tests (requires built image):
-    pytest tests/test_container_cross_install.py::TestBundledContainersBoot -v
+Full coverage (builds + boots with both docker and podman profiles):
+    pytest tests/test_container_cross_install.py -v --poky-dir /opt/bruce/poky --container-profiles docker,podman
+
+Single profile only:
+    pytest tests/test_container_cross_install.py -v --poky-dir /opt/bruce/poky --container-profiles docker
 
 Environment variables:
     POKY_DIR: Path to poky directory (default: /opt/bruce/poky)
     BUILD_DIR: Path to build directory (default: $POKY_DIR/build)
     MACHINE: Target machine (default: qemux86-64)
 
-Note: These tests require a configured Yocto build environment.
+Note: Boot tests (TestBundledContainersBoot, TestCustomServiceFileBoot) build
+container-image-host with each --container-profiles profile, boot it, and
+verify containers are present and runnable. No local.conf editing required.
 """
 
 import os
@@ -87,26 +92,55 @@ def meta_virt_dir(poky_dir):
     return path
 
 
-def run_bitbake(build_dir, recipe, task=None, extra_args=None, timeout=1800):
-    """Run a bitbake command."""
-    cmd = ["bitbake"]
+def run_bitbake(build_dir, recipe, task=None, extra_args=None, extra_vars=None, timeout=1800):
+    """Run a bitbake command within the Yocto environment.
+
+    Args:
+        build_dir: Path to build directory
+        recipe: Recipe or mc:target to build
+        task: Optional task (e.g., 'rootfs')
+        extra_args: Optional list of extra bitbake arguments
+        extra_vars: Optional dict of variable overrides (written to a
+                    temporary conf file and passed via -R)
+        timeout: Command timeout in seconds
+    """
+    import tempfile
+
+    bb_cmd = "bitbake"
     if task:
-        cmd.extend(["-c", task])
-    cmd.append(recipe)
+        bb_cmd += f" -c {task}"
+
+    # Write variable overrides to a temporary conf file
+    conf_file = None
+    if extra_vars:
+        conf_file = tempfile.NamedTemporaryFile(
+            mode='w', suffix='.conf', prefix='pytest-bbvars-',
+            dir=str(build_dir / "conf"), delete=False)
+        for var, val in extra_vars.items():
+            conf_file.write(f'{var} = "{val}"\n')
+        conf_file.close()
+        bb_cmd += f" -R {conf_file.name}"
+
+    bb_cmd += f" {recipe}"
     if extra_args:
-        cmd.extend(extra_args)
-
-    env = os.environ.copy()
-    env["BUILDDIR"] = str(build_dir)
-
-    result = subprocess.run(
-        cmd,
-        cwd=build_dir,
-        env=env,
-        timeout=timeout,
-        capture_output=True,
-        text=True,
-    )
+        bb_cmd += " " + " ".join(extra_args)
+
+    poky_dir = build_dir.parent
+    full_cmd = f"bash -c 'cd {poky_dir} && source oe-init-build-env {build_dir} >/dev/null 2>&1 && {bb_cmd}'"
+
+    try:
+        result = subprocess.run(
+            full_cmd,
+            shell=True,
+            cwd=build_dir,
+            timeout=timeout,
+            capture_output=True,
+            text=True,
+        )
+    finally:
+        if conf_file:
+            os.unlink(conf_file.name)
+
     return result
 
 
@@ -298,13 +332,13 @@ class TestVdkrRecipes:
         assert len(installers) > 0, f"No SDK installer found in {sdk_deploy}"
 
     def test_vdkr_initramfs_create(self, build_dir):
-        """Test vdkr-initramfs-create builds."""
-        result = run_bitbake(build_dir, "vdkr-initramfs-create")
+        """Test vdkr-initramfs-create builds via multiconfig."""
+        result = run_bitbake(build_dir, "mc:vruntime-x86-64:vdkr-initramfs-create")
         assert result.returncode == 0, f"Build failed: {result.stderr}"
 
     def test_vpdmn_initramfs_create(self, build_dir):
-        """Test vpdmn-initramfs-create builds."""
-        result = run_bitbake(build_dir, "vpdmn-initramfs-create")
+        """Test vpdmn-initramfs-create builds via multiconfig."""
+        result = run_bitbake(build_dir, "mc:vruntime-x86-64:vpdmn-initramfs-create")
         assert result.returncode == 0, f"Build failed: {result.stderr}"
 
 
@@ -439,6 +473,10 @@ class RunqemuSession:
             # Get everything before the prompt
             raw_output = self.child.before
 
+            # Strip OSC and other escape sequences from output
+            raw_output = re.sub(r'\x1b\]3008;[^\x07\x1b]*(?:\x07|\x1b\\)', '', raw_output)
+            raw_output = re.sub(r'\x1b\[[0-9;]*[A-Za-z]', '', raw_output)
+
             # Parse: split by newlines, skip command echo (first line), take the rest
             lines = raw_output.replace('\r', '').split('\n')
 
@@ -589,6 +627,64 @@ def runqemu_session(request, poky_dir, build_dir, machine, check_rootfs_freshnes
         session.stop()
 
 
+def _get_container_profiles(request):
+    """Parse --container-profiles option into a list."""
+    return [p.strip() for p in request.config.getoption("--container-profiles").split(",")]
+
+
+@pytest.fixture(scope="class", params=["docker", "podman"])
+def profiled_session(request, poky_dir, build_dir, machine):
+    """
+    Fixture that builds container-image-host with a specific CONTAINER_PROFILE,
+    boots it, and provides a session for testing.
+
+    Parametrized over profiles from --container-profiles (default: docker,podman).
+    Each profile gets a full build → boot → test cycle.
+    """
+    profile = request.param
+    profiles = _get_container_profiles(request)
+    if profile not in profiles:
+        pytest.skip(f"Profile {profile} not in --container-profiles={','.join(profiles)}")
+
+    if not PEXPECT_AVAILABLE:
+        pytest.skip("pexpect not installed. Run: pip install pexpect")
+
+    image = request.config.getoption("--image")
+    fstype = request.config.getoption("--image-fstype")
+    timeout = request.config.getoption("--boot-timeout")
+    use_kvm = not request.config.getoption("--no-kvm")
+
+    # Build the image with this profile
+    result = run_bitbake(
+        build_dir, image,
+        extra_vars={"CONTAINER_PROFILE": profile},
+        timeout=3600,
+    )
+    if result.returncode != 0:
+        pytest.fail(f"Build failed for profile {profile}: {result.stderr}")
+
+    session = RunqemuSession(poky_dir, build_dir, machine, image,
+                             fstype=fstype, use_kvm=use_kvm, timeout=timeout)
+    session.container_profile = profile
+
+    try:
+        session.start()
+        yield session
+    finally:
+        session.stop()
+
+
+@pytest.fixture(scope="class")
+def profiled_containers(profiled_session, build_dir, machine):
+    """Detect containers in the booted image for the active profile."""
+    image = "container-image-host"
+    result = _detect_containers_from_rootfs(build_dir, machine, image)
+    if not result:
+        result = {'docker': [], 'podman': []}
+    result['profile'] = profiled_session.container_profile
+    return result
+
+
 def _detect_containers_from_rootfs(build_dir, machine, image):
     """
     Detect bundled containers by checking storage directories in the rootfs.
@@ -775,135 +871,75 @@ class TestBundledContainersBoot:
     """
     Boot tests to verify bundled containers are visible.
 
-    These tests boot the actual Yocto image and verify that
-    `docker images` or `podman images` shows the bundled containers.
-
-    Prerequisites:
-        - Image must be built with BUNDLED_CONTAINERS configured
-        - pexpect must be installed: pip install pexpect
+    Parametrized over container profiles (--container-profiles, default: docker,podman).
+    For each profile, builds container-image-host with that CONTAINER_PROFILE,
+    boots the image, and verifies the profile's containers are present and runnable.
 
     Run with:
         pytest tests/test_container_cross_install.py::TestBundledContainersBoot -v
 
     Options:
-        --image IMAGE          Image name to boot (default: core-image-minimal)
+        --container-profiles   Profiles to test (default: docker,podman)
+        --image IMAGE          Image name to boot (default: container-image-host)
         --machine MACHINE      Machine to use (default: qemux86-64)
         --boot-timeout SECS    Timeout for boot (default: 120)
     """
 
     @pytest.mark.slow
     @pytest.mark.boot
-    def test_system_boots(self, runqemu_session):
+    @pytest.mark.container_profile
+    def test_system_boots(self, profiled_session):
         """Test that the system boots successfully."""
-        assert runqemu_session.booted, "System failed to boot"
+        assert profiled_session.booted, \
+            f"System failed to boot with profile {profiled_session.container_profile}"
 
-        # Basic sanity check
-        output = runqemu_session.run_command('uname -a')
+        output = profiled_session.run_command('uname -a')
         assert 'Linux' in output, f"Unexpected uname output: {output}"
 
     @pytest.mark.slow
     @pytest.mark.boot
-    def test_docker_images_visible(self, runqemu_session, bundled_containers_config):
-        """Test that bundled Docker containers are visible."""
-        expected = bundled_containers_config['docker']
-        if not expected:
-            pytest.skip("No Docker containers in bundle packages or BUNDLED_CONTAINERS")
+    @pytest.mark.container_profile
+    def test_containers_visible(self, profiled_session, profiled_containers):
+        """Test that bundled containers are visible for the active profile."""
+        profile = profiled_session.container_profile
+        runtime = profile  # docker or podman
 
-        # Check if docker is available
-        output = runqemu_session.run_command('which docker')
-        if '/docker' not in output:
-            pytest.skip("docker not installed in image")
+        output = profiled_session.run_command(f'which {runtime}')
+        assert f'/{runtime}' in output, \
+            f"{runtime} not installed in image (profile={profile})"
 
-        # Get docker images
-        output = runqemu_session.run_command('docker images', timeout=30)
-        print(f"docker images output:\n{output}")
+        output = profiled_session.run_command(f'{runtime} images', timeout=30)
+        print(f"{runtime} images output ({profile}):\n{output}")
 
-        # Verify each expected container is present
-        missing = []
-        for container in expected:
-            if container not in output:
-                missing.append(container)
+        expected = profiled_containers.get(runtime, [])
+        assert expected, \
+            f"No {runtime} containers detected in rootfs (profile={profile})"
 
-        assert not missing, f"Missing Docker containers: {missing}\nOutput:\n{output}"
+        missing = [c for c in expected if c not in output]
+        assert not missing, \
+            f"Missing {runtime} containers: {missing}\nOutput:\n{output}"
 
     @pytest.mark.slow
     @pytest.mark.boot
-    def test_podman_images_visible(self, runqemu_session, bundled_containers_config):
-        """Test that bundled Podman containers are visible."""
-        expected = bundled_containers_config['podman']
-        if not expected:
-            pytest.skip("No Podman containers in bundle packages or BUNDLED_CONTAINERS")
-
-        # Check if podman is available
-        output = runqemu_session.run_command('which podman')
-        if '/podman' not in output:
-            pytest.skip("podman not installed in image")
-
-        # Get podman images
-        output = runqemu_session.run_command('podman images', timeout=30)
-        print(f"podman images output:\n{output}")
-
-        # Verify each expected container is present
-        missing = []
-        for container in expected:
-            if container not in output:
-                missing.append(container)
-
-        assert not missing, f"Missing Podman containers: {missing}\nOutput:\n{output}"
-
-    @pytest.mark.slow
-    @pytest.mark.boot
-    def test_docker_run_bundled_container(self, runqemu_session, bundled_containers_config):
-        """Test that a bundled Docker container can actually run."""
-        expected = bundled_containers_config['docker']
-        if not expected:
-            pytest.skip("No Docker containers configured")
-
-        # Check if docker is available
-        output = runqemu_session.run_command('which docker')
-        if '/docker' not in output:
-            pytest.skip("docker not installed in image")
-
-        # Try to run the first bundled container with a simple command
-        # Use --entrypoint to override any image entrypoint, otherwise
-        # images with entrypoint like ["sh"] would interpret the command
-        # as a script argument rather than executing the binary directly
-        container = expected[0]
-        output = runqemu_session.run_command(
-            f'docker run --rm --entrypoint /bin/echo {container}:latest "CONTAINER_WORKS"',
-            timeout=60
-        )
-        print(f"docker run output:\n{output}")
+    @pytest.mark.container_profile
+    def test_run_bundled_container(self, profiled_session, profiled_containers):
+        """Test that a bundled container can actually run."""
+        profile = profiled_session.container_profile
+        runtime = profile
 
-        assert 'CONTAINER_WORKS' in output, \
-            f"Container {container} failed to run.\nOutput:\n{output}"
+        expected = profiled_containers.get(runtime, [])
+        assert expected, \
+            f"No {runtime} containers detected in rootfs (profile={profile})"
 
-    @pytest.mark.slow
-    @pytest.mark.boot
-    def test_podman_run_bundled_container(self, runqemu_session, bundled_containers_config):
-        """Test that a bundled Podman container can actually run."""
-        expected = bundled_containers_config['podman']
-        if not expected:
-            pytest.skip("No Podman containers in bundle packages or BUNDLED_CONTAINERS")
-
-        # Check if podman is available
-        output = runqemu_session.run_command('which podman')
-        if '/podman' not in output:
-            pytest.skip("podman not installed in image")
-
-        # Try to run the first bundled container with a simple command
-        # Use --entrypoint to override any image entrypoint, otherwise
-        # images with entrypoint like ["sh"] would interpret the command
-        # as a script argument rather than executing the binary directly
         container = expected[0]
-        output = runqemu_session.run_command(
-            f'podman run --rm --entrypoint /bin/echo {container}:latest "CONTAINER_WORKS"',
+        output = profiled_session.run_command(
+            f'{runtime} run --rm --entrypoint /bin/echo {container}:latest "CONTAINER_WORKS"',
             timeout=60
         )
-        print(f"podman run output:\n{output}")
+        print(f"{runtime} run output ({profile}):\n{output}")
 
         assert 'CONTAINER_WORKS' in output, \
-            f"Container {container} failed to run.\nOutput:\n{output}"
+            f"Container {container} failed to run with {runtime}.\nOutput:\n{output}"
 
 
 # ============================================================================
@@ -933,6 +969,22 @@ class TestCustomServiceFileSupport:
         assert "install_custom_service" in content, \
             "install_custom_service function not found"
 
+    def test_bundle_class_unpack_enabled(self, meta_virt_dir):
+        """Test that do_unpack is NOT disabled in container-bundle.bbclass.
+
+        Custom service files use SRC_URI file:// entries which require
+        do_unpack to run. If do_unpack[noexec] = "1" is set, the files
+        never reach UNPACKDIR and CONTAINER_SERVICE_FILE references fail.
+        """
+        class_file = meta_virt_dir / "classes" / "container-bundle.bbclass"
+        content = class_file.read_text()
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            assert 'do_unpack[noexec]' not in stripped, \
+                "do_unpack must not be noexec — custom service files need SRC_URI unpacking"
+
     def test_bundle_class_has_service_file_support(self, meta_virt_dir):
         """Test that container-bundle.bbclass includes CONTAINER_SERVICE_FILE support."""
         class_file = meta_virt_dir / "classes" / "container-bundle.bbclass"
@@ -983,118 +1035,74 @@ class TestCustomServiceFileBoot:
     """
     Boot tests for custom service files.
 
-    These tests verify that custom service files are properly installed
-    and enabled in the booted system.
+    Parametrized over container profiles — verifies that autostart services
+    (Docker systemd units or Podman Quadlet files) are correctly installed
+    and enabled for each profile.
     """
 
     @pytest.mark.slow
     @pytest.mark.boot
-    def test_systemd_services_directory_exists(self, runqemu_session):
+    @pytest.mark.container_profile
+    def test_systemd_services_directory_exists(self, profiled_session):
         """Test that systemd service directories exist."""
-        output = runqemu_session.run_command('ls -la /lib/systemd/system/ | head -5')
+        output = profiled_session.run_command('ls -la /lib/systemd/system/ | head -n 5')
         assert 'systemd' in output or 'total' in output, \
             "Systemd system directory not accessible"
 
     @pytest.mark.slow
     @pytest.mark.boot
-    def test_container_services_present(self, runqemu_session, bundled_containers_config):
-        """Test that container service files are present (custom or generated)."""
-        docker_containers = bundled_containers_config.get('docker', [])
-
-        if not docker_containers:
-            pytest.skip("No Docker containers configured")
-
-        # Check if docker is available
-        output = runqemu_session.run_command('which docker')
-        if '/docker' not in output:
-            pytest.skip("docker not installed in image")
-
-        # Check for container service files
-        output = runqemu_session.run_command('ls /lib/systemd/system/container-*.service 2>/dev/null || echo "NONE"')
-
-        if 'NONE' in output:
-            # No autostart services - check if any containers have autostart
-            pytest.skip("No container autostart services found (containers may not have autostart enabled)")
-
-        # Verify at least one service file exists
-        assert '.service' in output, \
-            f"No container service files found. Output: {output}"
-
-    @pytest.mark.slow
-    @pytest.mark.boot
-    def test_container_service_enabled(self, runqemu_session, bundled_containers_config):
-        """Test that container services are enabled (linked in wants directory)."""
-        docker_containers = bundled_containers_config.get('docker', [])
-
-        if not docker_containers:
-            pytest.skip("No Docker containers configured")
-
-        # Check for enabled services in multi-user.target.wants
-        output = runqemu_session.run_command(
-            'ls /etc/systemd/system/multi-user.target.wants/container-*.service 2>/dev/null || echo "NONE"'
-        )
-
-        if 'NONE' in output:
-            pytest.skip("No container autostart services enabled")
-
-        # Verify services are symlinked
-        assert '.service' in output, \
-            f"No enabled container services found. Output: {output}"
+    @pytest.mark.container_profile
+    def test_autostart_service_present(self, profiled_session):
+        """Test that autostart service files are present for the active profile."""
+        profile = profiled_session.container_profile
+
+        if profile == 'docker':
+            output = profiled_session.run_command(
+                'ls /lib/systemd/system/container-*.service 2>/dev/null || echo "NONE"')
+            assert 'NONE' not in output and '.service' in output, \
+                f"No Docker autostart service files found (profile={profile})"
+
+        elif profile == 'podman':
+            output = profiled_session.run_command(
+                'ls /etc/containers/systemd/*.container 2>/dev/null || echo "NONE"')
+            assert 'NONE' not in output and '.container' in output, \
+                f"No Podman Quadlet files found (profile={profile})"
 
     @pytest.mark.slow
     @pytest.mark.boot
-    def test_custom_service_content(self, runqemu_session, bundled_containers_config):
-        """Test that custom service files have expected content markers."""
-        docker_containers = bundled_containers_config.get('docker', [])
-
-        if not docker_containers:
-            pytest.skip("No Docker containers configured")
+    @pytest.mark.container_profile
+    def test_autostart_service_running(self, profiled_session):
+        """Test that the autostart container is actually running."""
+        profile = profiled_session.container_profile
+        runtime = profile
 
-        # Find a container service file
-        output = runqemu_session.run_command(
-            'ls /lib/systemd/system/container-*.service 2>/dev/null | head -1'
-        )
-
-        if not output or 'container-' not in output:
-            pytest.skip("No container service files found")
-
-        service_file = output.strip().split('\n')[0]
+        output = profiled_session.run_command(f'{runtime} ps', timeout=30)
+        print(f"{runtime} ps output ({profile}):\n{output}")
 
-        # Read the service file content
-        content = runqemu_session.run_command(f'cat {service_file}')
-
-        # Verify it has expected systemd service structure
-        assert '[Unit]' in content, f"Service file missing [Unit] section: {service_file}"
-        assert '[Service]' in content, f"Service file missing [Service] section: {service_file}"
-        assert '[Install]' in content, f"Service file missing [Install] section: {service_file}"
-
-        # Check for docker-related content
-        assert 'docker' in content.lower(), \
-            f"Service file doesn't reference docker: {content}"
+        assert 'autostart-test-container' in output, \
+            f"autostart-test-container not running under {runtime} (profile={profile})\nOutput:\n{output}"
 
     @pytest.mark.slow
     @pytest.mark.boot
-    def test_podman_quadlet_directory(self, runqemu_session, bundled_containers_config):
-        """Test Podman Quadlet directory exists for Podman containers."""
-        podman_containers = bundled_containers_config.get('podman', [])
-
-        if not podman_containers:
-            pytest.skip("No Podman containers configured")
-
-        # Check if podman is available
-        output = runqemu_session.run_command('which podman')
-        if '/podman' not in output:
-            pytest.skip("podman not installed in image")
-
-        # Check for Quadlet directory
-        output = runqemu_session.run_command('ls -la /etc/containers/systemd/ 2>/dev/null || echo "NONE"')
-
-        if 'NONE' in output:
-            pytest.skip("Quadlet directory not found (containers may not have autostart enabled)")
-
-        # Check for .container files
-        output = runqemu_session.run_command('ls /etc/containers/systemd/*.container 2>/dev/null || echo "NONE"')
-
-        if 'NONE' not in output:
-            assert '.container' in output, \
-                f"No Quadlet container files found. Output: {output}"
+    @pytest.mark.container_profile
+    def test_autostart_service_content(self, profiled_session):
+        """Test that autostart service files have expected content."""
+        profile = profiled_session.container_profile
+
+        if profile == 'docker':
+            content = profiled_session.run_command(
+                'cat /lib/systemd/system/container-autostart-test-container.service')
+            assert '[Unit]' in content, \
+                f"Missing [Unit] section in docker service file.\nContent:\n{content}"
+            assert '[Service]' in content, \
+                f"Missing [Service] section in docker service file"
+            assert 'docker' in content.lower(), \
+                f"Service doesn't reference docker"
+
+        elif profile == 'podman':
+            content = profiled_session.run_command(
+                'cat /etc/containers/systemd/container-autostart-test-container.container')
+            assert '[Container]' in content, \
+                f"Missing [Container] section in podman quadlet file.\nContent:\n{content}"
+            assert 'Image=' in content, \
+                f"Missing Image= directive in podman quadlet file"
diff --git a/tests/test_container_registry_script.py b/tests/test_container_registry_script.py
index 3089e870..18efb851 100644
--- a/tests/test_container_registry_script.py
+++ b/tests/test_container_registry_script.py
@@ -1497,7 +1497,7 @@ class TestVcontainerSecureRegistry:
             "Should not base64 encode CA cert for kernel cmdline"
 
     def test_vrunner_daemon_sets_9p(self):
-        """Test that daemon mode sets _9p=1 in kernel cmdline."""
+        """Test that daemon mode sets up virtio-9p share and _9p=1."""
         script = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
                       "vcontainer/files/vrunner.sh")
         if not script.exists():
@@ -1505,26 +1505,24 @@ class TestVcontainerSecureRegistry:
 
         content = script.read_text()
 
-        # Find the daemon mode block and check for _9p=1
-        # The daemon block should contain both virtfs and _9p=1
+        # Find the daemon mode block and check for 9p setup
         lines = content.split('\n')
         in_daemon_block = False
-        daemon_has_virtfs = False
-        daemon_has_9p = False
+        daemon_has_9p_opts = False
+        daemon_has_9p_flag = False
         for line in lines:
-            if 'DAEMON_MODE" = "start"' in line or "DAEMON_MODE\" = \"start\"" in line:
+            if 'DAEMON_MODE" = "start"' in line or 'DAEMON_MODE = "start"' in line:
                 in_daemon_block = True
             if in_daemon_block:
-                if "virtfs" in line and "DAEMON_SHARE_DIR" in line:
-                    daemon_has_virtfs = True
+                if "hv_build_9p_opts" in line and "DAEMON_SHARE_DIR" in line:
+                    daemon_has_9p_opts = True
                 if "_9p=1" in line:
-                    daemon_has_9p = True
-                # Detect end of the if block (next top-level statement)
-                if line.startswith("fi") and in_daemon_block and daemon_has_virtfs:
+                    daemon_has_9p_flag = True
+                if line.startswith("fi") and in_daemon_block and daemon_has_9p_opts:
                     break
 
-        assert daemon_has_virtfs, "Daemon mode should set up virtio-9p share"
-        assert daemon_has_9p, "Daemon mode should set _9p=1 in kernel cmdline"
+        assert daemon_has_9p_opts, "Daemon mode should set up virtio-9p share via hv_build_9p_opts"
+        assert daemon_has_9p_flag, "Daemon mode should set _9p=1 in kernel cmdline"
 
     def test_vrunner_nondaemon_ca_cert_virtio9p(self):
         """Test that non-daemon mode creates virtio-9p share for CA cert."""
@@ -1536,8 +1534,8 @@ class TestVcontainerSecureRegistry:
         content = script.read_text()
         assert "CA_SHARE_DIR" in content, \
             "Non-daemon mode should create CA_SHARE_DIR for virtio-9p"
-        assert "cashare" in content, \
-            "Should add virtio-9p device for CA cert sharing"
+        assert "hv_build_9p_opts" in content and "CA_SHARE_DIR" in content, \
+            "Should set up virtio-9p device for CA cert sharing via hv_build_9p_opts"
 
     def test_vdkr_init_reads_ca_from_share(self):
         """Test that vdkr-init.sh reads CA cert from /mnt/share/ca.crt."""
diff --git a/tests/test_containerd_runtime.py b/tests/test_containerd_runtime.py
new file mode 100644
index 00000000..470ac3ba
--- /dev/null
+++ b/tests/test_containerd_runtime.py
@@ -0,0 +1,358 @@
+# SPDX-FileCopyrightText: Copyright (C) 2026 Bruce Ashfield
+#
+# SPDX-License-Identifier: MIT
+"""
+Containerd runtime tests — recipe checks, build, and boot verification.
+
+The tests automatically build container-image-host with
+CONTAINER_PROFILE=containerd before booting. No local.conf changes needed.
+
+Run:
+    # Static tests only
+    pytest tests/test_containerd_runtime.py -v -m "not slow and not boot" --poky-dir /opt/bruce/poky
+
+    # All tests
+    pytest tests/test_containerd_runtime.py -v --poky-dir /opt/bruce/poky
+"""
+
+import os
+import re
+import subprocess
+import tempfile
+import time
+import pytest
+from pathlib import Path
+
+try:
+    import pexpect
+    PEXPECT_AVAILABLE = True
+except ImportError:
+    PEXPECT_AVAILABLE = False
+
+
+def _run_bitbake(build_dir, recipe, extra_vars=None, timeout=3600):
+    """Run bitbake with optional variable overrides via -R conf file."""
+    bb_cmd = "bitbake"
+    conf_file = None
+    if extra_vars:
+        conf_file = tempfile.NamedTemporaryFile(
+            mode='w', suffix='.conf', prefix='pytest-containerd-',
+            dir=str(build_dir / "conf"), delete=False)
+        for var, val in extra_vars.items():
+            conf_file.write(f'{var} = "{val}"\n')
+        conf_file.close()
+        bb_cmd += f" -R {conf_file.name}"
+    bb_cmd += f" {recipe}"
+    poky_dir = build_dir.parent
+    full_cmd = f"bash -c 'cd {poky_dir} && source oe-init-build-env {build_dir} >/dev/null 2>&1 && {bb_cmd}'"
+    try:
+        return subprocess.run(full_cmd, shell=True, cwd=build_dir,
+                              timeout=timeout, capture_output=True, text=True)
+    finally:
+        if conf_file:
+            os.unlink(conf_file.name)
+
+
+# ============================================================================
+# Fixtures
+# ============================================================================
+
+@pytest.fixture(scope="module")
+def poky_dir(request):
+    path = Path(request.config.getoption("--poky-dir"))
+    if not path.exists():
+        pytest.skip(f"Poky directory not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def build_dir(request, poky_dir):
+    bd = request.config.getoption("--build-dir")
+    path = Path(bd) if bd else poky_dir / "build"
+    if not path.exists():
+        pytest.skip(f"Build directory not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def meta_virt_dir(poky_dir):
+    path = poky_dir / "meta-virtualization"
+    if not path.exists():
+        pytest.skip(f"meta-virtualization not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def containerd_image(build_dir):
+    """Build container-image-host with containerd profile."""
+    result = _run_bitbake(
+        build_dir, "container-image-host",
+        extra_vars={"CONTAINER_PROFILE": "containerd"},
+    )
+    if result.returncode != 0:
+        pytest.fail(f"Containerd image build failed: {result.stderr}")
+
+
+@pytest.fixture(scope="module")
+def containerd_session(request, poky_dir, build_dir, containerd_image):
+    """Boot container-image-host with containerd and provide pexpect session."""
+    if not PEXPECT_AVAILABLE:
+        pytest.skip("pexpect not installed")
+
+    machine = request.config.getoption("--machine", default="qemux86-64")
+    timeout = int(request.config.getoption("--boot-timeout", default="120"))
+    no_kvm = request.config.getoption("--no-kvm", default=False)
+
+    kvm_opt = "" if no_kvm else "kvm"
+    cmd = (
+        f"bash -c 'cd {poky_dir} && "
+        f"source oe-init-build-env {build_dir} >/dev/null 2>&1 && "
+        f"runqemu {machine} container-image-host ext4 nographic slirp "
+        f"{kvm_opt} qemuparams=\"-m 2048\"'"
+    )
+
+    child = pexpect.spawn(cmd, encoding='utf-8', timeout=timeout)
+    child.logfile_read = open('/tmp/runqemu-containerd-test.log', 'w')
+
+    try:
+        index = child.expect([r'login:', r'root@', pexpect.TIMEOUT, pexpect.EOF],
+                             timeout=timeout)
+        if index == 0:
+            child.sendline('root')
+            child.expect([r'root@', r'#'], timeout=30)
+        elif index >= 2:
+            raise RuntimeError("Boot failed")
+
+        child.sendline('export TERM=dumb')
+        child.expect(r'root@[^:]+:[^#]+#', timeout=10)
+
+        yield child
+
+    except RuntimeError as e:
+        pytest.skip(f"Failed to boot: {e}")
+    finally:
+        child.sendline('poweroff')
+        try:
+            child.expect(pexpect.EOF, timeout=30)
+        except pexpect.TIMEOUT:
+            child.terminate(force=True)
+
+
+def run_cmd(child, cmd, timeout=60):
+    """Run a command and return (output, returncode)."""
+    marker = f"__MARKER_{time.monotonic_ns()}__"
+    child.sendline(f"{cmd}; echo {marker} $?")
+    child.expect(marker + r" (\d+)", timeout=timeout)
+    raw = child.before
+    raw = re.sub(r'\x1b\]3008;[^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)
+    raw = re.sub(r'\x1b\[[0-9;]*[A-Za-z]', '', raw)
+    output = raw.strip()
+    rc = int(child.match.group(1))
+    child.expect(r'root@[^:]+:[^#]+#', timeout=10)
+    return output, rc
+
+
+# ============================================================================
+# Tier 1: Static recipe assertions
+# ============================================================================
+
+class TestContainerdRecipeStatic:
+    """Static checks on containerd recipe."""
+
+    def test_recipe_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "recipes-containers" / "containerd" / "containerd_git.bb"
+        assert path.exists()
+
+    def test_provides_virtual_containerd(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "containerd" / "containerd_git.bb").read_text()
+        assert "virtual/containerd" in content or "virtual-containerd" in content
+
+    def test_systemd_service(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "containerd" / "containerd_git.bb").read_text()
+        assert "containerd.service" in content
+
+    def test_rdepends_container_runtime(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "containerd" / "containerd_git.bb").read_text()
+        assert "VIRTUAL-RUNTIME_container_runtime" in content
+
+    def test_cni_networking(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "containerd" / "containerd_git.bb").read_text()
+        assert "cni_networking" in content
+
+    def test_installs_ctr(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "containerd" / "containerd_git.bb").read_text()
+        assert "ctr" in content
+
+    def test_installs_shim(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "containerd" / "containerd_git.bb").read_text()
+        assert "containerd-shim-runc-v2" in content
+
+
+class TestContainerdProfileStatic:
+    """Static checks on containerd profile configuration."""
+
+    def test_profile_conf_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "conf" / "distro" / "include" / "container-host-containerd.conf"
+        assert path.exists()
+
+    def test_profile_sets_containerd(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "container-host-containerd.conf").read_text()
+        assert 'CONTAINER_PROFILE = "containerd"' in content
+
+    def test_profile_inc_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "conf" / "distro" / "include" / "meta-virt-container-containerd.inc"
+        assert path.exists()
+
+    def test_profile_engine_is_containerd(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "meta-virt-container-containerd.inc").read_text()
+        assert "containerd" in content
+        assert "VIRTUAL-RUNTIME_container_engine" in content
+
+    def test_packagegroup_containerd(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-core" / "packagegroups" / "packagegroup-container.bb").read_text()
+        assert "packagegroup-containerd" in content
+        assert "nerdctl" in content
+
+
+class TestNerdctlRecipeStatic:
+    """Static checks on nerdctl recipe."""
+
+    def test_recipe_exists(self, meta_virt_dir):
+        recipes = list((meta_virt_dir / "recipes-containers" / "nerdctl").glob("nerdctl_*.bb"))
+        assert len(recipes) >= 1, "nerdctl recipe not found"
+
+
+class TestCriToolsRecipeStatic:
+    """Static checks on cri-tools (crictl) recipe."""
+
+    def test_recipe_exists(self, meta_virt_dir):
+        recipes = list((meta_virt_dir / "recipes-containers" / "cri-tools").glob("cri-tools_*.bb"))
+        assert len(recipes) >= 1, "cri-tools recipe not found"
+
+
+class TestCriORecipeStatic:
+    """Static checks on CRI-O recipe."""
+
+    def test_recipe_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "recipes-containers" / "cri-o" / "cri-o_git.bb"
+        assert path.exists()
+
+    def test_requires_seccomp(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "cri-o" / "cri-o_git.bb").read_text()
+        assert "seccomp" in content
+        assert "REQUIRED_DISTRO_FEATURES" in content
+
+    def test_systemd_service(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "cri-o" / "cri-o_git.bb").read_text()
+        assert "crio.service" in content
+
+    def test_rdepends_cni(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "cri-o" / "cri-o_git.bb").read_text()
+        assert "cni" in content
+
+    def test_rdepends_conmon(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "cri-o" / "cri-o_git.bb").read_text()
+        assert "conmon" in content
+
+    def test_rdepends_runtime(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-containers" / "cri-o" / "cri-o_git.bb").read_text()
+        assert "VIRTUAL-RUNTIME_container_runtime" in content
+
+
+# ============================================================================
+# Tier 2: Build verification
+# ============================================================================
+
+@pytest.mark.slow
+class TestContainerdBuild:
+    """Build tests for containerd."""
+
+    def test_containerd_builds(self, build_dir):
+        result = _run_bitbake(build_dir, "containerd")
+        assert result.returncode == 0, f"containerd build failed: {result.stderr}"
+
+    def test_nerdctl_builds(self, build_dir):
+        result = _run_bitbake(build_dir, "nerdctl")
+        assert result.returncode == 0, f"nerdctl build failed: {result.stderr}"
+
+    def test_containerd_image_builds(self, build_dir, containerd_image):
+        """container-image-host with containerd profile builds (via fixture)."""
+        pass
+
+
+# ============================================================================
+# Tier 3: Boot tests — containerd
+# ============================================================================
+
+@pytest.mark.slow
+@pytest.mark.boot
+class TestContainerdRuntime:
+    """Boot tests for containerd on container-image-host."""
+
+    def test_containerd_running(self, containerd_session):
+        """containerd systemd service should be active."""
+        output, rc = run_cmd(containerd_session, "systemctl is-active containerd")
+        assert "active" in output, f"containerd not active: {output}"
+
+    def test_ctr_available(self, containerd_session):
+        """ctr command should be available."""
+        output, rc = run_cmd(containerd_session, "which ctr")
+        assert rc == 0, f"ctr not found: {output}"
+
+    def test_nerdctl_available(self, containerd_session):
+        """nerdctl command should be available."""
+        output, rc = run_cmd(containerd_session, "which nerdctl")
+        assert rc == 0, f"nerdctl not found: {output}"
+
+    def test_containerd_version(self, containerd_session):
+        """containerd should report its version."""
+        output, rc = run_cmd(containerd_session, "containerd --version")
+        assert rc == 0, f"containerd version failed: {output}"
+        assert "containerd" in output
+
+    def test_ctr_version(self, containerd_session):
+        """ctr should report its version."""
+        output, rc = run_cmd(containerd_session, "ctr version")
+        assert rc == 0, f"ctr version failed: {output}"
+
+    def test_ctr_namespaces(self, containerd_session):
+        """ctr should list namespaces."""
+        output, rc = run_cmd(containerd_session, "ctr namespaces list")
+        assert rc == 0, f"ctr namespaces list failed: {output}"
+        assert "NAME" in output, f"Unexpected namespaces output: {output}"
+
+    def test_runtime_available(self, containerd_session):
+        """Container runtime (runc/crun) should be installed."""
+        output, rc = run_cmd(containerd_session,
+                             "which crun 2>/dev/null || which runc 2>/dev/null")
+        assert rc == 0, f"No container runtime found: {output}"
+
+    def test_cni_plugins_installed(self, containerd_session):
+        """CNI plugins should be installed."""
+        output, rc = run_cmd(containerd_session, "ls /opt/cni/bin/bridge")
+        assert rc == 0, f"CNI bridge plugin not found: {output}"
+
+    def test_nerdctl_pull(self, containerd_session):
+        """nerdctl should be able to pull an image."""
+        output, rc = run_cmd(containerd_session,
+                             "nerdctl pull docker.io/library/busybox:latest",
+                             timeout=120)
+        assert rc == 0, f"nerdctl pull failed: {output}"
+
+    def test_nerdctl_run(self, containerd_session):
+        """nerdctl should run a container."""
+        output, rc = run_cmd(containerd_session,
+                             'nerdctl run --rm busybox:latest echo CONTAINERD_WORKS',
+                             timeout=60)
+        assert rc == 0, f"nerdctl run failed: {output}"
+        assert "CONTAINERD_WORKS" in output
+
+    def test_nerdctl_images(self, containerd_session):
+        """nerdctl images should show pulled images."""
+        output, rc = run_cmd(containerd_session, "nerdctl images")
+        assert rc == 0, f"nerdctl images failed: {output}"
+        assert "busybox" in output
+
+    def test_nerdctl_cleanup(self, containerd_session):
+        """Clean up test image."""
+        run_cmd(containerd_session, "nerdctl rmi busybox:latest", timeout=30)
diff --git a/tests/test_incus_runtime.py b/tests/test_incus_runtime.py
index 6de4bd5c..4314709b 100644
--- a/tests/test_incus_runtime.py
+++ b/tests/test_incus_runtime.py
@@ -5,15 +5,11 @@
 Incus runtime tests - boot container-image-host with incus and verify
 system container management.
 
-Build prerequisites (in local.conf):
-    require conf/distro/include/meta-virt-host.conf
-    require conf/distro/include/container-host-incus.conf
-    MACHINE = "qemux86-64"  # or qemuarm64
-
-    bitbake container-image-host
+The tests automatically build container-image-host with CONTAINER_PROFILE=incus
+before booting. No local.conf changes needed.
 
 Run:
-    pytest tests/test_incus_runtime.py -v --machine qemux86-64
+    pytest tests/test_incus_runtime.py -v --poky-dir /opt/bruce/poky
 
 Options:
     --boot-timeout      QEMU boot timeout (default: 120s)
@@ -22,8 +18,11 @@ Options:
 
 import os
 import re
+import subprocess
+import tempfile
 import time
 import pytest
+from pathlib import Path
 
 try:
     import pexpect
@@ -38,19 +37,60 @@ pytestmark = [
 ]
 
 
+def _run_bitbake(build_dir, recipe, extra_vars=None, timeout=3600):
+    """Run bitbake with optional variable overrides via -R conf file."""
+    bb_cmd = "bitbake"
+    conf_file = None
+    if extra_vars:
+        conf_file = tempfile.NamedTemporaryFile(
+            mode='w', suffix='.conf', prefix='pytest-incus-',
+            dir=str(build_dir / "conf"), delete=False)
+        for var, val in extra_vars.items():
+            conf_file.write(f'{var} = "{val}"\n')
+        conf_file.close()
+        bb_cmd += f" -R {conf_file.name}"
+    bb_cmd += f" {recipe}"
+    poky_dir = build_dir.parent
+    full_cmd = f"bash -c 'cd {poky_dir} && source oe-init-build-env {build_dir} >/dev/null 2>&1 && {bb_cmd}'"
+    try:
+        return subprocess.run(full_cmd, shell=True, cwd=build_dir,
+                              timeout=timeout, capture_output=True, text=True)
+    finally:
+        if conf_file:
+            os.unlink(conf_file.name)
+
+
+@pytest.fixture(scope="module")
+def incus_image(request):
+    """Build container-image-host with incus profile."""
+    poky_dir = Path(request.config.getoption("--poky-dir"))
+    bd = request.config.getoption("--build-dir")
+    build_dir = Path(bd) if bd else poky_dir / "build"
+    result = _run_bitbake(
+        build_dir, "container-image-host",
+        extra_vars={
+            "CONTAINER_PROFILE": "incus",
+        },
+    )
+    if result.returncode != 0:
+        pytest.fail(f"Incus image build failed: {result.stderr}")
+
+
 @pytest.fixture(scope="module")
-def incus_qemu(request):
-    """Boot a QEMU VM with incus and return the pexpect session."""
+def incus_qemu(request, incus_image):
+    """Build incus image, boot a QEMU VM, and return the pexpect session."""
     machine = request.config.getoption("--machine", default="qemux86-64")
     boot_timeout = int(request.config.getoption("--boot-timeout", default="120"))
     no_kvm = request.config.getoption("--no-kvm", default=False)
 
-    builddir = os.environ.get("BUILDDIR", os.path.expanduser("~/poky/build"))
+    poky_dir = Path(request.config.getoption("--poky-dir"))
+    bd = request.config.getoption("--build-dir")
+    builddir = str(Path(bd) if bd else poky_dir / "build")
 
     kvm_opt = "" if no_kvm else "kvm"
-    cmd = f"runqemu {machine} nographic slirp {kvm_opt} qemuparams=\"-m 4096\""
+    cmd = f"runqemu {machine} container-image-host ext4 nographic slirp {kvm_opt} qemuparams=\"-m 4096\""
 
-    child = pexpect.spawn(f"bash -c 'source {builddir}/oe-init-build-env {builddir} >/dev/null 2>&1 && {cmd}'",
+    child = pexpect.spawn(f"bash -c 'cd {poky_dir} && source oe-init-build-env {builddir} >/dev/null 2>&1 && {cmd}'",
                           timeout=boot_timeout, encoding="utf-8", logfile=None)
 
     # Wait for login prompt
diff --git a/tests/test_k3s_runtime.py b/tests/test_k3s_runtime.py
index aa0d443f..eb9600dd 100644
--- a/tests/test_k3s_runtime.py
+++ b/tests/test_k3s_runtime.py
@@ -8,22 +8,18 @@ Single-node tests verify k3s server start, node readiness, and basic pod
 deployment. Multi-node tests use QEMU socket networking to connect two VMs
 on a shared L2 segment and verify agent join + multi-node scheduling.
 
-Build prerequisites (in local.conf):
-    require conf/distro/include/meta-virt-host.conf
-    require conf/distro/include/container-host-k3s.conf
-    MACHINE = "qemux86-64"  # or qemuarm64
-
-    bitbake container-image-host
+The tests automatically build container-image-host with CONTAINER_PROFILE=k3s-host
+before booting. No local.conf changes needed.
 
 Run:
     # Single-node only
-    pytest tests/test_k3s_runtime.py -v -k "not multinode" --machine qemux86-64
+    pytest tests/test_k3s_runtime.py -v -k "not multinode" --poky-dir /opt/bruce/poky
 
     # Multi-node only
-    pytest tests/test_k3s_runtime.py -v -k "multinode" --machine qemux86-64
+    pytest tests/test_k3s_runtime.py -v -k "multinode" --poky-dir /opt/bruce/poky
 
     # All tests
-    pytest tests/test_k3s_runtime.py -v --machine qemux86-64
+    pytest tests/test_k3s_runtime.py -v --poky-dir /opt/bruce/poky
 
 Options:
     --k3s-timeout       Overall k3s readiness timeout (default: 300s)
@@ -43,6 +39,8 @@ Notes:
 import os
 import re
 import shutil
+import subprocess
+import tempfile
 import time
 import pytest
 from pathlib import Path
@@ -290,6 +288,39 @@ class K3sRunner:
 # Fixtures
 # ============================================================================
 
+def run_bitbake(build_dir, recipe, extra_vars=None, timeout=3600):
+    """Run a bitbake command within the Yocto environment."""
+    import tempfile
+
+    bb_cmd = "bitbake"
+
+    conf_file = None
+    if extra_vars:
+        conf_file = tempfile.NamedTemporaryFile(
+            mode='w', suffix='.conf', prefix='pytest-k3s-',
+            dir=str(build_dir / "conf"), delete=False)
+        for var, val in extra_vars.items():
+            conf_file.write(f'{var} = "{val}"\n')
+        conf_file.close()
+        bb_cmd += f" -R {conf_file.name}"
+
+    bb_cmd += f" {recipe}"
+
+    poky_dir = build_dir.parent
+    full_cmd = f"bash -c 'cd {poky_dir} && source oe-init-build-env {build_dir} >/dev/null 2>&1 && {bb_cmd}'"
+
+    try:
+        result = subprocess.run(
+            full_cmd, shell=True, cwd=build_dir,
+            timeout=timeout, capture_output=True, text=True,
+        )
+    finally:
+        if conf_file:
+            os.unlink(conf_file.name)
+
+    return result
+
+
 @pytest.fixture(scope="module")
 def poky_dir(request):
     """Path to poky directory."""
@@ -325,20 +356,28 @@ def k3s_timeout(request):
 
 
 @pytest.fixture(scope="module")
-def k3s_session(request, poky_dir, build_dir, machine):
+def k3s_image(build_dir):
+    """Build container-image-host with k3s profile."""
+    result = run_bitbake(
+        build_dir, "container-image-host",
+        extra_vars={
+            "CONTAINER_PROFILE": "k3s-host",
+            "DISTRO_FEATURES:append": " k3s",
+        },
+    )
+    if result.returncode != 0:
+        pytest.fail(f"K3s image build failed: {result.stderr}")
+
+
+@pytest.fixture(scope="module")
+def k3s_session(request, poky_dir, build_dir, machine, k3s_image):
     """
-    Module-scoped fixture that boots container-image-host once for all
-    single-node k3s tests. Uses runqemu for single-node tests.
+    Module-scoped fixture that builds container-image-host with k3s profile,
+    boots it, and provides a session for all single-node k3s tests.
     """
     if not PEXPECT_AVAILABLE:
         pytest.skip("pexpect not installed. Run: pip install pexpect")
 
-    deploy_dir = build_dir / "tmp" / "deploy" / "images" / machine
-    ext4_files = list(deploy_dir.glob("container-image-host-*.rootfs.ext4"))
-    if not ext4_files:
-        pytest.skip(
-            f"container-image-host ext4 image not found in {deploy_dir}")
-
     timeout = request.config.getoption("--boot-timeout")
     use_kvm = not request.config.getoption("--no-kvm")
 
@@ -356,10 +395,10 @@ def k3s_session(request, poky_dir, build_dir, machine):
 
 
 @pytest.fixture(scope="module")
-def k3s_multinode(request, poky_dir, build_dir, machine):
+def k3s_multinode(request, poky_dir, build_dir, machine, k3s_image):
     """
-    Module-scoped fixture that boots two VMs connected via QEMU socket
-    networking for multi-node k3s testing.
+    Module-scoped fixture that builds with k3s profile, then boots two VMs
+    connected via QEMU socket networking for multi-node k3s testing.
 
     Uses direct QEMU launch (not runqemu) since runqemu can only run
     one VM at a time. Creates a copy of the rootfs for the agent VM.
@@ -380,9 +419,13 @@ def k3s_multinode(request, poky_dir, build_dir, machine):
 
     rootfs_orig = ext4_files[-1]
 
-    # Create a copy of the rootfs for the agent VM — two VMs can't
-    # share the same ext4 file read-write
+    # Both VMs need their own rootfs copy — the original may still be
+    # locked by a previous runqemu session (single-node test), and two
+    # VMs can't share the same ext4 file read-write.
+    rootfs_server = Path(f"/tmp/k3s-server-rootfs-{os.getpid()}.ext4")
     rootfs_agent = Path(f"/tmp/k3s-agent-rootfs-{os.getpid()}.ext4")
+    print(f"Copying rootfs for server VM: {rootfs_orig} -> {rootfs_server}")
+    shutil.copy2(rootfs_orig, rootfs_server)
     print(f"Copying rootfs for agent VM: {rootfs_orig} -> {rootfs_agent}")
     shutil.copy2(rootfs_orig, rootfs_agent)
 
@@ -399,7 +442,7 @@ def k3s_multinode(request, poky_dir, build_dir, machine):
                        use_kvm=use_kvm, timeout=timeout,
                        extra_qemu_params=server_params,
                        use_runqemu=False,
-                       rootfs_path=rootfs_orig,
+                       rootfs_path=rootfs_server,
                        kernel_append="k3s.role=server k3s.node-ip=192.168.50.1",
                        log_suffix="-server")
 
@@ -415,6 +458,7 @@ def k3s_multinode(request, poky_dir, build_dir, machine):
                       rootfs_path=rootfs_agent,
                       kernel_append="k3s.role=agent k3s.node-ip=192.168.50.2 k3s.node-name=k3s-agent",
                       log_suffix="-agent")
+    server._rootfs_copy = str(rootfs_server)
     agent._rootfs_copy = str(rootfs_agent)
 
     try:
diff --git a/tests/test_libvirt.py b/tests/test_libvirt.py
new file mode 100644
index 00000000..442df8c3
--- /dev/null
+++ b/tests/test_libvirt.py
@@ -0,0 +1,468 @@
+# SPDX-FileCopyrightText: Copyright (C) 2026 Bruce Ashfield
+#
+# SPDX-License-Identifier: MIT
+"""
+Libvirt recipe and runtime tests.
+
+Tier 1: Static assertions on recipe files (no build required)
+Tier 2: Build verification (requires bitbake)
+Tier 3: Boot tests on kvm-image-minimal (requires QEMU with KVM)
+
+The tests automatically build kvm-image-minimal with the kvm
+DISTRO_FEATURE before booting. No local.conf changes needed.
+
+Run:
+    # Static tests only
+    pytest tests/test_libvirt.py -v -m "not slow and not boot" --poky-dir /opt/bruce/poky
+
+    # All tests including build and boot
+    pytest tests/test_libvirt.py -v --poky-dir /opt/bruce/poky
+
+Options:
+    --boot-timeout      QEMU boot timeout (default: 120s)
+    --no-kvm            Disable KVM acceleration
+"""
+
+import os
+import re
+import subprocess
+import tempfile
+import time
+import pytest
+from pathlib import Path
+
+try:
+    import pexpect
+    PEXPECT_AVAILABLE = True
+except ImportError:
+    PEXPECT_AVAILABLE = False
+
+
+def _run_bitbake(build_dir, recipe, extra_vars=None, timeout=3600):
+    """Run bitbake with optional variable overrides via -R conf file."""
+    bb_cmd = "bitbake"
+    conf_file = None
+    if extra_vars:
+        conf_file = tempfile.NamedTemporaryFile(
+            mode='w', suffix='.conf', prefix='pytest-libvirt-',
+            dir=str(build_dir / "conf"), delete=False)
+        for var, val in extra_vars.items():
+            conf_file.write(f'{var} = "{val}"\n')
+        conf_file.close()
+        bb_cmd += f" -R {conf_file.name}"
+    bb_cmd += f" {recipe}"
+    poky_dir = build_dir.parent
+    full_cmd = f"bash -c 'cd {poky_dir} && source oe-init-build-env {build_dir} >/dev/null 2>&1 && {bb_cmd}'"
+    try:
+        return subprocess.run(full_cmd, shell=True, cwd=build_dir,
+                              timeout=timeout, capture_output=True, text=True)
+    finally:
+        if conf_file:
+            os.unlink(conf_file.name)
+
+
+# ============================================================================
+# Fixtures
+# ============================================================================
+
+@pytest.fixture(scope="module")
+def poky_dir(request):
+    path = Path(request.config.getoption("--poky-dir"))
+    if not path.exists():
+        pytest.skip(f"Poky directory not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def build_dir(request, poky_dir):
+    bd = request.config.getoption("--build-dir")
+    path = Path(bd) if bd else poky_dir / "build"
+    if not path.exists():
+        pytest.skip(f"Build directory not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def meta_virt_dir(poky_dir):
+    path = poky_dir / "meta-virtualization"
+    if not path.exists():
+        pytest.skip(f"meta-virtualization not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def libvirt_recipe(meta_virt_dir):
+    path = meta_virt_dir / "recipes-extended" / "libvirt" / "libvirt_git.bb"
+    if not path.exists():
+        pytest.skip(f"libvirt recipe not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def libvirt_files_dir(meta_virt_dir):
+    path = meta_virt_dir / "recipes-extended" / "libvirt" / "libvirt"
+    if not path.exists():
+        pytest.skip(f"libvirt files dir not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def kvm_image(build_dir):
+    """Build kvm-image-minimal with kvm DISTRO_FEATURE."""
+    result = _run_bitbake(
+        build_dir, "kvm-image-minimal",
+        extra_vars={
+            "DISTRO_FEATURES:append": " kvm",
+        },
+    )
+    if result.returncode != 0:
+        pytest.fail(f"KVM image build failed: {result.stderr}")
+
+
+@pytest.fixture(scope="module")
+def libvirt_session(request, poky_dir, build_dir, kvm_image):
+    """Boot kvm-image-minimal and provide a pexpect session."""
+    if not PEXPECT_AVAILABLE:
+        pytest.skip("pexpect not installed")
+
+    machine = request.config.getoption("--machine", default="qemux86-64")
+    timeout = int(request.config.getoption("--boot-timeout", default="120"))
+    no_kvm = request.config.getoption("--no-kvm", default=False)
+
+    kvm_opt = "" if no_kvm else "kvm"
+    cmd = (
+        f"bash -c 'cd {poky_dir} && "
+        f"source oe-init-build-env {build_dir} >/dev/null 2>&1 && "
+        f"runqemu {machine} kvm-image-minimal ext4 nographic slirp "
+        f"{kvm_opt} qemuparams=\"-m 2048\"'"
+    )
+
+    child = pexpect.spawn(cmd, encoding='utf-8', timeout=timeout)
+    child.logfile_read = open('/tmp/runqemu-libvirt-test.log', 'w')
+
+    try:
+        index = child.expect([r'login:', r'root@', pexpect.TIMEOUT, pexpect.EOF],
+                             timeout=timeout)
+        if index == 0:
+            child.sendline('root')
+            child.expect([r'root@', r'#'], timeout=30)
+        elif index >= 2:
+            raise RuntimeError("Boot failed")
+
+        child.sendline('export TERM=dumb')
+        child.expect(r'root@[^:]+:[^#]+#', timeout=10)
+
+        yield child
+
+    except RuntimeError as e:
+        pytest.skip(f"Failed to boot: {e}")
+    finally:
+        child.sendline('poweroff')
+        try:
+            child.expect(pexpect.EOF, timeout=30)
+        except pexpect.TIMEOUT:
+            child.terminate(force=True)
+
+
+def run_cmd(child, cmd, timeout=60):
+    """Run a command and return (output, returncode)."""
+    marker = f"__MARKER_{time.monotonic_ns()}__"
+    child.sendline(f"{cmd}; echo {marker} $?")
+    child.expect(marker + r" (\d+)", timeout=timeout)
+    raw = child.before
+    raw = re.sub(r'\x1b\]3008;[^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)
+    raw = re.sub(r'\x1b\[[0-9;]*[A-Za-z]', '', raw)
+    output = raw.strip()
+    rc = int(child.match.group(1))
+    child.expect(r'root@[^:]+:[^#]+#', timeout=10)
+    return output, rc
+
+
+# ============================================================================
+# Tier 1: Static assertions (no build required)
+# ============================================================================
+
+class TestLibvirtRecipeStatic:
+    """Static checks on the libvirt recipe file."""
+
+    def test_recipe_exists(self, libvirt_recipe):
+        assert libvirt_recipe.exists()
+
+    def test_has_meson_inherit(self, libvirt_recipe):
+        content = libvirt_recipe.read_text()
+        assert "inherit meson" in content
+
+    def test_has_systemd_support(self, libvirt_recipe):
+        content = libvirt_recipe.read_text()
+        assert "inherit" in content and "systemd" in content
+        assert "SYSTEMD_SERVICE" in content
+
+    def test_systemd_services_defined(self, libvirt_recipe):
+        content = libvirt_recipe.read_text()
+        assert "libvirtd.service" in content
+        assert "virtlockd.service" in content
+
+    def test_has_useradd(self, libvirt_recipe):
+        content = libvirt_recipe.read_text()
+        assert "inherit" in content and "useradd" in content
+        assert "qemu" in content
+        assert "libvirt" in content
+
+    def test_qemu_packageconfig(self, libvirt_recipe):
+        content = libvirt_recipe.read_text()
+        assert "PACKAGECONFIG[qemu]" in content
+        assert "driver_qemu" in content
+
+    def test_lxc_packageconfig(self, libvirt_recipe):
+        content = libvirt_recipe.read_text()
+        assert "PACKAGECONFIG[lxc]" in content
+        assert "driver_lxc" in content
+
+    def test_xen_packageconfig_gated(self, libvirt_recipe):
+        """libxl PACKAGECONFIG should be gated on xen DISTRO_FEATURE."""
+        content = libvirt_recipe.read_text()
+        assert "PACKAGECONFIG[libxl]" in content
+        for line in content.splitlines():
+            if "libxl" in line and "DISTRO_FEATURES" in line:
+                assert "xen" in line
+                break
+        else:
+            pytest.fail("libxl PACKAGECONFIG not gated on xen DISTRO_FEATURE")
+
+    def test_nftables_rdepends(self, libvirt_recipe):
+        """libvirt-libvirtd should RDEPEND on nftables when configured."""
+        content = libvirt_recipe.read_text()
+        assert "nftables" in content
+
+    def test_nftables_or_iptables_rdepends(self, libvirt_recipe):
+        """RDEPENDS should select nftables or iptables based on PACKAGECONFIG."""
+        content = libvirt_recipe.read_text()
+        assert "bb.utils.contains('PACKAGECONFIG', 'nftables'" in content, \
+            "RDEPENDS should conditionally select nftables or iptables"
+
+    def test_packages_split(self, libvirt_recipe):
+        """Recipe should split into libvirt, libvirt-libvirtd, libvirt-virsh."""
+        content = libvirt_recipe.read_text()
+        assert "${PN}-libvirtd" in content
+        assert "${PN}-virsh" in content
+
+    def test_cve_status_entries(self, libvirt_recipe):
+        content = libvirt_recipe.read_text()
+        assert "CVE_STATUS" in content
+        cve_count = content.count("CVE_STATUS[CVE-")
+        assert cve_count >= 5, f"Expected at least 5 CVE entries, found {cve_count}"
+
+
+class TestLibvirtHookSupport:
+    """Tests for hook_support.py (the file from the recent bug report)."""
+
+    def test_hook_script_exists(self, libvirt_files_dir):
+        path = libvirt_files_dir / "hook_support.py"
+        assert path.exists()
+
+    def test_hook_script_python3_shebang(self, libvirt_files_dir):
+        content = (libvirt_files_dir / "hook_support.py").read_text()
+        first_line = content.splitlines()[0]
+        assert "python3" in first_line or "python" in first_line
+
+    def test_hook_script_uses_text_mode(self, libvirt_files_dir):
+        """Popen should use text=True for python3 string compatibility."""
+        content = (libvirt_files_dir / "hook_support.py").read_text()
+        assert "text=True" in content, \
+            "Popen should use text=True for python3 string/bytes compatibility"
+
+    def test_hook_script_regex_raw_string(self, libvirt_files_dir):
+        """Regex should use raw string to avoid SyntaxWarning in python3.12+."""
+        content = (libvirt_files_dir / "hook_support.py").read_text()
+        for line in content.splitlines():
+            if "re.compile" in line and "\\w" in line:
+                assert "rf\"" in line or "r'" in line or 'r"' in line, \
+                    f"Regex with \\w should use raw string: {line.strip()}"
+
+    def test_hook_script_syntax_valid(self, libvirt_files_dir):
+        """hook_support.py should parse without syntax errors."""
+        import py_compile
+        path = libvirt_files_dir / "hook_support.py"
+        try:
+            py_compile.compile(str(path), doraise=True)
+        except py_compile.PyCompileError as e:
+            pytest.fail(f"Syntax error in hook_support.py: {e}")
+
+    def test_hook_installs_for_all_domains(self, libvirt_recipe):
+        """hook_support.py should be installed for daemon, lxc, network, qemu."""
+        content = libvirt_recipe.read_text()
+        for hook in ["daemon", "lxc", "network", "qemu"]:
+            assert hook in content, f"Hook not installed for domain: {hook}"
+
+
+class TestLibvirtServiceFiles:
+    """Tests for systemd service and init script files."""
+
+    def test_initscript_exists(self, libvirt_files_dir):
+        assert (libvirt_files_dir / "libvirtd.sh").exists()
+
+    def test_initscript_has_lsb_header(self, libvirt_files_dir):
+        content = (libvirt_files_dir / "libvirtd.sh").read_text()
+        assert "BEGIN INIT INFO" in content
+
+    def test_initscript_start_stop(self, libvirt_files_dir):
+        content = (libvirt_files_dir / "libvirtd.sh").read_text()
+        assert "start)" in content
+        assert "stop)" in content
+        assert "restart)" in content
+
+    def test_dnsmasq_conf_exists(self, libvirt_files_dir):
+        assert (libvirt_files_dir / "dnsmasq.conf").exists()
+
+    def test_libvirtd_conf_exists(self, libvirt_files_dir):
+        assert (libvirt_files_dir / "libvirtd.conf").exists()
+
+    def test_gnutls_helper_exists(self, libvirt_files_dir):
+        assert (libvirt_files_dir / "gnutls-helper.py").exists()
+
+
+class TestLibvirtPatchFiles:
+    """Verify patches exist and reference valid upstream issues."""
+
+    def test_patches_exist(self, libvirt_files_dir):
+        patches = list(libvirt_files_dir.glob("*.patch"))
+        assert len(patches) >= 1, "Expected at least one patch"
+
+    def test_buildpath_patches_present(self, libvirt_files_dir):
+        """Patches for buildpaths should exist."""
+        patches = list(libvirt_files_dir.glob("*.patch"))
+        buildpath_patches = [p for p in patches if "build-path" in p.name
+                             or "build_path" in p.name or "gendispatch" in p.name]
+        assert len(buildpath_patches) >= 1, \
+            "Expected at least one buildpath-related patch"
+
+
+class TestKvmImageRecipe:
+    """Static checks on kvm-image-minimal recipe."""
+
+    def test_recipe_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "recipes-extended" / "images" / "kvm-image-minimal.bb"
+        assert path.exists()
+
+    def test_requires_kvm_distro_feature(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-extended" / "images" / "kvm-image-minimal.bb").read_text()
+        assert "kvm" in content
+        assert "REQUIRED_DISTRO_FEATURES" in content
+
+    def test_includes_libvirt(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-extended" / "images" / "kvm-image-minimal.bb").read_text()
+        assert "libvirt" in content
+        assert "libvirt-libvirtd" in content
+        assert "libvirt-virsh" in content
+
+    def test_includes_qemu(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-extended" / "images" / "kvm-image-minimal.bb").read_text()
+        assert "qemu" in content
+
+    def test_includes_kvm_modules(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-extended" / "images" / "kvm-image-minimal.bb").read_text()
+        assert "kernel-module-kvm" in content
+
+
+# ============================================================================
+# Tier 2: Build verification (requires bitbake)
+# ============================================================================
+
+@pytest.mark.slow
+class TestLibvirtBuild:
+    """Build tests for libvirt recipe."""
+
+    def test_libvirt_builds(self, build_dir):
+        result = _run_bitbake(build_dir, "libvirt")
+        assert result.returncode == 0, f"libvirt build failed: {result.stderr}"
+
+    def test_kvm_image_builds(self, build_dir, kvm_image):
+        """kvm-image-minimal builds successfully (via kvm_image fixture)."""
+        pass
+
+
+# ============================================================================
+# Tier 3: Boot tests (requires QEMU)
+# ============================================================================
+
+# Libvirt v12 defaults to modular daemons (virtqemud, virtnetworkd, etc.)
+# but kvm-image-minimal runs the monolithic libvirtd. virsh must be pointed
+# at the monolithic socket explicitly.
+_VIRSH = "virsh -c qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock"
+
+
+@pytest.mark.slow
+@pytest.mark.boot
+class TestLibvirtRuntime:
+    """Boot tests verifying libvirt on a running kvm-image-minimal."""
+
+    def test_libvirtd_running(self, libvirt_session):
+        """libvirtd systemd service should be active."""
+        output, rc = run_cmd(libvirt_session, "systemctl is-active libvirtd")
+        assert "active" in output, f"libvirtd not active: {output}"
+
+    def test_virtlockd_running(self, libvirt_session):
+        """virtlockd should be active (started on demand via socket)."""
+        output, rc = run_cmd(libvirt_session,
+                             "systemctl is-active virtlockd.socket")
+        assert "active" in output, f"virtlockd.socket not active: {output}"
+
+    def test_virsh_available(self, libvirt_session):
+        """virsh command should be available."""
+        output, rc = run_cmd(libvirt_session, "which virsh")
+        assert rc == 0, f"virsh not found: {output}"
+
+    def test_virsh_version(self, libvirt_session):
+        """virsh version should report libvirt version."""
+        output, rc = run_cmd(libvirt_session, "virsh --version")
+        assert rc == 0, f"virsh version failed: {output}"
+
+    def test_virsh_connect(self, libvirt_session):
+        """virsh should connect to local libvirtd."""
+        output, rc = run_cmd(libvirt_session, f"{_VIRSH} uri")
+        assert rc == 0, f"virsh uri failed: {output}"
+
+    def test_virsh_capabilities(self, libvirt_session):
+        """virsh capabilities should return valid XML."""
+        output, rc = run_cmd(libvirt_session, f"{_VIRSH} capabilities")
+        assert rc == 0, f"virsh capabilities failed: {output}"
+        assert "<capabilities>" in output or "capabilities" in output
+
+    def test_virsh_nodeinfo(self, libvirt_session):
+        """virsh nodeinfo should report system info."""
+        output, rc = run_cmd(libvirt_session, f"{_VIRSH} nodeinfo")
+        assert rc == 0, f"virsh nodeinfo failed: {output}"
+        assert "CPU model" in output or "cpu" in output.lower()
+
+    def test_virsh_list(self, libvirt_session):
+        """virsh list should work (even with no domains)."""
+        output, rc = run_cmd(libvirt_session, f"{_VIRSH} list --all")
+        assert rc == 0, f"virsh list failed: {output}"
+
+    def test_default_network(self, libvirt_session):
+        """Default network should be defined."""
+        output, rc = run_cmd(libvirt_session, f"{_VIRSH} net-list --all")
+        assert rc == 0, f"virsh net-list failed: {output}"
+
+    def test_hook_scripts_installed(self, libvirt_session):
+        """Hook scripts should be installed for all domains."""
+        output, rc = run_cmd(libvirt_session, "ls /etc/libvirt/hooks/")
+        assert rc == 0
+        for hook in ["daemon", "lxc", "network", "qemu"]:
+            assert hook in output, f"Hook script missing: {hook}"
+
+    def test_hook_scripts_executable(self, libvirt_session):
+        """Hook scripts should be executable."""
+        output, rc = run_cmd(libvirt_session,
+                             "test -x /etc/libvirt/hooks/qemu && echo OK")
+        assert "OK" in output, "qemu hook not executable"
+
+    def test_qemu_user_exists(self, libvirt_session):
+        """qemu user should exist (created by useradd in recipe)."""
+        output, rc = run_cmd(libvirt_session, "grep ^qemu: /etc/passwd")
+        assert rc == 0, f"qemu user not found: {output}"
+
+    def test_libvirt_group_exists(self, libvirt_session):
+        """libvirt group should exist."""
+        output, rc = run_cmd(libvirt_session, "grep ^libvirt: /etc/group")
+        assert rc == 0, f"libvirt group not found: {output}"
diff --git a/tests/test_lxc_runtime.py b/tests/test_lxc_runtime.py
new file mode 100644
index 00000000..695cfeb7
--- /dev/null
+++ b/tests/test_lxc_runtime.py
@@ -0,0 +1,290 @@
+# SPDX-FileCopyrightText: Copyright (C) 2026 Bruce Ashfield
+#
+# SPDX-License-Identifier: MIT
+"""
+LXC runtime tests — boot container-image-host with lxc installed and
+exercise the LXC command-line lifecycle (create, start, attach, stop,
+destroy).
+
+The tests build container-image-host with CONTAINER_IMAGE_HOST_EXTRA_INSTALL
+including lxc. No local.conf changes needed.
+
+The download-template regression check (TestLxcDownloadTemplate) exists
+specifically to catch the class of bug reported on the meta-virt list
+on 2026-06-13 (Ferry Toth: "lxc: starting a container errors out"),
+where a stale local patch to templates/lxc-download.in expanded an empty
+${DOWNLOAD_TEMP} into `mktemp -p -d` and broke the download path before
+any network call. The test invokes lxc-create with the download template
+and asserts that the early mktemp error does not appear in the output,
+even if the actual download itself fails (e.g. no network in the test
+environment). That keeps the regression test useful in air-gapped CI
+without requiring outbound network from the qemu guest.
+
+Run:
+    pytest tests/test_lxc_runtime.py -v --poky-dir /opt/bruce/poky
+
+Options:
+    --boot-timeout      QEMU boot timeout (default: 120s)
+    --no-kvm            Disable KVM acceleration
+    --machine           QEMU MACHINE (default: qemux86-64)
+"""
+
+import os
+import subprocess
+import tempfile
+import time
+from pathlib import Path
+
+import pytest
+
+try:
+    import pexpect
+    PEXPECT_AVAILABLE = True
+except ImportError:
+    PEXPECT_AVAILABLE = False
+
+
+pytestmark = [
+    pytest.mark.skipif(not PEXPECT_AVAILABLE, reason="pexpect not installed"),
+    pytest.mark.lxc,
+    pytest.mark.boot,
+]
+
+
+# ---------------------------------------------------------------------------
+# Helpers (mirror test_incus_runtime.py conventions so the suites read alike)
+# ---------------------------------------------------------------------------
+
+def _run_bitbake(build_dir, recipe, extra_vars=None, timeout=3600):
+    """Run bitbake with optional variable overrides via -R conf file."""
+    bb_cmd = "bitbake"
+    conf_file = None
+    if extra_vars:
+        conf_file = tempfile.NamedTemporaryFile(
+            mode='w', suffix='.conf', prefix='pytest-lxc-',
+            dir=str(build_dir / "conf"), delete=False)
+        for var, val in extra_vars.items():
+            conf_file.write(f'{var} = "{val}"\n')
+        conf_file.close()
+        bb_cmd += f" -R {conf_file.name}"
+    bb_cmd += f" {recipe}"
+    poky_dir = build_dir.parent
+    full_cmd = (
+        f"bash -c 'cd {poky_dir} && "
+        f"source oe-init-build-env {build_dir} >/dev/null 2>&1 && {bb_cmd}'"
+    )
+    try:
+        return subprocess.run(full_cmd, shell=True, cwd=build_dir,
+                              timeout=timeout, capture_output=True, text=True)
+    finally:
+        if conf_file:
+            os.unlink(conf_file.name)
+
+
+# ---------------------------------------------------------------------------
+# Fixtures
+# ---------------------------------------------------------------------------
+
+@pytest.fixture(scope="module")
+def lxc_image(request):
+    """Build container-image-host with lxc included.
+
+    Uses CONTAINER_IMAGE_HOST_EXTRA_INSTALL to add the lxc package without
+    needing to touch local.conf or invent a dedicated container-host-lxc
+    profile fragment.
+    """
+    poky_dir = Path(request.config.getoption("--poky-dir"))
+    bd = request.config.getoption("--build-dir")
+    build_dir = Path(bd) if bd else poky_dir / "build"
+    result = _run_bitbake(
+        build_dir, "container-image-host",
+        extra_vars={
+            "CONTAINER_IMAGE_HOST_EXTRA_INSTALL": "lxc",
+        },
+    )
+    if result.returncode != 0:
+        pytest.fail(f"container-image-host with lxc failed to build: {result.stderr}")
+
+
+@pytest.fixture(scope="module")
+def lxc_qemu(request, lxc_image):
+    """Boot container-image-host in QEMU, return a logged-in pexpect session."""
+    machine = request.config.getoption("--machine", default="qemux86-64")
+    boot_timeout = int(request.config.getoption("--boot-timeout", default="120"))
+    no_kvm = request.config.getoption("--no-kvm", default=False)
+
+    poky_dir = Path(request.config.getoption("--poky-dir"))
+    bd = request.config.getoption("--build-dir")
+    builddir = str(Path(bd) if bd else poky_dir / "build")
+
+    kvm_opt = "" if no_kvm else "kvm"
+    cmd = (
+        f"runqemu {machine} container-image-host ext4 nographic slirp "
+        f"{kvm_opt} qemuparams=\"-m 4096\""
+    )
+
+    child = pexpect.spawn(
+        f"bash -c 'cd {poky_dir} && source oe-init-build-env {builddir} "
+        f">/dev/null 2>&1 && {cmd}'",
+        timeout=boot_timeout, encoding="utf-8", logfile=None,
+    )
+
+    child.expect(r"login:", timeout=boot_timeout)
+    child.sendline("root")
+    child.expect(r"root@.*[:~#]", timeout=30)
+
+    # Suppress shell-integration escape sequences that interfere with
+    # pexpect matchers (same trick as test_incus_runtime / test_xen_runtime).
+    child.sendline("export TERM=dumb")
+    child.expect(r"root@.*[:~#]", timeout=10)
+
+    yield child
+
+    child.sendline("poweroff")
+    try:
+        child.expect(pexpect.EOF, timeout=30)
+    except pexpect.TIMEOUT:
+        child.terminate(force=True)
+
+
+def run_cmd(child, cmd, timeout=60):
+    """Run a shell command in the guest and return (stdout, rc)."""
+    marker = f"__MARKER_{time.monotonic_ns()}__"
+    child.sendline(f"{cmd}; echo {marker} $?")
+    child.expect(marker + r" (\d+)", timeout=timeout)
+    output = child.before.strip()
+    rc = int(child.match.group(1))
+    child.expect(r"root@.*[:~#]", timeout=10)
+    return output, rc
+
+
+# ---------------------------------------------------------------------------
+# Sanity — lxc tooling present and functional
+# ---------------------------------------------------------------------------
+
+class TestLxcInstalled:
+    """Confirm lxc is installed and the basic commands report a version."""
+
+    def test_lxc_create_present(self, lxc_qemu):
+        output, rc = run_cmd(lxc_qemu, "command -v lxc-create")
+        assert rc == 0, f"lxc-create not installed: {output}"
+
+    def test_lxc_start_present(self, lxc_qemu):
+        output, rc = run_cmd(lxc_qemu, "command -v lxc-start")
+        assert rc == 0, f"lxc-start not installed: {output}"
+
+    def test_lxc_version(self, lxc_qemu):
+        output, rc = run_cmd(lxc_qemu, "lxc-create --version")
+        assert rc == 0, f"lxc-create --version failed: {output}"
+
+
+# ---------------------------------------------------------------------------
+# Regression: the lxc-download.in mktemp bug from list thread #11808
+# ---------------------------------------------------------------------------
+
+class TestLxcDownloadTemplate:
+    """Regression for the templates-actually-create-DOWNLOAD_TEMP-directory
+    patch breakage.
+
+    The bug was: when ${DOWNLOAD_TEMP} is unset (the common case for
+    `lxc-create --template download`), the patched else branch expanded
+    to `mktemp -p  -d`, which the shell parses as `-d` being the argument
+    to `-p` rather than its own flag. mktemp then reports:
+
+        mktemp: failed to create file via template '-d/tmp.XXXXXXXXXX':
+        No such file or directory
+
+    and lxc-create exits before any network call.
+
+    We don't care whether the download itself succeeds here — in a test
+    environment without outbound network, it won't, and that's fine.
+    We only care that the early mktemp parse never happens. If it does,
+    that *exact* error string surfaces, and that string failing to appear
+    is what we assert.
+    """
+
+    BAD_MKTEMP_ERROR = "mktemp: failed to create file via template '-d"
+
+    def test_download_template_no_mktemp_error(self, lxc_qemu):
+        """lxc-create with the download template must not emit the broken
+        mktemp invocation even when the actual download fails."""
+        # The specific dist/release/arch values don't matter — even an
+        # invalid combination still exercises the early mktemp path
+        # before any HTTP request. We pick a plausibly-real combo so the
+        # test stays meaningful if a future change adds an early
+        # validation step on the args.
+        cmd = (
+            "lxc-create --name test-download --template download -- "
+            "--dist ubuntu --release noble --arch amd64 2>&1"
+        )
+        output, _rc = run_cmd(lxc_qemu, cmd, timeout=120)
+        assert self.BAD_MKTEMP_ERROR not in output, (
+            f"lxc-download.in DOWNLOAD_TEMP regression — early mktemp error "
+            f"surfaced.\nFull output:\n{output}"
+        )
+        # Clean up whatever partial state lxc-create may have left behind
+        # so the next test starts clean. Ignore rc — there may be nothing
+        # to destroy.
+        run_cmd(lxc_qemu, "lxc-destroy --name test-download --force", timeout=30)
+
+
+# ---------------------------------------------------------------------------
+# Network-required path — exercise the full download+create flow
+# ---------------------------------------------------------------------------
+
+@pytest.mark.network
+class TestLxcContainerLifecycle:
+    """End-to-end create/start/attach/stop/destroy against a real download.
+
+    Marked @network because lxc-create --template download fetches from
+    images.linuxcontainers.org. Skipped on offline runners. The regression
+    test above runs without network and is the primary guard against
+    Ferry's bug.
+    """
+
+    NAME = "test-lxc-lifecycle"
+
+    def test_create_alpine_via_download(self, lxc_qemu):
+        cmd = (
+            f"lxc-create --name {self.NAME} --template download -- "
+            f"--dist alpine --release edge --arch amd64"
+        )
+        output, rc = run_cmd(lxc_qemu, cmd, timeout=600)
+        if rc != 0:
+            pytest.skip(
+                f"lxc-create download failed (likely network unreachable): "
+                f"{output[:400]}"
+            )
+
+    def test_start(self, lxc_qemu):
+        output, rc = run_cmd(lxc_qemu, f"lxc-start --name {self.NAME}",
+                             timeout=60)
+        assert rc == 0, f"lxc-start failed: {output}"
+        # Give the container a moment to come up
+        run_cmd(lxc_qemu, "sleep 3")
+
+    def test_running(self, lxc_qemu):
+        output, rc = run_cmd(lxc_qemu, f"lxc-ls --running -1")
+        assert self.NAME in output, f"container not running: {output}"
+
+    def test_attach_runs_command(self, lxc_qemu):
+        # lxc-attach returns the exit code of the inner command, so
+        # check the inner command's output rather than rc alone.
+        output, _rc = run_cmd(
+            lxc_qemu,
+            f"lxc-attach --name {self.NAME} -- cat /etc/os-release",
+            timeout=30,
+        )
+        assert "alpine" in output.lower(), (
+            f"expected alpine os-release inside container, got: {output}"
+        )
+
+    def test_stop(self, lxc_qemu):
+        output, rc = run_cmd(lxc_qemu, f"lxc-stop --name {self.NAME}",
+                             timeout=60)
+        assert rc == 0, f"lxc-stop failed: {output}"
+
+    def test_destroy(self, lxc_qemu):
+        output, rc = run_cmd(lxc_qemu, f"lxc-destroy --name {self.NAME}",
+                             timeout=60)
+        assert rc == 0, f"lxc-destroy failed: {output}"
diff --git a/tests/test_vcontainer_auth_config.py b/tests/test_vcontainer_auth_config.py
new file mode 100644
index 00000000..2e7093aa
--- /dev/null
+++ b/tests/test_vcontainer_auth_config.py
@@ -0,0 +1,642 @@
+# SPDX-FileCopyrightText: Copyright (C) 2026 Konsulko Group
+#
+# SPDX-License-Identifier: MIT
+"""
+Tests for the vcontainer registry-auth-config plumbing ("--config" /
+$VDKR_CONFIG / $VPDMN_CONFIG).
+
+These tests are split into two tiers:
+
+Tier 1 - static/shell-level (TestAuthConfigStaticPlumbing):
+    Reads the shell scripts under recipes-containers/vcontainer/files/ and the
+    README and asserts that the expected function definitions, call sites,
+    kernel cmdline flags, permission modes, mount options, and documentation
+    blocks are present. These tests need no infrastructure and run in <1s.
+
+Tier 2 - functional validator (TestAuthConfigValidator):
+    Extracts validate_auth_config() from vrunner.sh, sources it in a bash
+    subshell with a stubbed log() function, and drives it with a table of
+    inputs covering the perm / size / symlink / ownership / regular-file
+    rules. Also runs in <1s per case.
+
+Tier 3 (live registry pull with --config) is intentionally NOT in this file.
+It belongs alongside test_vdkr_registry.py once the registry fixture grows a
+credentials-required mode.
+
+Run with:
+    pytest tests/test_vcontainer_auth_config.py -v
+"""
+
+import os
+import re
+import stat
+import subprocess
+import textwrap
+from pathlib import Path
+
+import pytest
+
+
+# ---------------------------------------------------------------------------
+# Locate the vcontainer files/ directory.
+# ---------------------------------------------------------------------------
+#
+# Resolution order:
+#   1. VCONTAINER_FILES_DIR environment variable (explicit override)
+#   2. <repo-root>/recipes-containers/vcontainer/files/ relative to this test
+#      (i.e. tests/../recipes-containers/vcontainer/files/)
+#   3. /opt/bruce/poky/meta-virtualization/recipes-containers/vcontainer/files/
+#      (matches the pattern used by test_container_registry_script.py)
+#
+# If none of these are present, every test in this module is skipped.
+_TESTS_DIR = Path(__file__).resolve().parent
+_DEFAULT_CANDIDATES = [
+    _TESTS_DIR.parent / "recipes-containers" / "vcontainer" / "files",
+    Path("/opt/bruce/poky/meta-virtualization/recipes-containers/vcontainer/files"),
+]
+
+
+def _find_files_dir() -> Path:
+    override = os.environ.get("VCONTAINER_FILES_DIR")
+    if override:
+        return Path(override)
+    for c in _DEFAULT_CANDIDATES:
+        if c.is_dir():
+            return c
+    return _DEFAULT_CANDIDATES[0]  # return first, skip in fixture if missing
+
+
+@pytest.fixture(scope="module")
+def files_dir() -> Path:
+    d = _find_files_dir()
+    if not d.is_dir():
+        pytest.skip(f"vcontainer files/ dir not found: {d}")
+    return d
+
+
+@pytest.fixture(scope="module")
+def repo_root() -> Path:
+    # The vcontainer files live at <root>/recipes-containers/vcontainer/files,
+    # so the repo root is two levels up.
+    d = _find_files_dir()
+    return d.parent.parent.parent
+
+
+@pytest.fixture(scope="module")
+def vrunner_sh(files_dir: Path) -> str:
+    p = files_dir / "vrunner.sh"
+    if not p.is_file():
+        pytest.skip(f"vrunner.sh not found: {p}")
+    return p.read_text()
+
+
+@pytest.fixture(scope="module")
+def vcontainer_common_sh(files_dir: Path) -> str:
+    p = files_dir / "vcontainer-common.sh"
+    if not p.is_file():
+        pytest.skip(f"vcontainer-common.sh not found: {p}")
+    return p.read_text()
+
+
+@pytest.fixture(scope="module")
+def init_common_sh(files_dir: Path) -> str:
+    p = files_dir / "vcontainer-init-common.sh"
+    if not p.is_file():
+        pytest.skip(f"vcontainer-init-common.sh not found: {p}")
+    return p.read_text()
+
+
+@pytest.fixture(scope="module")
+def vdkr_init_sh(files_dir: Path) -> str:
+    p = files_dir / "vdkr-init.sh"
+    if not p.is_file():
+        pytest.skip(f"vdkr-init.sh not found: {p}")
+    return p.read_text()
+
+
+@pytest.fixture(scope="module")
+def vpdmn_init_sh(files_dir: Path) -> str:
+    p = files_dir / "vpdmn-init.sh"
+    if not p.is_file():
+        pytest.skip(f"vpdmn-init.sh not found: {p}")
+    return p.read_text()
+
+
+@pytest.fixture(scope="module")
+def readme_md(repo_root: Path) -> str:
+    p = repo_root / "recipes-containers" / "vcontainer" / "README.md"
+    if not p.is_file():
+        pytest.skip(f"vcontainer README.md not found: {p}")
+    return p.read_text()
+
+
+# ---------------------------------------------------------------------------
+# Tier 1: Static / shell-level plumbing assertions
+# ---------------------------------------------------------------------------
+
+
+class TestAuthConfigStaticPlumbing:
+    """Shell-script-level assertions for the --config / VDKR_CONFIG feature."""
+
+    # --- vrunner.sh --------------------------------------------------------
+
+    def test_vrunner_defines_auth_config_from_env(self, vrunner_sh):
+        """AUTH_CONFIG picks up $VDKR_CONFIG or $VPDMN_CONFIG by default."""
+        assert re.search(
+            r'AUTH_CONFIG="\$\{VDKR_CONFIG:-\$\{VPDMN_CONFIG:-\}\}"', vrunner_sh
+        ), "vrunner.sh should initialise AUTH_CONFIG from VDKR_CONFIG/VPDMN_CONFIG"
+
+    def test_vrunner_accepts_config_flag(self, vrunner_sh):
+        """`--config <path>` is parsed and assigned to AUTH_CONFIG."""
+        # The case label ("--config") plus the assignment should both exist.
+        # Allow interleaved comment lines between the label and the assignment.
+        assert re.search(
+            r'--config\)\s*\n(?:\s*#[^\n]*\n)*\s*AUTH_CONFIG="\$2"',
+            vrunner_sh,
+        ), "vrunner.sh should parse --config and set AUTH_CONFIG=\"$2\""
+
+    def test_vrunner_defines_validate_auth_config(self, vrunner_sh):
+        assert "validate_auth_config()" in vrunner_sh, \
+            "vrunner.sh should define validate_auth_config()"
+
+    def test_vrunner_defines_setup_auth_share(self, vrunner_sh):
+        assert "setup_auth_share()" in vrunner_sh, \
+            "vrunner.sh should define setup_auth_share()"
+
+    def test_vrunner_validator_rejects_symlinks(self, vrunner_sh):
+        """Symlinks are rejected outright to block /proc/self/environ tricks."""
+        assert re.search(r'if \[ -L "\$path" \]', vrunner_sh), \
+            "validate_auth_config must reject symlinks with `[ -L $path ]`"
+
+    def test_vrunner_validator_requires_regular_file(self, vrunner_sh):
+        assert re.search(r'if \[ ! -f "\$path" \]', vrunner_sh), \
+            "validate_auth_config must require a regular file (-f)"
+
+    def test_vrunner_validator_requires_readable(self, vrunner_sh):
+        assert re.search(r'if \[ ! -r "\$path" \]', vrunner_sh), \
+            "validate_auth_config must require the file be readable (-r)"
+
+    def test_vrunner_validator_checks_missing(self, vrunner_sh):
+        assert re.search(r'if \[ ! -e "\$path" \]', vrunner_sh), \
+            "validate_auth_config must detect missing files (-e)"
+
+    def test_vrunner_validator_min_size(self, vrunner_sh):
+        """Files smaller than 2 bytes (minimum "{}" JSON) are rejected."""
+        assert re.search(r'size"?\s*-lt\s*2', vrunner_sh), \
+            "validate_auth_config must reject files smaller than 2 bytes"
+
+    def test_vrunner_validator_max_size(self, vrunner_sh):
+        """Files larger than 1 MiB are rejected."""
+        assert "1048576" in vrunner_sh, \
+            "validate_auth_config must reject files larger than 1 MiB (1048576)"
+
+    def test_vrunner_validator_mode_whitelist(self, vrunner_sh):
+        """Permission modes are restricted to 400 / 600 / 200."""
+        # We accept either a case statement or equivalent chain; the canonical
+        # form in the source is a case statement that matches these literals.
+        assert re.search(r'400\s*\|\s*600\s*\|\s*200', vrunner_sh), (
+            "validate_auth_config must whitelist modes 400|600|200 only"
+        )
+
+    def test_vrunner_validator_warns_on_wrong_owner(self, vrunner_sh):
+        """Non-owner files trigger a WARN but don't reject (documented)."""
+        assert re.search(r'WARN.*not owned by current user', vrunner_sh), \
+            "validate_auth_config must WARN when file is not owned by current user"
+
+    def test_vrunner_setup_auth_share_permissions(self, vrunner_sh):
+        """Staging dir is 700 and staged file is 400."""
+        assert "chmod 700" in vrunner_sh, \
+            "setup_auth_share must chmod 700 the staging directory"
+        assert re.search(r'chmod 400[^\n]*config\.json', vrunner_sh), \
+            "setup_auth_share must chmod 400 the staged config.json"
+
+    def test_vrunner_setup_auth_share_readonly_9p(self, vrunner_sh):
+        """The 9p share is created with readonly=on."""
+        assert 'hv_build_9p_opts' in vrunner_sh and 'readonly=on' in vrunner_sh, (
+            "setup_auth_share must pass readonly=on to hv_build_9p_opts"
+        )
+
+    def test_vrunner_setup_auth_share_uses_dedicated_tag(self, vrunner_sh):
+        """Auth 9p tag is TOOL_NAME_auth (separate from the shared /mnt/share)."""
+        assert re.search(r'auth_tag="\$\{TOOL_NAME\}_auth"', vrunner_sh), (
+            'setup_auth_share must use a dedicated "${TOOL_NAME}_auth" 9p tag'
+        )
+
+    def test_vrunner_auth_cmdline_is_flag_only(self, vrunner_sh):
+        """Only a boolean flag (_auth=1) is appended - never the path or contents."""
+        # Flag is appended:
+        assert re.search(
+            r'KERNEL_APPEND="\$KERNEL_APPEND \$\{CMDLINE_PREFIX\}_auth=1"',
+            vrunner_sh,
+        ), "vrunner.sh must append `${CMDLINE_PREFIX}_auth=1` to KERNEL_APPEND"
+
+        # And the path / env var names must NEVER land in KERNEL_APPEND.
+        # Scan every line that mutates KERNEL_APPEND and prove none mention
+        # AUTH_CONFIG, VDKR_CONFIG, or VPDMN_CONFIG.
+        for ln in vrunner_sh.splitlines():
+            if "KERNEL_APPEND=" in ln or "KERNEL_APPEND+=" in ln:
+                assert "AUTH_CONFIG" not in ln, (
+                    f"KERNEL_APPEND must not carry AUTH_CONFIG: {ln!r}"
+                )
+                assert "VDKR_CONFIG" not in ln, (
+                    f"KERNEL_APPEND must not carry VDKR_CONFIG: {ln!r}"
+                )
+                assert "VPDMN_CONFIG" not in ln, (
+                    f"KERNEL_APPEND must not carry VPDMN_CONFIG: {ln!r}"
+                )
+
+    def test_vrunner_setup_auth_share_called_in_both_paths(self, vrunner_sh):
+        """setup_auth_share is called at least twice (daemon + non-daemon paths)."""
+        # Count *call sites*, not the definition. The definition line has a '(' right after.
+        call_sites = [
+            ln for ln in vrunner_sh.splitlines()
+            if re.search(r'\bsetup_auth_share\b', ln)
+            and "()" not in ln
+            and not ln.lstrip().startswith("#")
+        ]
+        assert len(call_sites) >= 2, (
+            f"setup_auth_share should be invoked in both daemon and non-daemon "
+            f"paths; found {len(call_sites)} call site(s): {call_sites}"
+        )
+
+    # --- vcontainer-common.sh ---------------------------------------------
+
+    def test_common_inits_auth_config_from_env(self, vcontainer_common_sh):
+        assert re.search(
+            r'AUTH_CONFIG="\$\{VDKR_CONFIG:-\$\{VPDMN_CONFIG:-\}\}"',
+            vcontainer_common_sh,
+        ), "vcontainer-common.sh should init AUTH_CONFIG from VDKR_CONFIG/VPDMN_CONFIG"
+
+    def test_common_parses_config_flag(self, vcontainer_common_sh):
+        assert re.search(
+            r'--config\)\s*\n(?:\s*#[^\n]*\n)*\s*(?:#[^\n]*\n\s*)*AUTH_CONFIG="\$2"',
+            vcontainer_common_sh,
+        ), "vcontainer-common.sh should parse --config into AUTH_CONFIG"
+
+    def test_common_forwards_auth_config_to_runner(self, vcontainer_common_sh):
+        """AUTH_CONFIG is forwarded as --config to vrunner.sh."""
+        assert re.search(
+            r'\[ -n "\$AUTH_CONFIG" \].*args\+=\("--config" "\$AUTH_CONFIG"\)',
+            vcontainer_common_sh,
+        ), "vcontainer-common.sh must forward AUTH_CONFIG via --config to vrunner"
+
+    def test_common_show_usage_documents_config(self, vcontainer_common_sh):
+        """--config appears in show_usage help output."""
+        assert re.search(r'--config\s+<path>', vcontainer_common_sh), (
+            "show_usage must document --config <path>"
+        )
+        assert "VDKR_CONFIG" in vcontainer_common_sh, \
+            "show_usage must mention VDKR_CONFIG env var"
+        assert "VPDMN_CONFIG" in vcontainer_common_sh, \
+            "show_usage must mention VPDMN_CONFIG env var"
+
+    # --- vcontainer-init-common.sh ----------------------------------------
+
+    def test_init_common_defaults_runtime_auth(self, init_common_sh):
+        assert re.search(r'RUNTIME_AUTH="0"', init_common_sh), \
+            "init-common must default RUNTIME_AUTH to 0"
+
+    def test_init_common_parses_auth_flag(self, init_common_sh):
+        """Kernel cmdline <prefix>_auth=* is parsed into RUNTIME_AUTH."""
+        assert re.search(
+            r'\$\{VCONTAINER_RUNTIME_PREFIX\}_auth=\*', init_common_sh
+        ), "init-common must parse ${VCONTAINER_RUNTIME_PREFIX}_auth=* cmdline arg"
+        assert re.search(
+            r'RUNTIME_AUTH="\$\{param#\$\{VCONTAINER_RUNTIME_PREFIX\}_auth=\}"',
+            init_common_sh,
+        ), "init-common must strip _auth= prefix into RUNTIME_AUTH"
+
+    def test_init_common_defines_mount_helpers(self, init_common_sh):
+        assert "mount_auth_share()" in init_common_sh, \
+            "init-common must define mount_auth_share()"
+        assert "unmount_auth_share()" in init_common_sh, \
+            "init-common must define unmount_auth_share()"
+
+    def test_init_common_mount_uses_dedicated_tag(self, init_common_sh):
+        """mount_auth_share uses ${VCONTAINER_RUNTIME_NAME}_auth tag."""
+        assert re.search(
+            r'AUTH_SHARE_TAG="\$\{VCONTAINER_RUNTIME_NAME\}_auth"',
+            init_common_sh,
+        ), "mount_auth_share must use a per-runtime _auth 9p tag"
+
+    def test_init_common_mount_options_hardened(self, init_common_sh):
+        """Auth share is mounted ro,nosuid,nodev,noexec."""
+        # All four options must be present on the mount command.
+        # Find the mount call to be sure we're looking at the right line.
+        m = re.search(
+            r'mount -t 9p[^\n]*\\\n[^\n]*trans=\$\{NINE_P_TRANSPORT\}[^\n]*',
+            init_common_sh,
+        )
+        assert m, "mount_auth_share must issue a mount -t 9p call"
+        # The options are on the continuation line; grab the paragraph.
+        start = m.start()
+        end = init_common_sh.find('"$AUTH_SHARE_TAG"', start)
+        block = init_common_sh[start:end if end != -1 else start + 400]
+        for opt in ("ro", "nosuid", "nodev", "noexec"):
+            assert opt in block, f"mount_auth_share must include {opt} mount option"
+
+    def test_init_common_mount_guarded_by_runtime_auth(self, init_common_sh):
+        """mount_auth_share returns early when RUNTIME_AUTH != 1."""
+        # Find "mount_auth_share()" and assert the first ~15 lines contain the guard.
+        idx = init_common_sh.find("mount_auth_share()")
+        assert idx != -1
+        snippet = init_common_sh[idx:idx + 400]
+        assert re.search(r'if \[ "\$RUNTIME_AUTH" != "1" \]', snippet), (
+            "mount_auth_share must early-return when RUNTIME_AUTH != 1"
+        )
+
+    # --- vdkr-init.sh ------------------------------------------------------
+
+    def test_vdkr_defines_install_auth_config(self, vdkr_init_sh):
+        assert "install_auth_config()" in vdkr_init_sh, \
+            "vdkr-init.sh must define install_auth_config()"
+
+    def test_vdkr_target_path_and_modes(self, vdkr_init_sh):
+        """Target is /root/.docker/config.json; mode 0600; parent 0700."""
+        assert "/root/.docker/config.json" in vdkr_init_sh, (
+            "vdkr-init must write credentials to /root/.docker/config.json"
+        )
+        assert "chmod 700 /root/.docker" in vdkr_init_sh, \
+            "vdkr-init must chmod 700 /root/.docker"
+        assert "chmod 600 /root/.docker/config.json" in vdkr_init_sh, \
+            "vdkr-init must chmod 600 /root/.docker/config.json"
+
+    def test_vdkr_calls_mount_and_unmount(self, vdkr_init_sh):
+        assert "mount_auth_share" in vdkr_init_sh
+        assert "unmount_auth_share" in vdkr_init_sh, (
+            "vdkr-init must unmount /mnt/auth after copying"
+        )
+
+    def test_vdkr_logs_precedence_note(self, vdkr_init_sh):
+        """When --config and --registry-user/--registry-pass are both set, log a NOTE."""
+        assert re.search(
+            r'NOTE:\s*--config\s*takes precedence over\s*--registry-user/--registry-pass',
+            vdkr_init_sh,
+        ), "vdkr-init must log a precedence NOTE when both mechanisms are supplied"
+
+    def test_vdkr_install_auth_config_after_ca(self, vdkr_init_sh):
+        """install_auth_config runs after install_registry_ca in main flow."""
+        # Find the call sites (not the definitions). Each name should appear
+        # at least once at column 0 (bare call) after the function bodies.
+        # A simpler, resilient check: the LAST occurrence of install_registry_ca
+        # should appear before the LAST occurrence of install_auth_config.
+        last_ca = vdkr_init_sh.rfind("install_registry_ca")
+        last_auth = vdkr_init_sh.rfind("install_auth_config")
+        assert last_ca != -1 and last_auth != -1
+        assert last_ca < last_auth, (
+            "install_auth_config must be called AFTER install_registry_ca "
+            "so --config wins on precedence"
+        )
+
+    # --- vpdmn-init.sh -----------------------------------------------------
+
+    def test_vpdmn_defines_install_auth_config(self, vpdmn_init_sh):
+        assert "install_auth_config()" in vpdmn_init_sh, \
+            "vpdmn-init.sh must define install_auth_config()"
+
+    def test_vpdmn_target_path_and_modes(self, vpdmn_init_sh):
+        """Target is /run/containers/0/auth.json with 0600; dir 0700."""
+        assert "/run/containers/0" in vpdmn_init_sh, \
+            "vpdmn-init must write to /run/containers/0 (rootful podman default)"
+        assert re.search(r'auth_file="\$auth_dir/auth\.json"', vpdmn_init_sh), \
+            "vpdmn-init must write to .../auth.json"
+        assert re.search(r'chmod 700 "\$auth_dir"', vpdmn_init_sh), \
+            "vpdmn-init must chmod 700 the auth dir"
+        assert re.search(r'chmod 600 "\$auth_file"', vpdmn_init_sh), \
+            "vpdmn-init must chmod 600 the auth.json"
+
+    def test_vpdmn_exports_registry_auth_file(self, vpdmn_init_sh):
+        """REGISTRY_AUTH_FILE is exported so podman finds the creds."""
+        assert re.search(r'export REGISTRY_AUTH_FILE="\$auth_file"', vpdmn_init_sh), (
+            "vpdmn-init must export REGISTRY_AUTH_FILE"
+        )
+
+    def test_vpdmn_calls_mount_and_unmount(self, vpdmn_init_sh):
+        assert "mount_auth_share" in vpdmn_init_sh
+        assert "unmount_auth_share" in vpdmn_init_sh, (
+            "vpdmn-init must unmount /mnt/auth after copying"
+        )
+
+    def test_vpdmn_install_auth_config_after_verify_podman(self, vpdmn_init_sh):
+        """install_auth_config runs after verify_podman in the main flow."""
+        last_verify = vpdmn_init_sh.rfind("verify_podman")
+        last_auth = vpdmn_init_sh.rfind("install_auth_config")
+        assert last_verify != -1 and last_auth != -1
+        assert last_verify < last_auth, (
+            "install_auth_config should be called AFTER verify_podman"
+        )
+
+    # --- README.md ---------------------------------------------------------
+
+    def test_readme_documents_config_section(self, readme_md):
+        assert "Passing an existing docker/podman auth file" in readme_md, (
+            "README must document the --config feature"
+        )
+
+    def test_readme_lists_env_vars(self, readme_md):
+        assert "VDKR_CONFIG" in readme_md, "README must document VDKR_CONFIG"
+        assert "VPDMN_CONFIG" in readme_md, "README must document VPDMN_CONFIG"
+
+    def test_readme_lists_target_paths(self, readme_md):
+        """Both runtime target paths appear in the doc."""
+        assert "/root/.docker/config.json" in readme_md, \
+            "README must document the vdkr target path"
+        assert "/run/containers/0/auth.json" in readme_md, \
+            "README must document the vpdmn target path"
+
+
+# ---------------------------------------------------------------------------
+# Tier 2: Functional validator tests (bash subshell, no QEMU).
+# ---------------------------------------------------------------------------
+
+
+def _extract_validate_auth_config(vrunner_text: str) -> str:
+    """Extract the validate_auth_config function body from vrunner.sh.
+
+    Parses from "validate_auth_config() {" to its matching top-level closing
+    brace. Simple brace-counting suffices because the function body only
+    contains shell constructs (no here-docs that start with '{').
+    """
+    start = vrunner_text.find("validate_auth_config()")
+    assert start != -1, "validate_auth_config not found in vrunner.sh"
+    # Jump to the opening brace of the function.
+    brace = vrunner_text.find("{", start)
+    assert brace != -1
+    depth = 0
+    i = brace
+    n = len(vrunner_text)
+    while i < n:
+        ch = vrunner_text[i]
+        if ch == "{":
+            depth += 1
+        elif ch == "}":
+            depth -= 1
+            if depth == 0:
+                return vrunner_text[start : i + 1]
+        i += 1
+    raise AssertionError("Unterminated validate_auth_config definition")
+
+
+@pytest.fixture(scope="module")
+def validator_harness(vrunner_sh, tmp_path_factory) -> Path:
+    """Create a tiny bash script that sources validate_auth_config + runs it.
+
+    The harness is parameterised by $1 = path argument. It prints validator
+    output to stderr (as vrunner does) and exits with the validator's code.
+    """
+    body = _extract_validate_auth_config(vrunner_sh)
+    harness = textwrap.dedent(
+        """\
+        #!/usr/bin/env bash
+        # Test harness for validate_auth_config (extracted from vrunner.sh).
+
+        # Stub the log() helper used by validate_auth_config. Route everything
+        # to stderr so the test can grep on captured stderr.
+        log() {
+            local level="$1"
+            shift
+            echo "[$level] $*" 1>&2
+        }
+
+        %s
+
+        validate_auth_config "$1"
+        exit $?
+        """
+    ) % body
+
+    out = tmp_path_factory.mktemp("auth_validator") / "harness.sh"
+    out.write_text(harness)
+    out.chmod(0o700)
+    return out
+
+
+def _run_validator(harness: Path, path_arg: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        ["bash", str(harness), path_arg],
+        capture_output=True,
+        text=True,
+        timeout=10,
+    )
+
+
+class TestAuthConfigValidator:
+    """Functional tests for validate_auth_config() in vrunner.sh."""
+
+    def test_accepts_valid_mode_600(self, validator_harness, tmp_path):
+        f = tmp_path / "config.json"
+        f.write_text('{"auths":{}}')
+        os.chmod(f, 0o600)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode == 0, f"expected accept, got {r.returncode}\nstderr={r.stderr}"
+
+    def test_accepts_valid_mode_400(self, validator_harness, tmp_path):
+        f = tmp_path / "config.json"
+        f.write_text('{"auths":{}}')
+        os.chmod(f, 0o400)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode == 0, f"expected accept, got {r.returncode}\nstderr={r.stderr}"
+
+    def test_accepts_minimum_two_byte_json(self, validator_harness, tmp_path):
+        """A 2-byte file ('{}' with no trailing newline) is the minimum valid size."""
+        f = tmp_path / "config.json"
+        f.write_bytes(b"{}")
+        os.chmod(f, 0o600)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode == 0, (
+            f"expected accept for 2-byte file, got {r.returncode}\nstderr={r.stderr}"
+        )
+
+    def test_rejects_missing_file(self, validator_harness, tmp_path):
+        r = _run_validator(validator_harness, str(tmp_path / "no-such-file"))
+        assert r.returncode != 0
+        assert "not found" in r.stderr
+
+    def test_rejects_symlink(self, validator_harness, tmp_path):
+        target = tmp_path / "real.json"
+        target.write_text('{"auths":{}}')
+        os.chmod(target, 0o600)
+        link = tmp_path / "link.json"
+        link.symlink_to(target)
+        r = _run_validator(validator_harness, str(link))
+        assert r.returncode != 0
+        assert "symlink" in r.stderr
+
+    def test_rejects_directory(self, validator_harness, tmp_path):
+        d = tmp_path / "adir"
+        d.mkdir()
+        r = _run_validator(validator_harness, str(d))
+        assert r.returncode != 0
+        # Directories trip the -L check first on some shells; either error is fine.
+        assert "regular file" in r.stderr or "not readable" in r.stderr or "symlink" not in r.stderr
+
+    def test_rejects_empty_file(self, validator_harness, tmp_path):
+        f = tmp_path / "empty.json"
+        f.write_bytes(b"")
+        os.chmod(f, 0o600)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode != 0
+        assert "empty or too small" in r.stderr
+
+    def test_rejects_one_byte_file(self, validator_harness, tmp_path):
+        """A single-byte file (e.g. lone newline from 'echo > file') is rejected."""
+        f = tmp_path / "tiny.json"
+        f.write_bytes(b"\n")
+        os.chmod(f, 0o600)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode != 0
+        assert "empty or too small" in r.stderr
+
+    def test_rejects_oversize_file(self, validator_harness, tmp_path):
+        """Files > 1 MiB are rejected."""
+        f = tmp_path / "big.json"
+        # 1 MiB + 1 byte.
+        f.write_bytes(b"{" + b"a" * (1024 * 1024) + b"}")
+        os.chmod(f, 0o600)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode != 0
+        assert "too large" in r.stderr
+
+    def test_rejects_world_readable(self, validator_harness, tmp_path):
+        """Mode 0644 (group/other readable) is rejected."""
+        f = tmp_path / "config.json"
+        f.write_text('{"auths":{}}')
+        os.chmod(f, 0o644)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode != 0
+        assert "unsafe permissions" in r.stderr
+
+    def test_rejects_group_readable(self, validator_harness, tmp_path):
+        """Mode 0640 (group readable) is rejected."""
+        f = tmp_path / "config.json"
+        f.write_text('{"auths":{}}')
+        os.chmod(f, 0o640)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode != 0
+        assert "unsafe permissions" in r.stderr
+
+    def test_rejects_executable(self, validator_harness, tmp_path):
+        """Mode 0700 (owner-exec) is rejected - we only permit r/w combos."""
+        f = tmp_path / "config.json"
+        f.write_text('{"auths":{}}')
+        os.chmod(f, 0o700)
+        r = _run_validator(validator_harness, str(f))
+        assert r.returncode != 0
+        assert "unsafe permissions" in r.stderr
+
+    def test_rejects_unreadable(self, validator_harness, tmp_path):
+        """A mode 0000 file cannot be read by the invoking user."""
+        if os.geteuid() == 0:
+            pytest.skip("running as root; DAC permission checks are bypassed")
+        f = tmp_path / "config.json"
+        f.write_text('{"auths":{}}')
+        # 0000: no bits at all.
+        os.chmod(f, 0o000)
+        try:
+            r = _run_validator(validator_harness, str(f))
+            assert r.returncode != 0
+            # Either "not readable" wins, or the mode-check fires; accept either.
+            assert "not readable" in r.stderr or "unsafe permissions" in r.stderr
+        finally:
+            # Restore perms so pytest can clean up the tmp tree.
+            os.chmod(f, 0o600)
diff --git a/tests/test_vcontainer_distro.py b/tests/test_vcontainer_distro.py
new file mode 100644
index 00000000..49c6deb0
--- /dev/null
+++ b/tests/test_vcontainer_distro.py
@@ -0,0 +1,532 @@
+# SPDX-FileCopyrightText: Copyright (C) 2025 Bruce Ashfield
+#
+# SPDX-License-Identifier: MIT
+"""
+Tests for vcontainer distro and multi-arch OCI container build infrastructure.
+
+Verifies:
+- vruntime-base.inc shared base exists and has correct content
+- vcontainer.conf distro uses shared base without BBMASK
+- vruntime.conf uses shared base with BBMASK (no regression)
+- Container multiconfig files exist and reference vcontainer distro
+- oci-multiarch.bbclass defaults point to container-* multiconfigs
+- container-base-multiarch.bb recipe wires up correctly
+- meta-virt-host.conf BBMULTICONFIG includes container-* entries
+- Built OCI output has valid multi-arch structure (when available)
+
+Run with:
+    pytest tests/test_vcontainer_distro.py -v --poky-dir /opt/bruce/poky
+
+Build-dependent tests (marked @pytest.mark.slow) require:
+    bitbake container-base-multiarch
+"""
+
+import json
+import os
+import pytest
+from pathlib import Path
+
+
+@pytest.fixture(scope="module")
+def meta_virt_dir(request):
+    """Path to meta-virtualization layer."""
+    poky_dir = Path(request.config.getoption("--poky-dir"))
+    path = poky_dir / "meta-virtualization"
+    if not path.exists():
+        pytest.skip(f"meta-virtualization not found: {path}")
+    return path
+
+
+@pytest.fixture(scope="module")
+def build_dir(request):
+    """Path to build directory."""
+    bd = request.config.getoption("--build-dir")
+    if bd:
+        return Path(bd)
+    poky_dir = Path(request.config.getoption("--poky-dir"))
+    return poky_dir / "build"
+
+
+# =============================================================================
+# Tier 1: Static file assertions (no bitbake required)
+# =============================================================================
+
+class TestVruntimeBaseInc:
+    """Test the shared vruntime-base.inc fragment."""
+
+    def test_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "conf" / "distro" / "include" / "vruntime-base.inc"
+        assert path.exists(), f"Missing: {path}"
+
+    def test_requires_poky(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vruntime-base.inc").read_text()
+        assert "require conf/distro/poky.conf" in content
+
+    def test_sets_distro_features(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vruntime-base.inc").read_text()
+        assert 'DISTRO_FEATURES = "' in content
+        assert "vcontainer" in content
+        assert "seccomp" in content
+
+    def test_opts_out_features(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vruntime-base.inc").read_text()
+        assert "DISTRO_FEATURES_OPTED_OUT" in content
+        assert "pulseaudio" in content
+        assert "wayland" in content
+
+    def test_native_class_overrides(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vruntime-base.inc").read_text()
+        assert "DISTRO_FEATURES:class-native" in content
+        assert "DISTRO_FEATURES:class-nativesdk" in content
+
+    def test_does_not_set_distro_name(self, meta_virt_dir):
+        """Shared base must NOT set DISTRO or DISTRO_NAME — consumers do that."""
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vruntime-base.inc").read_text()
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            assert not stripped.startswith("DISTRO ="), "vruntime-base.inc must not set DISTRO"
+            assert not stripped.startswith("DISTRO_NAME"), "vruntime-base.inc must not set DISTRO_NAME"
+
+    def test_does_not_include_bbmask(self, meta_virt_dir):
+        """Shared base must NOT include BBMASK files."""
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vruntime-base.inc").read_text()
+        assert "bbmask" not in content.lower()
+
+
+class TestVcontainerConf:
+    """Test the vcontainer OCI builder distro."""
+
+    def test_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "conf" / "distro" / "vcontainer.conf"
+        assert path.exists(), f"Missing: {path}"
+
+    def test_requires_shared_base(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "vcontainer.conf").read_text()
+        assert "require conf/distro/include/vruntime-base.inc" in content
+
+    def test_sets_distro(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "vcontainer.conf").read_text()
+        assert 'DISTRO = "vcontainer"' in content
+
+    def test_has_lighter_bbmask(self, meta_virt_dir):
+        """vcontainer uses its own lighter BBMASK, not vruntime's."""
+        content = (meta_virt_dir / "conf" / "distro" / "vcontainer.conf").read_text()
+        assert "vcontainer-bbmask.inc" in content
+        # Must NOT use vruntime's BBMASK (it blocks OCI tooling)
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            assert "vruntime-bbmask.inc" not in stripped, \
+                "vcontainer must not use vruntime-bbmask.inc (blocks OCI tooling)"
+
+    def test_no_image_fstypes(self, meta_virt_dir):
+        """vcontainer must NOT set IMAGE_FSTYPES -- 'oci' type needs image-oci.bbclass
+        which only container recipes inherit. Setting it distro-wide breaks other images."""
+        content = (meta_virt_dir / "conf" / "distro" / "vcontainer.conf").read_text()
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            assert not stripped.startswith("IMAGE_FSTYPES"), \
+                "IMAGE_FSTYPES must not be set in vcontainer.conf (breaks non-container images)"
+
+    def test_does_not_duplicate_base_settings(self, meta_virt_dir):
+        """vcontainer should not re-declare settings already in vruntime-base.inc."""
+        content = (meta_virt_dir / "conf" / "distro" / "vcontainer.conf").read_text()
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            assert not stripped.startswith("DISTRO_FEATURES ="), \
+                "DISTRO_FEATURES belongs in vruntime-base.inc"
+            assert not stripped.startswith("DISTRO_FEATURES_OPTED_OUT"), \
+                "DISTRO_FEATURES_OPTED_OUT belongs in vruntime-base.inc"
+
+
+class TestVcontainerBbmask:
+    """Test the vcontainer-bbmask.inc keeps OCI tooling available."""
+
+    def test_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "conf" / "distro" / "include" / "vcontainer-bbmask.inc"
+        assert path.exists()
+
+    def test_masks_graphics(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vcontainer-bbmask.inc").read_text()
+        assert "recipes-graphics" in content
+        assert "recipes-sato" in content
+
+    def test_masks_virtualization_platforms(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vcontainer-bbmask.inc").read_text()
+        assert "recipes-extended/xen/" in content
+        assert "recipes-extended/libvirt/" in content
+
+    def test_does_not_mask_oci_tooling(self, meta_virt_dir):
+        """OCI tooling must NOT be masked — this is the key difference from vruntime."""
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vcontainer-bbmask.inc").read_text()
+        # Check non-comment lines for things that must stay unmasked
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            assert "recipes-containers/umoci/" not in stripped, "umoci must not be masked"
+            assert "recipes-containers/container-registry/" not in stripped, "container-registry must not be masked"
+            assert "recipes-extended/images/" not in stripped, "container image recipes must not be masked"
+            assert "recipes-containers/oci-image-tools/" not in stripped, "oci-image-tools must not be masked"
+            assert "recipes-containers/sloci-image/" not in stripped, "sloci-image must not be masked"
+
+    def test_masks_orchestration(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "vcontainer-bbmask.inc").read_text()
+        assert "recipes-containers/kubernetes/" in content
+        assert "recipes-containers/k3s/" in content
+
+
+class TestVruntimeConfRefactored:
+    """Test that vruntime.conf still works after refactoring."""
+
+    def test_requires_shared_base(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "vruntime.conf").read_text()
+        assert "require conf/distro/include/vruntime-base.inc" in content
+
+    def test_still_has_bbmask(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "vruntime.conf").read_text()
+        assert "vruntime-bbmask.inc" in content
+        assert "vruntime-bbmask-oe-core.inc" in content
+        assert "vruntime-bbmask-meta-oe.inc" in content
+
+    def test_sets_distro_vruntime(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "vruntime.conf").read_text()
+        assert 'DISTRO = "vruntime"' in content
+
+    def test_no_direct_poky_require(self, meta_virt_dir):
+        """vruntime.conf should get poky.conf via vruntime-base.inc, not directly."""
+        content = (meta_virt_dir / "conf" / "distro" / "vruntime.conf").read_text()
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            assert "require conf/distro/poky.conf" not in stripped, \
+                "vruntime.conf should not directly require poky.conf (it comes via vruntime-base.inc)"
+
+    def test_does_not_duplicate_base_settings(self, meta_virt_dir):
+        """vruntime.conf should not re-declare settings already in vruntime-base.inc."""
+        content = (meta_virt_dir / "conf" / "distro" / "vruntime.conf").read_text()
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            assert not stripped.startswith("DISTRO_FEATURES ="), \
+                "DISTRO_FEATURES belongs in vruntime-base.inc, not vruntime.conf"
+            assert not stripped.startswith("DISTRO_FEATURES_OPTED_OUT"), \
+                "DISTRO_FEATURES_OPTED_OUT belongs in vruntime-base.inc"
+
+    def test_busybox_init(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "vruntime.conf").read_text()
+        assert "busybox" in content
+
+    def test_ptest_glib_disabled(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "vruntime.conf").read_text()
+        assert 'PTEST_ENABLED:pn-glib-2.0 = ""' in content
+
+
+class TestContainerMulticonfigs:
+    """Test container multiconfig files."""
+
+    def test_container_aarch64_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "conf" / "multiconfig" / "container-aarch64.conf"
+        assert path.exists(), f"Missing: {path}"
+
+    def test_container_x86_64_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "conf" / "multiconfig" / "container-x86-64.conf"
+        assert path.exists(), f"Missing: {path}"
+
+    def test_old_container_conf_removed(self, meta_virt_dir):
+        path = meta_virt_dir / "conf" / "multiconfig" / "container.conf"
+        assert not path.exists(), f"Stale placeholder should be removed: {path}"
+
+    def test_aarch64_uses_vcontainer(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "multiconfig" / "container-aarch64.conf").read_text()
+        assert 'DISTRO = "vcontainer"' in content
+        assert 'MACHINE = "qemuarm64"' in content
+
+    def test_x86_64_uses_vcontainer(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "multiconfig" / "container-x86-64.conf").read_text()
+        assert 'DISTRO = "vcontainer"' in content
+        assert 'MACHINE = "qemux86-64"' in content
+
+    def test_aarch64_has_separate_tmpdir(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "multiconfig" / "container-aarch64.conf").read_text()
+        assert "tmp-container-aarch64" in content
+
+    def test_x86_64_has_separate_tmpdir(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "multiconfig" / "container-x86-64.conf").read_text()
+        assert "tmp-container-x86-64" in content
+
+
+class TestOCIMultiarchClassUpdated:
+    """Test oci-multiarch.bbclass points to container-* multiconfigs."""
+
+    def test_default_mc_aarch64(self, meta_virt_dir):
+        content = (meta_virt_dir / "classes" / "oci-multiarch.bbclass").read_text()
+        assert 'OCI_MULTIARCH_MC[aarch64] ?= "container-aarch64"' in content
+
+    def test_default_mc_x86_64(self, meta_virt_dir):
+        content = (meta_virt_dir / "classes" / "oci-multiarch.bbclass").read_text()
+        assert 'OCI_MULTIARCH_MC[x86_64] ?= "container-x86-64"' in content
+
+    def test_no_vruntime_mc_defaults(self, meta_virt_dir):
+        """oci-multiarch defaults must NOT reference vruntime-* (BBMASK blocks OCI tools)."""
+        content = (meta_virt_dir / "classes" / "oci-multiarch.bbclass").read_text()
+        # Check non-comment lines
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            if "OCI_MULTIARCH_MC" in stripped and "?=" in stripped:
+                assert "vruntime" not in stripped, \
+                    f"OCI MC default must not reference vruntime: {stripped}"
+
+
+class TestMetaVirtHostConf:
+    """Test meta-virt-host.conf includes container multiconfigs."""
+
+    def test_bbmulticonfig_has_container_mcs(self, meta_virt_dir):
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "meta-virt-host.conf").read_text()
+        assert "container-aarch64" in content
+        assert "container-x86-64" in content
+
+    def test_bbmulticonfig_still_has_vruntime(self, meta_virt_dir):
+        """Existing vruntime MCs must not be removed."""
+        content = (meta_virt_dir / "conf" / "distro" / "include" / "meta-virt-host.conf").read_text()
+        assert "vruntime-aarch64" in content
+        assert "vruntime-x86-64" in content
+
+
+class TestContainerBaseMultiarchRecipe:
+    """Test container-base-multiarch.bb recipe."""
+
+    def test_exists(self, meta_virt_dir):
+        path = meta_virt_dir / "recipes-extended" / "images" / "container-base-multiarch.bb"
+        assert path.exists(), f"Missing: {path}"
+
+    def test_inherits_oci_multiarch(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-extended" / "images" / "container-base-multiarch.bb").read_text()
+        assert "inherit oci-multiarch" in content
+
+    def test_recipe_target(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-extended" / "images" / "container-base-multiarch.bb").read_text()
+        assert 'OCI_MULTIARCH_RECIPE = "container-base"' in content
+
+    def test_platforms(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-extended" / "images" / "container-base-multiarch.bb").read_text()
+        assert "aarch64" in content
+        assert "x86_64" in content
+
+    def test_has_license(self, meta_virt_dir):
+        content = (meta_virt_dir / "recipes-extended" / "images" / "container-base-multiarch.bb").read_text()
+        assert "LICENSE" in content
+
+
+# =============================================================================
+# Tier 2: Consistency checks across files
+# =============================================================================
+
+class TestCrossFileConsistency:
+    """Verify that the distro/multiconfig/bbclass files are consistent."""
+
+    def test_vcontainer_and_vruntime_share_same_base(self, meta_virt_dir):
+        """Both distros must require the same shared base."""
+        vruntime = (meta_virt_dir / "conf" / "distro" / "vruntime.conf").read_text()
+        vcontainer = (meta_virt_dir / "conf" / "distro" / "vcontainer.conf").read_text()
+        base_require = "require conf/distro/include/vruntime-base.inc"
+        assert base_require in vruntime
+        assert base_require in vcontainer
+
+    def test_multiconfig_distro_matches_conf(self, meta_virt_dir):
+        """Multiconfig DISTRO must match vcontainer.conf's DISTRO."""
+        vcontainer = (meta_virt_dir / "conf" / "distro" / "vcontainer.conf").read_text()
+        mc_arm = (meta_virt_dir / "conf" / "multiconfig" / "container-aarch64.conf").read_text()
+        mc_x86 = (meta_virt_dir / "conf" / "multiconfig" / "container-x86-64.conf").read_text()
+        assert 'DISTRO = "vcontainer"' in vcontainer
+        assert 'DISTRO = "vcontainer"' in mc_arm
+        assert 'DISTRO = "vcontainer"' in mc_x86
+
+    def test_bbclass_mc_names_match_multiconfig_files(self, meta_virt_dir):
+        """oci-multiarch.bbclass MC names must have matching multiconfig/*.conf files."""
+        content = (meta_virt_dir / "classes" / "oci-multiarch.bbclass").read_text()
+        mc_dir = meta_virt_dir / "conf" / "multiconfig"
+
+        # Extract default MC names from ?= lines
+        for line in content.splitlines():
+            if "OCI_MULTIARCH_MC" in line and "?=" in line:
+                # Parse: OCI_MULTIARCH_MC[arch] ?= "mc-name"
+                mc_name = line.split('"')[1] if '"' in line else None
+                if mc_name:
+                    mc_file = mc_dir / f"{mc_name}.conf"
+                    assert mc_file.exists(), \
+                        f"bbclass references MC '{mc_name}' but {mc_file} missing"
+
+    def test_bbclass_machines_match_multiconfig(self, meta_virt_dir):
+        """oci-multiarch.bbclass machine names must match multiconfig MACHINE values."""
+        bbclass = (meta_virt_dir / "classes" / "oci-multiarch.bbclass").read_text()
+
+        # Extract machine mapping from bbclass
+        machine_map = {}
+        for line in bbclass.splitlines():
+            if "OCI_MULTIARCH_MACHINE" in line and "?=" in line:
+                # OCI_MULTIARCH_MACHINE[aarch64] ?= "qemuarm64"
+                if "[" in line and "]" in line:
+                    arch = line.split("[")[1].split("]")[0]
+                    machine = line.split('"')[1]
+                    machine_map[arch] = machine
+
+        # Extract MC mapping from bbclass
+        mc_map = {}
+        for line in bbclass.splitlines():
+            if "OCI_MULTIARCH_MC" in line and "?=" in line:
+                if "[" in line and "]" in line:
+                    arch = line.split("[")[1].split("]")[0]
+                    mc = line.split('"')[1]
+                    mc_map[arch] = mc
+
+        # Verify each MC's MACHINE matches the bbclass machine mapping
+        mc_dir = meta_virt_dir / "conf" / "multiconfig"
+        for arch, mc_name in mc_map.items():
+            mc_file = mc_dir / f"{mc_name}.conf"
+            if mc_file.exists() and arch in machine_map:
+                mc_content = mc_file.read_text()
+                expected_machine = machine_map[arch]
+                assert f'MACHINE = "{expected_machine}"' in mc_content, \
+                    f"MC {mc_name} MACHINE should be {expected_machine}"
+
+
+# =============================================================================
+# Tier 3: Build output verification (requires bitbake)
+# =============================================================================
+
+@pytest.mark.slow
+class TestMultiArchBuildOutput:
+    """Verify OCI output from bitbake container-base-multiarch.
+
+    These tests require a prior build:
+        bitbake container-base-multiarch
+    """
+
+    @pytest.fixture(scope="class")
+    def multiarch_output(self, build_dir):
+        """Find the multi-arch OCI output directory."""
+        # oci-multiarch.bbclass puts output in DEPLOY_DIR_IMAGE
+        # Try the main build's deploy dir first
+        candidates = [
+            build_dir / "tmp" / "deploy" / "images",
+        ]
+        # Also check machine-specific dirs
+        for candidate in candidates:
+            if candidate.exists():
+                for d in candidate.rglob("*-multiarch-oci"):
+                    if (d / "index.json").exists():
+                        return d
+        pytest.skip("Multi-arch OCI output not found — run: bitbake container-base-multiarch")
+
+    def test_index_json_exists(self, multiarch_output):
+        assert (multiarch_output / "index.json").exists()
+
+    def test_oci_layout_exists(self, multiarch_output):
+        assert (multiarch_output / "oci-layout").exists()
+        layout = json.loads((multiarch_output / "oci-layout").read_text())
+        assert layout.get("imageLayoutVersion") == "1.0.0"
+
+    def test_blobs_directory_exists(self, multiarch_output):
+        assert (multiarch_output / "blobs" / "sha256").is_dir()
+
+    def test_index_is_oci_image_index(self, multiarch_output):
+        index = json.loads((multiarch_output / "index.json").read_text())
+        assert index.get("schemaVersion") == 2
+        assert index.get("mediaType") == "application/vnd.oci.image.index.v1+json"
+
+    def test_has_arm64_platform(self, multiarch_output):
+        index = json.loads((multiarch_output / "index.json").read_text())
+        platforms = [m.get("platform", {}).get("architecture")
+                     for m in index.get("manifests", [])]
+        assert "arm64" in platforms, f"arm64 not in platforms: {platforms}"
+
+    def test_has_amd64_platform(self, multiarch_output):
+        index = json.loads((multiarch_output / "index.json").read_text())
+        platforms = [m.get("platform", {}).get("architecture")
+                     for m in index.get("manifests", [])]
+        assert "amd64" in platforms, f"amd64 not in platforms: {platforms}"
+
+    def test_all_manifests_have_os_linux(self, multiarch_output):
+        index = json.loads((multiarch_output / "index.json").read_text())
+        for m in index.get("manifests", []):
+            assert m.get("platform", {}).get("os") == "linux"
+
+    def test_manifest_blobs_exist(self, multiarch_output):
+        """Every manifest digest must have a matching blob."""
+        index = json.loads((multiarch_output / "index.json").read_text())
+        blobs_dir = multiarch_output / "blobs" / "sha256"
+        for m in index.get("manifests", []):
+            digest = m["digest"]
+            assert digest.startswith("sha256:")
+            blob_hash = digest[len("sha256:"):]
+            assert (blobs_dir / blob_hash).exists(), \
+                f"Missing blob for manifest: {digest}"
+
+    def test_manifest_sizes_match(self, multiarch_output):
+        """Manifest size in index must match actual blob size."""
+        index = json.loads((multiarch_output / "index.json").read_text())
+        blobs_dir = multiarch_output / "blobs" / "sha256"
+        for m in index.get("manifests", []):
+            blob_hash = m["digest"][len("sha256:"):]
+            blob_path = blobs_dir / blob_hash
+            if blob_path.exists():
+                actual_size = blob_path.stat().st_size
+                assert actual_size == m["size"], \
+                    f"Size mismatch for {m['digest']}: index={m['size']} actual={actual_size}"
+
+    def test_each_manifest_is_valid_json(self, multiarch_output):
+        """Each manifest blob must be valid JSON with expected OCI fields."""
+        index = json.loads((multiarch_output / "index.json").read_text())
+        blobs_dir = multiarch_output / "blobs" / "sha256"
+        for m in index.get("manifests", []):
+            blob_hash = m["digest"][len("sha256:"):]
+            blob_path = blobs_dir / blob_hash
+            if blob_path.exists():
+                manifest = json.loads(blob_path.read_text())
+                assert manifest.get("schemaVersion") == 2
+                assert "config" in manifest
+                assert "layers" in manifest
+
+
+@pytest.mark.slow
+class TestSingleArchContainerBuild:
+    """Verify single-arch container OCI output.
+
+    Requires: bitbake mc:container-x86-64:container-base
+    """
+
+    @pytest.fixture(scope="class")
+    def x86_oci_dir(self, build_dir):
+        """Find x86-64 container OCI output."""
+        deploy = build_dir / "tmp-container-x86-64" / "deploy" / "images" / "qemux86-64"
+        if not deploy.exists():
+            pytest.skip("x86-64 container build not found — run: bitbake mc:container-x86-64:container-base")
+        for d in deploy.glob("container-base*oci"):
+            if (d / "index.json").exists():
+                return d
+        pytest.skip("container-base OCI output not found in deploy dir")
+
+    def test_index_json_valid(self, x86_oci_dir):
+        index = json.loads((x86_oci_dir / "index.json").read_text())
+        assert "manifests" in index
+        assert len(index["manifests"]) >= 1
+
+    def test_has_oci_layout(self, x86_oci_dir):
+        assert (x86_oci_dir / "oci-layout").exists()
+
+    def test_has_blobs(self, x86_oci_dir):
+        blobs = x86_oci_dir / "blobs" / "sha256"
+        assert blobs.is_dir()
+        assert len(list(blobs.iterdir())) > 0, "No blobs found"
diff --git a/tests/test_vdkr_registry.py b/tests/test_vdkr_registry.py
index 72a27169..e429f6ab 100644
--- a/tests/test_vdkr_registry.py
+++ b/tests/test_vdkr_registry.py
@@ -112,15 +112,20 @@ class TestImageCompoundCommands:
             return None, None
 
         # Parse the images output to find alpine
+        # Docker output format varies by version:
+        #   Old: REPOSITORY  TAG  IMAGE ID  CREATED  SIZE
+        #   New: IMAGE  ID  DISK USAGE  CONTENT SIZE  EXTRA
         for line in images_result.stdout.splitlines():
-            if "alpine" in line.lower() and "REPOSITORY" not in line:
-                # Parse: REPOSITORY TAG IMAGE_ID CREATED SIZE
+            if "alpine" in line.lower() and "REPOSITORY" not in line and "IMAGE" not in line:
                 parts = line.split()
-                if len(parts) >= 3:
-                    repo = parts[0]
-                    tag = parts[1]
-                    image_id = parts[2]
-                    return f"{repo}:{tag}", image_id
+                if len(parts) >= 2:
+                    image_ref = parts[0]
+                    image_id = parts[1]
+                    # Old format: repo and tag are separate columns
+                    if ':' not in image_ref and len(parts) >= 3:
+                        image_ref = f"{parts[0]}:{parts[1]}"
+                        image_id = parts[2]
+                    return image_ref, image_id
         return None, None
 
     def test_image_ls(self):
diff --git a/tests/test_xen_runtime.py b/tests/test_xen_runtime.py
index 697c57ee..b31153bd 100644
--- a/tests/test_xen_runtime.py
+++ b/tests/test_xen_runtime.py
@@ -7,21 +7,11 @@ Xen runtime boot tests - boot xen-image-minimal and verify hypervisor.
 These tests boot an actual Xen Dom0 image via runqemu, verify the
 hypervisor is functional, check guest bundling, and exercise vxn/containerd.
 
-Build prerequisites (minimum for Dom0 boot tests):
-    DISTRO_FEATURES:append = " xen systemd"
-    MACHINE = "qemux86-64"  # or qemuarm64
-    bitbake xen-image-minimal
-
-For guest bundling tests:
-    IMAGE_INSTALL:append:pn-xen-image-minimal = " alpine-xen-guest-bundle"
-
-For vxn/containerd tests:
-    DISTRO_FEATURES:append = " virtualization vcontainer vxn"
-    IMAGE_INSTALL:append:pn-xen-image-minimal = " vxn"
-    BBMULTICONFIG = "vruntime-aarch64 vruntime-x86-64"
+The tests automatically build xen-image-minimal with the required
+DISTRO_FEATURES before booting. No local.conf changes needed.
 
 Run with:
-    pytest tests/test_xen_runtime.py -v --machine qemux86-64
+    pytest tests/test_xen_runtime.py -v --poky-dir /opt/bruce/poky
 
 Skip network-dependent tests:
     pytest tests/test_xen_runtime.py -v -m "boot and not network"
@@ -33,7 +23,10 @@ Custom paths and longer timeout:
         --boot-timeout 180
 """
 
+import os
 import re
+import subprocess
+import tempfile
 import time
 import pytest
 from pathlib import Path
@@ -50,6 +43,29 @@ except ImportError:
 # are defined in conftest.py to avoid conflicts with other test files.
 
 
+def _run_bitbake(build_dir, recipe, extra_vars=None, timeout=3600):
+    """Run bitbake with optional variable overrides via -R conf file."""
+    bb_cmd = "bitbake"
+    conf_file = None
+    if extra_vars:
+        conf_file = tempfile.NamedTemporaryFile(
+            mode='w', suffix='.conf', prefix='pytest-xen-',
+            dir=str(build_dir / "conf"), delete=False)
+        for var, val in extra_vars.items():
+            conf_file.write(f'{var} = "{val}"\n')
+        conf_file.close()
+        bb_cmd += f" -R {conf_file.name}"
+    bb_cmd += f" {recipe}"
+    poky_dir = build_dir.parent
+    full_cmd = f"bash -c 'cd {poky_dir} && source oe-init-build-env {build_dir} >/dev/null 2>&1 && {bb_cmd}'"
+    try:
+        return subprocess.run(full_cmd, shell=True, cwd=build_dir,
+                              timeout=timeout, capture_output=True, text=True)
+    finally:
+        if conf_file:
+            os.unlink(conf_file.name)
+
+
 class XenRunner:
     """
     Manages a runqemu session for Xen boot testing.
@@ -218,11 +234,25 @@ def machine(request):
 
 
 @pytest.fixture(scope="module")
-def xen_session(request, poky_dir, build_dir, machine):
+def xen_image(build_dir):
+    """Build xen-image-minimal with required distro features."""
+    result = _run_bitbake(
+        build_dir, "xen-image-minimal",
+        extra_vars={
+            "DISTRO_FEATURES:append": " xen vxn",
+        },
+    )
+    if result.returncode != 0:
+        pytest.fail(f"Xen image build failed: {result.stderr}")
+
+
+@pytest.fixture(scope="module")
+def xen_session(request, poky_dir, build_dir, machine, xen_image):
     """
-    Module-scoped fixture that boots xen-image-minimal once for all tests.
+    Module-scoped fixture that builds xen-image-minimal and boots it
+    once for all tests.
 
-    Skips if pexpect is not available, image is not found, or boot fails.
+    Skips if pexpect is not available or boot fails.
     """
     if not PEXPECT_AVAILABLE:
         pytest.skip("pexpect not installed. Run: pip install pexpect")