I agree with this and we use direct kernel boot for libguestfs. The problem for confidential VMs / containers is the kernel must be inside the image and must b

I agree with this and we use direct kernel boot for libguestfs. The problem for confidential VMs / containers is the kernel must be inside the image and must be inaccessible to hypervisor (as that is the exact point of the thing), and direct kernel boot needs the kernel to be outside and accessible. The problem for oVirt and other management systems is that usually you want the kernel to be inside the VM so it gets updated when you update the VM, and again direct kernel boot means you've got to have a way to reach in and extract it (cough virt-get-kernel).