-platform=kvm -file-access=exclusive -network=sandbox -overlay -net-raw -watchdog-action=panic -vfs2 -cover