$ sudo cat /etc/sudoers.d/cloudinit-test-kvm 
# let all users in cloudinit-test group run mic <path> mchroot
# where that is restricted to expected path.
Cmnd_Alias      CLOUDINIT_TEST_KVM = \
                /usr/bin/mount-image-callback /citest-images/* mchroot, \
                /usr/bin/mount-image-callback /citest-images/* mchroot *
%cloudinit-test ALL=(ALL) NOPASSWD: CLOUDINIT_TEST_KVM