diff --git a/microdroid/payload/config/Android.bp b/microdroid/payload/config/Android.bp
new file mode 100644
index 0000000..da58bdf
--- /dev/null
+++ b/microdroid/payload/config/Android.bp
@@ -0,0 +1,16 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+rust_library {
+    name: "libmicrodroid_payload_config",
+    host_supported: true,
+    crate_name: "microdroid_payload_config",
+    srcs: ["src/lib.rs"],
+    prefer_rlib: true,
+    edition: "2018",
+    rustlibs: [
+        "libserde_json",
+        "libserde",
+    ],
+}
diff --git a/microdroid/payload/config/config.proto b/microdroid/payload/config/config.proto
new file mode 100644
index 0000000..b3d8d3a
--- /dev/null
+++ b/microdroid/payload/config/config.proto
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+syntax = "proto3";
+
+package android.microdroid;
+
+// This .proto is for the schema of a VM payload config (JSON)
+
+message PayloadConfig {
+  uint32 version = 1;
+
+  OsConfig os = 2;
+
+  Task task = 3;
+
+  repeated ApexConfig apexes = 4;
+}
+
+message OsConfig {
+  // for now "microdroid" is the only type we support
+  string name = 1;
+}
+
+message Task {
+  enum TaskType {
+    EXECUTABLE = 0,          // "executable" in JSON
+    MICRODROID_LAUNCHER = 1, // "microdroid_launcher" in JSON
+  }
+  // when the type is "microdroid_launcher", command is searched in /mnt/apk/lib/{arch}"
+  TaskType type = 1;
+
+  string command = 2;
+  repeated string args = 3;
+}
+
+message ApexConfig {
+  string name = 1;
+
+  // TODO(b/186396080) An APEX can be identified either by
+  // (1) its name
+  // (2) name and public key (or cert)
+  // or (3) name and exact hash.
+  // Rollback index should be supported for the case (2).
+}
diff --git a/microdroid/payload/config/src/lib.rs b/microdroid/payload/config/src/lib.rs
new file mode 100644
index 0000000..6dc127b
--- /dev/null
+++ b/microdroid/payload/config/src/lib.rs
@@ -0,0 +1,89 @@
+// Copyright 2021, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! VM Payload Config
+
+use serde::{Deserialize, Serialize};
+
+/// VM payload config
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct VmPayloadConfig {
+    /// OS config. Default: "microdroid"
+    #[serde(default)]
+    pub os: OsConfig,
+
+    /// Task to run in a VM
+    #[serde(default)]
+    pub task: Option<Task>,
+
+    /// APEXes to activate in a VM
+    #[serde(default)]
+    pub apexes: Vec<ApexConfig>,
+}
+
+/// OS config
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct OsConfig {
+    /// The name of OS to use
+    pub name: String,
+}
+
+impl Default for OsConfig {
+    fn default() -> Self {
+        Self { name: "microdroid".to_owned() }
+    }
+}
+
+/// Payload's task can be one of plain executable
+/// or an .so library which can be started via /system/bin/microdroid_launcher
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum TaskType {
+    /// Task's command indicates the path to the executable binary.
+    #[serde(rename = "executable")]
+    Executable,
+    /// Task's command indicates the .so library in /mnt/apk/lib/{arch}
+    #[serde(rename = "microdroid_launcher")]
+    MicrodroidLauncher,
+}
+
+/// Task to run in a VM
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct Task {
+    /// Decides how to execute the command: executable(default) | microdroid_launcher
+    #[serde(default, rename = "type")]
+    pub type_: TaskType,
+
+    /// Command to run
+    /// - For executable task, this is the path to the executable.
+    /// - For microdroid_launcher task, this is the name of .so
+    pub command: String,
+
+    /// Args to the command
+    #[serde(default)]
+    pub args: Vec<String>,
+}
+
+impl Default for TaskType {
+    fn default() -> TaskType {
+        TaskType::Executable
+    }
+}
+
+/// APEX config
+/// For now, we only pass the name of APEX.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct ApexConfig {
+    /// The name of APEX
+    pub name: String,
+}
diff --git a/microdroid/sepolicy/system/private/microdroid_launcher.te b/microdroid/sepolicy/system/private/microdroid_launcher.te
index 35286a6..e68b687 100644
--- a/microdroid/sepolicy/system/private/microdroid_launcher.te
+++ b/microdroid/sepolicy/system/private/microdroid_launcher.te
@@ -9,6 +9,9 @@
 allow microdroid_launcher adbd:fd use;
 allow microdroid_launcher adbd:unix_stream_socket { read write };
 
+# microdroid_launcher is launched by microdroid_manager with fork/execvp.
+allow microdroid_launcher microdroid_manager:fd use;
+
 # Allow to use FDs inherited from the shell. This includes the FD opened for
 # the microdroid_launcher executable itself and the FD for adb connection.
 # TODO(b/186396070) remove this when this is executed from microdroid_manager
diff --git a/microdroid_manager/Android.bp b/microdroid_manager/Android.bp
index ea811c8..cb628b1 100644
--- a/microdroid_manager/Android.bp
+++ b/microdroid_manager/Android.bp
@@ -11,8 +11,10 @@
     rustlibs: [
         "libandroid_logger",
         "libanyhow",
+        "libkeystore2_system_property-rust",
         "liblog_rust",
         "libmicrodroid_metadata_proto_rust",
+        "libmicrodroid_payload_config",
         "libprotobuf",
         "libserde_json",
         "libserde",
diff --git a/microdroid_manager/src/main.rs b/microdroid_manager/src/main.rs
index 1ab17d5..ae72a59 100644
--- a/microdroid_manager/src/main.rs
+++ b/microdroid_manager/src/main.rs
@@ -16,39 +16,76 @@
 
 mod ioutil;
 mod metadata;
-mod payload_config;
 
 use android_logger::Config;
+use anyhow::{anyhow, bail, Result};
+use keystore2_system_property::PropertyWatcher;
 use log::{info, Level};
-use payload_config::{Task, VmPayloadConfig};
-use std::io;
+use microdroid_payload_config::{Task, TaskType, VmPayloadConfig};
+use std::fs;
 use std::path::Path;
-use std::process::{Command, Stdio};
+use std::process::Command;
+use std::time::Duration;
+
+const WAIT_TIMEOUT: Duration = Duration::from_secs(10);
 
 const LOG_TAG: &str = "MicrodroidManager";
 
-fn main() -> io::Result<()> {
+fn main() -> Result<()> {
     android_logger::init_once(Config::default().with_tag(LOG_TAG).with_min_level(Level::Debug));
 
     info!("started.");
 
     let metadata = metadata::load()?;
     if !metadata.payload_config_path.is_empty() {
-        let config = VmPayloadConfig::load_from(Path::new(&metadata.payload_config_path))?;
+        let config = load_config(Path::new(&metadata.payload_config_path))?;
+
+        // TODO(jooyung): wait until sys.boot_completed?
         if let Some(main_task) = &config.task {
-            exec(main_task)?;
+            exec_task(main_task)?;
         }
     }
 
     Ok(())
 }
 
-/// executes a task
-/// TODO(jooyung): fork a child process
-fn exec(task: &Task) -> io::Result<()> {
-    info!("executing main task {} {:?}...", task.command, task.args);
-    let exit_status =
-        Command::new(&task.command).args(&task.args).stdout(Stdio::inherit()).status()?;
-    info!("exit with {}", &exit_status);
+fn load_config(path: &Path) -> Result<VmPayloadConfig> {
+    info!("loading config from {:?}...", path);
+    let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)?;
+    Ok(serde_json::from_reader(file)?)
+}
+
+fn exec_task(task: &Task) -> Result<()> {
+    info!("executing main task {:?}...", task);
+    build_command(task)?.spawn()?;
     Ok(())
 }
+
+fn build_command(task: &Task) -> Result<Command> {
+    Ok(match task.type_ {
+        TaskType::Executable => {
+            let mut command = Command::new(&task.command);
+            command.args(&task.args);
+            command
+        }
+        TaskType::MicrodroidLauncher => {
+            let mut command = Command::new("/system/bin/microdroid_launcher");
+            command.arg(find_library_path(&task.command)?).args(&task.args);
+            command
+        }
+    })
+}
+
+fn find_library_path(name: &str) -> Result<String> {
+    let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?;
+    let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?;
+    let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?;
+    let path = format!("/mnt/apk/lib/{}/{}", abi, name);
+
+    let metadata = fs::metadata(&path)?;
+    if !metadata.is_file() {
+        bail!("{} is not a file", &path);
+    }
+
+    Ok(path)
+}
diff --git a/microdroid_manager/src/payload_config.rs b/microdroid_manager/src/payload_config.rs
deleted file mode 100644
index bac841a..0000000
--- a/microdroid_manager/src/payload_config.rs
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2021, The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! VM Payload Config
-
-use log::info;
-use serde::{Deserialize, Serialize};
-use std::io;
-use std::path::Path;
-use std::time::Duration;
-
-use crate::ioutil;
-
-const WAIT_TIMEOUT: Duration = Duration::from_secs(10);
-
-#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
-pub struct VmPayloadConfig {
-    #[serde(default)]
-    pub task: Option<Task>,
-}
-
-#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
-pub struct Task {
-    pub command: String,
-    #[serde(default)]
-    pub args: Vec<String>,
-}
-
-impl VmPayloadConfig {
-    pub fn load_from(path: &Path) -> io::Result<VmPayloadConfig> {
-        info!("loading config from {:?}...", path);
-        let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)?;
-        Ok(serde_json::from_reader(file)?)
-    }
-}
diff --git a/tests/testapk/assets/vm_config.json b/tests/testapk/assets/vm_config.json
index e619c3b..7a3df7a 100644
--- a/tests/testapk/assets/vm_config.json
+++ b/tests/testapk/assets/vm_config.json
@@ -1,6 +1,13 @@
 {
+  "os": {
+    "name": "microdroid"
+  },
   "task": {
-    "command": "echo",
-    "args": ["hello", "microdroid"]
+    "type": "microdroid_launcher",
+    "command": "MicrodroidTestNativeLib.so",
+    "args": [
+      "hello",
+      "microdroid"
+    ]
   }
 }
\ No newline at end of file