I would like to create KVM containers which will come with a default password.
As a security measure I would like to force them to change password at 1st login, how should I proceed?
Password expiration is supported by the OS itself so that shouldn't be an issue. You can build a skeleton user directory through /usr/share/skel (see also that adduser manualpage) and there you could set up a script which forces users to change their password. When done you'd remove the script and you're set up.