feat(lab12): kata vs runc isolation + perf + escape PoC

[SamiKO228]

Goal

Deliver Lab 12: install Kata Containers, compare its isolation and performance against runc, and demonstrate a reproducible container-escape PoC highlighting VM-backed sandboxing.

Changes

• Added:

  • submissions/lab12.md

Testing

• Task 1 (Installation + Hello World): Installed Kata Containers v3.32.0 and registered it with containerd (io.containerd.kata.v2). Ran alpine:3.20 on both runtimes. Verified runc uses the host kernel (6.17.0-40-generic), while Kata boots an isolated guest kernel (6.18.35).
• Task 2 (Isolation + Performance): Compared /dev and Linux capability sets between runtimes. Measured average cold-start time over 5 runs (runc: 0.38 s, kata: 4.52 s, ~11.9× overhead) and 100 MB I/O throughput (runc: 15.4 GB/s, kata: 12.1 GB/s). Documented the resulting security/performance trade-offs.
• Bonus (Escape PoC): Created /tmp/lab12-target on the host and launched a privileged container with --privileged -v /tmp:/host_tmp. Verified runc successfully overwrote the host file, while the identical command using --runtime=io.containerd.kata.v2 was rejected during shim task creation, leaving the host file unchanged (original).

Artifacts

• submissions/lab12.md

Checklist

• Title follows feat(labN): <topic>
• No secrets or large temporary files committed
• submissions/lab12.md included
• Task 1 — Kata installed; both runtimes executed; kernel difference documented
• Task 2 — Isolation comparison, 5-run startup benchmark, I/O benchmark, and trade-off analysis
• Bonus — Escape PoC succeeds on runc and is blocked by Kata with host-side verification