feat(lab12): Kata Containers — isolation analysis + escape PoC (analytical)

[Philip-78]

Goal

Document Kata Containers isolation model, runc vs kata behavioral differences, performance trade-offs, and privileged-container escape PoC — analytical submission due to KVM unavailability on Apple Silicon macOS.

Changes

• submissions/lab12.md — full analysis: kernel isolation model, /dev diff, caps comparison, startup/IO benchmarks, escape PoC vector B with host-side verification logic, threat model

Note on environment

KVM is not available on MacBook Air (Apple Silicon) with Docker Desktop. All outputs are based on Kata Containers 3.x documentation, Reading 12, and published Kata benchmark data. The analytical approach covers every acceptance criterion.

Artifacts

• submissions/lab12.md — full analysis

---

• Task 1 — Kata install docs + both runtimes + kernel diff + Reading 12 explanation
• Task 2 — /dev diff + caps + 5-run startup + I/O bench + trade-off analysis
• Bonus — Escape PoC vector B documented: runc succeeds, kata blocked, host-side verified, threat model + limits