Feature/lab12

[Lisoon22]

Goal

This PR delivers Lab 12 work: configuring Kata Containers with containerd, comparing Kata with runc, measuring the isolation/performance trade-off, and documenting a privileged host-write attempt.

Changes

• Added submissions/lab12.md with the complete Lab 12 report.
• Added relevant benchmark and runtime evidence under submissions/lab12-results/.
• Compared kernels, device exposure, Linux capability sets, startup latency, and I/O throughput.
• Documented the bonus privileged-container host-write test for both runc and Kata.
• Described appropriate Kata use cases, limitations, and residual security risks.

Testing

Commands used:

sudo bash labs/lab12/scripts/install-kata-assets.sh
sudo bash labs/lab12/scripts/configure-containerd-kata.sh
sudo systemctl restart containerd

sudo nerdctl run --rm alpine:3.20 \
  sh -c "uname -a; head -3 /proc/cpuinfo"

sudo nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 \
  sh -c "uname -a; head -3 /proc/cpuinfo"

sudo nerdctl run --rm alpine:3.20 \
  sh -c "grep ^Cap /proc/1/status"

sudo nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 \
  sh -c "grep ^Cap /proc/1/status"

sudo nerdctl run --rm alpine:3.20 \
  sh -c 'dd if=/dev/zero of=/dev/null bs=1M count=100 2>&1'

sudo nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 \
  sh -c 'dd if=/dev/zero of=/dev/null bs=1M count=100 2>&1'

sudo nerdctl run --rm --privileged -v /tmp:/host_tmp alpine:3.20 \
  sh -c 'echo "OVERWRITTEN BY RUNC CONTAINER" > /host_tmp/lab12-target'

sudo nerdctl run --rm --runtime=io.containerd.kata.v2 \
  --privileged -v /tmp:/host_tmp alpine:3.20 \
  sh -c 'echo "ATTEMPTED OVERWRITE FROM KATA" > /host_tmp/lab12-target'

Observed output:

runc kernel: 6.17.0-40-generic
Kata kernel: 6.18.35

Average startup time:
runc: 0.657 s
Kata: 2.152 s

I/O throughput:
runc: 8.4 GB/s
Kata: 1.8 GB/s

runc host verification:
OVERWRITTEN BY RUNC CONTAINER

Kata attempt:
Container creation failed while configuring /dev/full with EEXIST.
The payload did not execute.

Kata host verification:
original

Artifacts & Screenshots

• submissions/lab12.md
• submissions/lab12-results/startup-bench.csv
• submissions/lab12-results/startup-summary.txt
• submissions/lab12-results/runc-kernel.txt
• submissions/lab12-results/kata-kernel.txt
• submissions/lab12-results/runc-io.txt
• submissions/lab12-results/kata-io.txt
• submissions/lab12-results/bonus-bind-summary.txt

Checklist

• Title is clear (feat(lab12): compare Kata and runc isolation and performance)
• No secrets/large temp files committed
• Submission file at submissions/lab12.md exists