feat(lab12): kata vs runc isolation + perf + escape PoC

[err0r522]

Goal

Install Kata, confirm the kernel inside the Kana container differs, quantify and analyze trade-offs, perform a real Container-Escape PoC and confirm it fails on Kata.

Changes

• submissions/lab12.md

Testing

# Confirm Linux host with KVM and /dev/kvm is readable.
lsmod | grep -E "kvm_intel|kvm_amd" && ls -la /dev/kvm

# Confirm containerd installation
sudo systemctl status containerd

# Confirm nerdct installation
nerdctl --version

# Verify Kata installation
grep -A 2 'runtimes.kata' /etc/containerd/config.toml
cat /opt/kata/VERSION

# Confirm different kernels on runc and Kata
sudo nerdctl run --rm alpine:3.20 sh -c "uname -a; head -3 /proc/cpuinfo" \
  > labs/lab12/results/runc-kernel.txt 2>&1
cat labs/lab12/results/runc-kernel.txt

sudo nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 \
  sh -c "uname -a; head -3 /proc/cpuinfo" \
  > labs/lab12/results/kata-kernel.txt 2>&1
cat labs/lab12/results/kata-kernel.txt

Artifacts & Screenshots

---

Checklist

• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + 5-run startup + I/O benchmark with trade-off analysis
• Bonus — Escape PoC succeeds on runc, fails on Kata (with host-side verification)