feat(lab12): kata vs runc isolation + perf + escape PoC

[Esqavator]

Goal

Deliver Lab 12 by installing and configuring Kata Containers alongside runc, comparing their isolation and performance characteristics, and demonstrating a privileged host-write escape scenario with host-side verification.

Changes

• Added:

  • submissions/lab12.md with the complete Lab 12 report.
  • runc vs Kata kernel comparison.
  • /dev and Linux capability comparison.
  • Five-run startup benchmark.
  • I/O benchmark.
  • Bonus privileged host-write PoC with host-side verification.

• Modified:

  • Local containerd configuration to register the io.containerd.kata.v2 runtime.
  • Local Kata configuration to use QEMU and a separate guest kernel.

• Updated:

  • Documented the security and performance trade-offs between runc and Kata.
  • Documented the effect of a separate guest kernel on container escape risks.
  • Added conclusions for trusted, untrusted and multi-tenant workloads.

Testing

Commands executed:

sudo kata-runtime check

sudo nerdctl run --rm \
  alpine:3.20 \
  uname -a

sudo nerdctl run --rm \
  --runtime=io.containerd.kata.v2 \
  alpine:3.20 \
  uname -a

sudo nerdctl run --rm \
  alpine:3.20 \
  ls -1 /dev

sudo nerdctl run --rm \
  --runtime=io.containerd.kata.v2 \
  alpine:3.20 \
  ls -1 /dev

sudo nerdctl run --rm \
  alpine:3.20 \
  sh -c 'grep "^Cap" /proc/1/status'

sudo nerdctl run --rm \
  --runtime=io.containerd.kata.v2 \
  alpine:3.20 \
  sh -c 'grep "^Cap" /proc/1/status'

Observed kernel results:

Host kernel: 6.17.0-35-generic
runc kernel: 6.17.0-35-generic
Kata kernel: 6.18.35

Observed startup benchmark:

runc:
1: 2.235 s
2: 2.135 s
3: 2.102 s
4: 2.052 s
5: 2.036 s
Average: 2.112 s

Kata:
1: 2.738 s
2: 2.568 s
3: 2.535 s
4: 2.636 s
5: 2.469 s
Average: 2.589 s

Kata/runc startup overhead: 1.23x

Observed I/O benchmark:

runc: 100 MiB copied in 0.002176 seconds, 44.9 GB/s
Kata: 100 MiB copied in 0.001840 seconds, 53.1 GB/s

Observed Bonus PoC:

runc exit code: 0
Host after runc: OVERWRITTEN BY RUNC CONTAINER

Kata exit code: 1
Host after Kata: original

The privileged runc container modified the physical host file.

The equivalent privileged Kata configuration was rejected before the payload completed. Host-side verification confirmed that the physical host file remained unchanged.

Artifacts & Screenshots

• Submission file:

  • submissions/lab12.md

• Screenshots:

  • No screenshots required.
  • Command outputs and verification results are included in the submission file.

• Additional artifacts:

  • Local benchmark output files were used to prepare the report.
  • The local output files were not committed because the submission requires only submissions/lab12.md.

Checklist

• Title is clear (feat(labN): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/labN.md exists
• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + 5-run startup + I/O benchmark with trade-off analysis
• Bonus — Escape PoC succeeds on runc, fails on Kata (with host-side verification)