feat(lab12): kata vs runc isolation + perf + escape PoC

[Muratich]

Goal

This PR delivers the completed bonus lab 12, comparing Kata Containers vs. runc in terms of isolation, performance, and a real container‑escape demonstration.

Changes

• Added:
  • submissions/lab12.md — full submission with Task 1 (installation + kernel diff), Task 2 (isolation /dev, capabilities, startup & I/O benchmarks, trade‑off analysis), and Bonus (escape PoC with runc success vs Kata blocked)
• Added benchmark outputs and verification files in labs/lab12/results/:
  • runc-kernel.txt, kata-kernel.txt
  • runc-caps.txt, kata-caps.txt
  • runc-devs.txt, kata-devs.txt, dev-diff.txt
  • startup-bench.txt, startup-avg.txt, io-bench.txt
  • runc-escape-output.txt, runc-host-verify.txt
  • kata-escape-attempt.txt, kata-host-verify.txt
• No other changes.

Testing

• Commands run (on a dual‑boot Ubuntu 24.04 with KVM):
  • sudo nerdctl run --rm alpine:3.20 sh -c "uname -a; head -3 /proc/cpuinfo"
  • sudo nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 sh -c "uname -a; head -3 /proc/cpuinfo"
  • Isolation: ls /dev, grep Cap /proc/1/status for both runtimes
  • Startup: 5‑run average with date +%s.%N
  • I/O: dd if=/dev/zero of=/dev/null bs=1M count=100
  • Escape PoC (vector B): sudo nerdctl run --rm --privileged -v /tmp:/host_tmp alpine:3.20 sh -c 'echo "OVERWRITTEN BY RUNC CONTAINER" > /host_tmp/lab12-target && cat /host_tmp/lab12-target' (succeeds on runc, fails on Kata)
• Observed results:
  • Kata runs with its own kernel (6.18.35) vs runc (6.14.0) – isolation visible
  • /dev/core missing in Kata, capability sets identical
  • Startup overhead ~2.5× (runc 0.578 s, kata 1.447 s)
  • I/O throughput nearly identical (~18‑20 GB/s)
  • runc escape modifies host file; Kata fails to start (device creation error) and host file remains untouched

Artifacts & Screenshots

• submissions/lab12.md — complete submission with all required sections
• All raw outputs are saved in labs/lab12/results/ (included in PR)
• No screenshots – command outputs are provided as text files.

Checklist

• Title is clear (feat(lab12): kata vs runc isolation + perf + escape PoC)
• No secrets or large temp files are committed
• Submission file at submissions/lab12.md exists and is filled
• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + 5-run startup + I/O benchmark with trade-off analysis
• Bonus — Escape PoC succeeds on runc, fails on Kata (with host-side verification)