feat(lab12): kata vs runc isolation + perf + escape PoC

[semyonnadutkin]

Goal

This PR delivers the Lab 12 bonus submission covering Kata Containers installation, runtime comparison with runc, isolation analysis, performance benchmarking, and a container escape demonstration.

Changes

• Added submissions/lab12.md with:
  • Kata Containers setup details
  • runc vs Kata kernel comparison
  • /dev and Linux capability isolation analysis
  • startup and I/O benchmark results
  • security/performance trade-off analysis
  • privileged container escape PoC comparison
• Added benchmark and runtime comparison results for Lab 12.
• Documented Kata's microVM isolation model and its impact on container escape scenarios.

Testing

Verified the required software components presence.

Commands executed:

lsmod | grep -E "kvm_intel|kvm_amd"
ls -la /dev/kvm
containerd --version

Observed output:

kvm_intel             552960  0
kvm                  1527808  1 kvm_intel
crw-rw----+ 1 root kvm 10, 232 Jul 15 12:55 /dev/kvm
containerd containerd v2.2.6 11ce9d5f3c68c941867e82890e93e815c1304f1b

Artifacts & Screenshots

Artifacts

• submissions/lab12.md

Screenshots

Checklist

• Title is clear (feat(lab12): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/lab12.md exists
• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + 5-run startup + I/O benchmark with trade-off analysis
• Bonus — Escape PoC succeeds on runc, fails on Kata (with host-side verification)