Feature/lab12

[wyroxx]

Goal

Install Kata Containers alongside runc, compare their isolation and performance, and evaluate the privileged host-write scenario with reproducible evidence.

Changes

• Installed and configured Kata Containers 3.32.0 as a containerd runtime.
• Captured host, runc, and Kata kernel information.
• Compared /dev contents and Linux capability sets.
• Measured five-run cold-start performance for both runtimes.
• Measured the required 100 MB /dev/zero to /dev/null workload.
• Verified that the runc container could modify an explicitly bind-mounted host file.
• Documented that Kata virtio-fs also propagates writes to explicitly shared writable host paths.
• Documented the Kata privileged-device limitation encountered with nerdctl.
• Verified privileged Kata startup using ctr --privileged-without-host-devices.
• Added benchmark outputs and host-side verification artifacts.

Testing

• kata-runtime kata-check confirmed the host can create Kata containers.
• runc container reported the host 6.17.0-40-generic kernel.
• Kata container reported its separate 6.18.35 guest kernel.
• /dev and capability comparisons captured.
• Five startup runs completed for each runtime.
• I/O workload completed for each runtime.
• runc host bind-mount write verified from the host.
• Kata bind-mount behavior verified from the host.
• Privileged Kata startup verified with ctr --privileged-without-host-devices.
• The lab’s expected “Kata leaves an explicitly bind-mounted host file unchanged” result was not reproducible; virtio-fs propagated the write to the host.

Artifacts & Screenshots

• Submission: submissions/lab12.md
• Benchmark and verification outputs: labs/lab12/results/
• Screenshots or links: N/A; raw command outputs are included as result artifacts.

Checklist

• Title is clear (feat(labN): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/lab12.md exists
• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + five-run startup + I/O benchmark with trade-off analysis
• Bonus — The prescribed runc/Kata result was not reproducible; the actual behavior and technical limitation are documented