feat(lab12): kata vs runc isolation + perf + escape PoC

[sofifaro]

Goal

This PR completes Lab 12 by configuring Kata Containers as a containerd runtime and comparing its VM-backed isolation with the default runc runtime.

Changes

• Added Kata installation and containerd runtime configuration.
• Captured host, runc and Kata kernel information.
• Compared device visibility and Linux capability masks.
• Added five-run startup and 100 MiB I/O benchmarks.
• Demonstrated that a privileged host-namespace write succeeds with runc while the equivalent Kata launch is rejected.
• Added the completed Markdown report and benchmark evidence.

Results

• Kata version: 3.31.0
• runc average startup: 0.206 s
• Kata average startup: 1.250 s
• Cold-start overhead: approximately 6.08×
• runc I/O throughput: 4.9 GB/s
• Kata I/O throughput: 2.2 GB/s
• runc host write: successful
• Kata host PID namespace request: rejected
• Kata host-side target: unchanged

Files

• labs/lab12/results/
• submissions/lab12.md

Checklist

• Task 1 — Kata installed; both runtimes tested; kernel difference documented
• Task 2 — device, capability, startup and I/O comparisons documented
• Bonus — privileged host-namespace test shown for runc and Kata