docs(lab12): add lab12 — kata containers VM-backed sandboxing

[3llimi]

Goal

Install and configure Kata Containers as a VM-backed container runtime on WSL2 (Ubuntu 24.04 / KVM), run OWASP Juice Shop under runc and compare it against Kata isolation, execute isolation tests proving the VM boundary, and document performance trade-offs between the two runtimes.

Changes

• labs/submission12.md — full lab writeup covering all 4 tasks with commands, outputs, and analysis
• labs/lab12/setup/kata-built-version.txt — containerd-shim-kata-v2 --version output (Kata 3.28.0 runtime-rs)
• labs/lab12/runc/health.txt — HTTP 200 health check for juice-runc on port 3012
• labs/lab12/kata/test1.txt — uname -a inside Kata container (guest kernel 6.12.47)
• labs/lab12/kata/kernel.txt — uname -r inside Kata container
• labs/lab12/isolation/dmesg.txt — Kata VM boot log proving separate guest kernel
• labs/lab12/isolation/proc.txt — /proc entry counts (host: 119 vs Kata VM: 52)
• labs/lab12/isolation/network.txt — Kata VM dedicated virtual NIC (10.4.0.10/24)
• labs/lab12/isolation/modules.txt — kernel module counts (host: 114 vs Kata VM: 72)
• labs/lab12/bench/startup.txt — startup time comparison (runc: 1.148s, Kata: 2.664s)
• labs/lab12/bench/http-latency.txt — 50-request HTTP latency baseline (avg: 0.0030s)
• labs/lab12/analysis/kernel-comparison.txt — host vs guest kernel versions
• labs/lab12/analysis/cpu-comparison.txt — real i5-12450H vs virtualized Intel Xeon

Testing

• Verified KVM availability in WSL2: egrep -c '(vmx|svm)' /proc/cpuinfo → 24, /dev/kvm present
• Confirmed Kata shim version: containerd-shim-kata-v2 --version → 3.28.0 (runtime-rs / Rust)
• Verified Kata runtime with: sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 uname -r → 6.12.47
• Confirmed runc Juice Shop health: curl http://localhost:3012 → HTTP 200
• Ran all isolation tests: dmesg, /proc count, network interfaces, kernel module count
• Measured startup time with time for both runtimes
• Collected 50-request HTTP latency baseline with curl

Artifacts & Screenshots

• labs/lab12/setup/kata-built-version.txt — shim version evidence
• labs/lab12/kata/test1.txt — Kata container running with guest kernel 6.12.47
• labs/lab12/isolation/dmesg.txt — VM boot log proving kernel isolation
• labs/lab12/bench/startup.txt — runc vs Kata startup time comparison
• labs/lab12/bench/http-latency.txt — HTTP latency results for juice-runc

WSL2-specific note: Default Kata QEMU config requires vhost_vsock which the Microsoft WSL2 kernel does not include. Resolved by switching to runtime-rs + Dragonball hypervisor (configuration-dragonball.toml), which uses virtio-mmio and is fully compatible with WSL2 KVM.

---

Checklist

• PR title is clear and descriptive
• Documentation updated if needed
• No secrets or large temporary files committed