Feature/lab12

[raaller]

Goal

Compare runc and Kata Containers 3.32.0 using kernel-isolation evidence, startup and I/O benchmarks, and a privileged host-access demonstration.

Changes

• Add submissions/lab12.md with Task 1, Task 2, bonus results, and security trade-off analysis.
• Add runc and Kata kernel, device, capability, startup, and I/O benchmark outputs under labs/lab12/results/.
• Add host-side evidence showing that a privileged runc container can modify the host through the host PID namespace, while the equivalent Kata request is blocked.

Testing

# Verify nested KVM support
kvm-ok

# Observed output:
# INFO: /dev/kvm exists
# KVM acceleration can be used

# Verify the default runc runtime
sudo nerdctl run --rm alpine:3.20 uname -a

# Observed output:
# Linux ... 5.15.0-139-generic ... x86_64 Linux

# Verify the Kata runtime and separate guest kernel
sudo nerdctl run --rm \
  --runtime=io.containerd.kata.v2 \
  alpine:3.20 \
  uname -a

# Observed output:
# Linux ... 6.18.35 ... x86_64 Linux

# Collect Task 1 and Task 2 evidence
KATA_VERSION=3.32.0 ../temp/hoh.sh

# Observed output:
# Kata version: 3.32.0
# runc kernel: 5.15.0-139-generic
# Kata kernel: 6.18.35
#
# runc startup samples:
# 0.526595584
# 0.552260352
# 0.481219072
# 0.423924224
# 0.372067072
#
# Kata startup samples:
# 7.855792128
# 7.574585856
# 7.067718144
# 6.545513984
# 7.210876160
#
# runc average startup: 0.471213261 s
# Kata average startup: 7.250897254 s
# Cold-start overhead: 15.3877x
#
# runc I/O throughput: 20.7 GB/s
# Kata I/O throughput: 4.1 GB/s

# Complete and verify the privileged host-access experiment
../temp/finish-lab12.sh

# Observed output:
# host_release=5.15.0-139-generic
# runc_release=5.15.0-139-generic
# kata_release=6.18.35
#
# runc_container_exit=0
# runc_host_value=OVERWRITTEN THROUGH HOST PID NAMESPACE
# kata_container_exit=1
# kata_host_value=original
#
# Status: SUCCESS

# Validate the staged repository changes
git diff --cached --check
git status --short

# Observed output:
# No whitespace errors reported by git diff --cached --check
# submissions/lab12.md and labs/lab12/results/* are staged

Artifacts & Screenshots

• submissions/lab12.md

Checklist

• Title is clear (feat(lab12): kata vs runc isolation + perf + escape PoC)
• No secrets/large temp files committed
• Submission file at submissions/lab12.md exists
• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + 5-run startup + I/O benchmark with trade-off analysis
• Bonus — Escape PoC succeeds on runc, fails on Kata (with host-side verification)