feat(lab12): kata vs runc isolation + perf + escape PoC

labs/lab12/scripts/configure-containerd-kata.sh

@@ -1,17 +1,10 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# configure-containerd-kata.sh
-# Idempotently ensure containerd has the Kata runtime configured:
-#   [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata]
-#     runtime_type = "io.containerd.kata.v2"
-#
-# Usage:
-#   sudo bash labs/lab12/scripts/configure-containerd-kata.sh
+# Add the Kata runtime to containerd config.
+# Usage: sudo bash labs/lab12/scripts/configure-containerd-kata.sh
 
-CONF_DEFAULT="/etc/containerd/config.toml"
-# Allow override via $CONF or first CLI arg
-CONF="${CONF:-${1:-$CONF_DEFAULT}}"
+CONF="${CONF:-/etc/containerd/config.toml}"
 TMP=$(mktemp)
 
 backup() {
@@ -22,73 +15,36 @@ backup() {
 
 ensure_default() {
   if [ ! -s "$CONF" ]; then
-    echo "Generating default containerd config at $CONF" >&2
     mkdir -p "$(dirname "$CONF")"
     containerd config default > "$CONF"
   fi
 }
 
-detect_header() {
-  # Prefer v3 split-CRI path if present; otherwise fallback to grpc path
-  if grep -q "^\[plugins\.'io\.containerd\.cri\.v1\.runtime'\]" "$CONF"; then
-    echo "[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.kata]"
-  else
-    echo "[plugins.'io.containerd.grpc.v1.cri'.containerd.runtimes.kata]"
-  fi
-}
-
 insert_or_update_kata() {
-  local header
-  header=$(detect_header)
+  local header="[plugins.'io.containerd.grpc.v1.cri'.containerd.runtimes.kata]"
   local value="  runtime_type = 'io.containerd.kata.v2'"
 
-  # Process file: update runtime_type inside the kata table if it exists,
-  # otherwise append a new table at the end.
-  awk -v hdr="$header" -v val="$value" '
-    BEGIN { inside=0; updated=0 }
-    {
-      if ($0 == hdr) {
-        print $0; inside=1; next
-      }
-      if (inside) {
-        if ($0 ~ /^\[/) {
-          if (!updated) print val
-          inside=0
-          print $0
-          next
-        }
-        if ($0 ~ /^\s*runtime_type\s*=\s*/){
-          print val; updated=1; next
-        }
-        print $0; next
-      }
-      print $0
-    }
-    END {
-      if (inside && !updated) {
-        print val
-      } else if (!inside && NR > 0) {
-        # Check if header ever appeared; if not, append it.
-        # We can infer by searching the output later, but simpler: do a second pass.
+  if grep -qF "$header" "$CONF"; then
+    awk -v hdr="$header" -v val="$value" '
+      BEGIN { inside=0 }
+      {
+        if ($0 == hdr) { inside=1; print $0; next }
+        if (inside && $0 ~ /^\[/) { inside=0; print $0; next }
+        if (inside && $0 ~ /^\s*runtime_type\s*=/) { print val; next }
+        print $0
       }
-    }
-  ' "$CONF" > "$TMP"
-
-  if ! grep -qF "$header" "$TMP"; then
-    {
-      printf '\n%s\n%s\n' "$header" "$value"
-    } >> "$TMP"
+    ' "$CONF" > "$TMP"
+  else
+    cp "$CONF" "$TMP"
+    printf '
+%s
+%s
+' "$header" "$value" >> "$TMP"
   fi
-
   install -m 0644 "$TMP" "$CONF"
 }
 
-main() {
-  backup
-  ensure_default
-  insert_or_update_kata
-  echo "Updated $CONF with Kata runtime: io.containerd.kata.v2" >&2
-  echo "Restart containerd to apply: sudo systemctl restart containerd" >&2
-}
-
-main "$@"
+backup
+ensure_default
+insert_or_update_kata
+echo "Updated $CONF with Kata runtime. Restart containerd to apply." >&2

labs/lab12/scripts/install-kata-assets.sh

@@ -1,19 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# install-kata-assets.sh
-# Download and install Kata Containers static assets (kernel, rootfs image,
-# default runtime-rs configuration) under /opt/kata, and ensure a
-# configuration file exists in an expected path for runtime-rs.
-#
-# Usage:
-#   sudo bash labs/lab12/scripts/install-kata-assets.sh [KATA_VER]
-#
-# Notes:
-# - Requires: curl, jq, tar (with zstd support), and root privileges.
-# - Creates or updates a symlink at:
-#     /etc/kata-containers/runtime-rs/configuration.toml
-#   pointing to the installed default configuration.
+# Install Kata Containers static assets under /opt/kata.
+# Usage: sudo bash labs/lab12/scripts/install-kata-assets.sh [KATA_VER]
 
 VER_ARG=${1:-}
 ARCH=$(uname -m)
@@ -36,44 +25,16 @@ echo "Installing Kata static assets ${KATA_VER} for ${ARCH}" >&2
 TMP_TAR=$(mktemp --suffix=.tar.zst)
 curl -fL -o "${TMP_TAR}" "${ASSET_URL}"
 
-# Extract to root; archive lays files under /opt/kata, /usr/local/bin, etc.
-# Prefer explicit decompressor if available to avoid tar invoking external zstd unexpectedly.
 if command -v zstd >/dev/null 2>&1; then
   zstd -d -c "${TMP_TAR}" | tar -xf - -C /
 elif command -v unzstd >/dev/null 2>&1; then
   unzstd -c "${TMP_TAR}" | tar -xf - -C /
 elif tar --help 2>/dev/null | grep -q -- '--zstd'; then
   tar --zstd -xf "${TMP_TAR}" -C /
 else
-  echo "Missing zstd support to extract ${TMP_TAR}." >&2
-  echo "Install the zstd package (e.g., sudo apt-get update && sudo apt-get install -y zstd) and re-run." >&2
+  echo "Missing zstd support. Install zstd and re-run." >&2
   exit 1
 fi
 rm -f "${TMP_TAR}"
 
-# Link configuration to an expected path for runtime-rs
-sudo mkdir -p /etc/kata-containers/runtime-rs
-SRC_CANDIDATES=(
-  "/opt/kata/share/defaults/kata-containers/runtime-rs/configuration-dragonball.toml"
-  "/opt/kata/share/defaults/kata-containers/configuration-dragonball.toml"
-  "/opt/kata/share/defaults/kata-containers/runtime-rs/configuration.toml"
-  "/usr/share/defaults/kata-containers/runtime-rs/configuration.toml"
-)
-
-for src in "${SRC_CANDIDATES[@]}"; do
-  if [[ -f "$src" ]]; then
-    ln -sf "$src" /etc/kata-containers/runtime-rs/configuration.toml
-    echo "Linked runtime-rs config -> $src" >&2
-    break
-  fi
-done
-
-if [[ ! -f /etc/kata-containers/runtime-rs/configuration.toml ]]; then
-  echo "Warning: could not find a default runtime-rs configuration in known locations." >&2
-  echo "Check /opt/kata/share/defaults/kata-containers/ and create: /etc/kata-containers/runtime-rs/configuration.toml" >&2
-  exit 1
-fi
-
-echo "Kata assets installed. Restart containerd and test a kata container." >&2
-echo "  sudo systemctl restart containerd" >&2
-echo "  sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 uname -a" >&2
+echo "Kata assets installed. Restart containerd: sudo systemctl restart containerd" >&2

labs/lab12/setup/build-kata-runtime.sh

@@ -1,56 +1,28 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Build Kata Containers 3.x Rust runtime (containerd-shim-kata-v2)
-# inside a temporary Rust toolchain container, and place the binary
-# into the provided output directory. This avoids installing build
-# dependencies on the host.
-#
-# Usage:
-#   bash labs/lab12/setup/build-kata-runtime.sh
-#   # result: labs/lab12/setup/kata-out/containerd-shim-kata-v2
+# Build the Kata containerd shim in a Rust container.
+# Result: labs/lab12/setup/kata-out/containerd-shim-kata-v2
 
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../.. && pwd)"
-WORK_DIR="${ROOT_DIR}/lab12/setup/kata-build"
-OUT_DIR="${ROOT_DIR}/lab12/setup/kata-out"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WORK_DIR="${ROOT_DIR}/labs/lab12/setup/kata-build"
+OUT_DIR="${ROOT_DIR}/labs/lab12/setup/kata-out"
 
 mkdir -p "${WORK_DIR}" "${OUT_DIR}"
 
-echo "Building Kata runtime in Docker..." >&2
-docker run --rm \
-  -e CARGO_NET_GIT_FETCH_WITH_CLI=true \
-  -v "${WORK_DIR}":/work \
-  -v "${OUT_DIR}":/out \
-  rust:1.75-bookworm bash -lc '
+docker run --rm   -v "${WORK_DIR}":/work   -v "${OUT_DIR}":/out   rust:1.75-bookworm bash -lc '
     set -euo pipefail
-    apt-get update && apt-get install -y --no-install-recommends \
-      git make gcc pkg-config ca-certificates musl-tools libseccomp-dev && \
-      update-ca-certificates || true
-
-    # Ensure cargo/rustup are available
+    apt-get update && apt-get install -y --no-install-recommends git make gcc pkg-config ca-certificates musl-tools libseccomp-dev
     export PATH=/usr/local/cargo/bin:$PATH
-    rustc --version; cargo --version; rustup --version || true
-
     cd /work
     if [ ! -d kata-containers ]; then
       git clone --depth 1 https://github.com/kata-containers/kata-containers.git
     fi
     cd kata-containers/src/runtime-rs
-
-    # Add MUSL target for static build expected by runtime Makefile
     rustup target add x86_64-unknown-linux-musl || true
-
-    # Build the runtime (shim v2)
     make
-
-    # Collect the produced binary
     f=$(find target -type f -name containerd-shim-kata-v2 | head -n1)
-    if [ -z "$f" ]; then
-      echo "ERROR: built binary not found" >&2; exit 1
-    fi
     install -m 0755 "$f" /out/containerd-shim-kata-v2
-    strip /out/containerd-shim-kata-v2 || true
-    /out/containerd-shim-kata-v2 --version || true
   '
 
-echo "Done. Binary saved to: ${OUT_DIR}/containerd-shim-kata-v2" >&2
+echo "Done. Binary: ${OUT_DIR}/containerd-shim-kata-v2"