feat(lab12): kata vs runc isolation + perf + escape PoC - #13

Goal

Complete Lab 12 by evaluating runc vs Kata Containers isolation and performance, documenting the local runc results, the privileged-container host-write PoC, and the Kata blocker caused by unavailable KVM in WSL2.

Changes

• submissions/lab12.md — added the Lab 12 report with host environment details, runc kernel/dev/capability captures, startup and I/O benchmark results, privileged host-write PoC output, and a short explanation of why Kata could not start.
• labs/lab12/results/ — generated local evidence files for preflight checks, runc runtime output, benchmarks, and PoC verification. This directory is ignored by .gitignore.

Testing

Host / KVM Preflight

wsl -d Ubuntu -- bash -lc "uname -a; ls -la /dev/kvm 2>&1 || true; command -v containerd || true; command -v nerdctl || true; command -v docker || true"
Expected: /dev/kvm is not available in WSL2 during the lab run, so Kata cannot boot its KVM-backed micro-VM.

runc Kernel / Isolation Checks

docker run --rm alpine:3.20 sh -c "uname -a; head -3 /proc/cpuinfo"
docker run --rm alpine:3.20 ls /dev
docker run --rm alpine:3.20 sh -c "grep ^Cap /proc/1/status"
Expected: runc container runs successfully and reports the shared WSL2 host kernel, /dev entries, and Linux capability set.

runc Performance Benchmark

docker run --rm alpine:3.20 echo hello
docker run --rm alpine:3.20 sh -c "dd if=/dev/zero of=/dev/null bs=1M count=100 2>&1"
Expected: startup and 100MB I/O benchmark outputs are captured for runc.

Bonus PoC — runc Host Write

docker run --rm --privileged --mount type=bind,source="${PWD}\labs\lab12\results",target=/host_tmp alpine:3.20 sh -c 'echo OVERWRITTEN BY RUNC CONTAINER > /host_tmp/lab12-target && cat /host_tmp/lab12-target'
Expected: runc privileged container writes to the host-mounted file, and host-side verification shows OVERWRITTEN BY RUNC CONTAINER.

Artifacts & Screenshots

Submission report: submissions/lab12.md
Local evidence files: labs/lab12/results/

Required checklist:

• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + 5-run startup + I/O benchmark with trade-off analysis
• Bonus — Escape PoC succeeds on runc, fails on Kata (with host-side verification)

Note:
Task 1 — Kata hello-world/kernel evidence blocked by missing /dev/kvm
Task 2 — Kata isolation and benchmark data blocked by missing /dev/kvm
Bonus — Kata blocked result could not be executed without a KVM-backed Kata runtime