feat(lab12): complete kata vs runc comparison with escape PoC

[Wilikson173]

Goal

This PR delivers a complete comparison of Kata Containers vs runc: installation, side‑by‑side isolation tests (kernel, /dev, capabilities), performance benchmarks (startup time, I/O throughput), and a real container‑escape PoC demonstrating that Kata blocks what runc allows.

Changes

• submissions/lab12.md — full report with analysis and conclusions
• labs/lab12/results/runc-kernel.txt — kernel info inside runc container
• labs/lab12/results/kata-kernel.txt — kernel info inside Kata container (different kernel, proving VM isolation)
• labs/lab12/results/runc-devs.txt — /dev listing in runc
• labs/lab12/results/kata-devs.txt — /dev listing in Kata (fewer devices, more restricted)
• labs/lab12/results/dev-diff.txt — diff between the two (/dev/core absent in Kata)
• labs/lab12/results/runc-caps.txt — Linux capabilities in runc
• labs/lab12/results/kata-caps.txt — Linux capabilities in Kata (identical, but VM boundary provides extra isolation)
• labs/lab12/results/startup-bench.txt — 5‑run cold‑start benchmark for both runtimes
• labs/lab12/results/io-bench.txt — I/O throughput benchmark (100MB dd to /dev/null)
• labs/lab12/results/kata-escape-attempt.txt — output when trying to escape from Kata (fails, host file untouched)

Testing

All tests were run on a KVM‑capable Kali Linux host (kernel 6.12.33) with Kata Containers 3.32.0 and containerd 1.7.24.

1. Kernel comparison (Task 1)

# runc (host kernel)
nerdctl run --rm alpine:3.20 sh -c "uname -a"
Linux be6c2de605fc 6.12.33+kali-amd64 ...

# kata (VM kernel)
nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 sh -c "uname -a"
Linux 21ef90bc1e2f 6.18.35 ...

### 2. Isolation tests (Task 2)

# /dev comparison
nerdctl run --rm alpine:3.20 ls /dev > runc-devs.txt
nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 ls /dev > kata-devs.txt
diff runc-devs.txt kata-devs.txt
# Output: 1d0 / < core (Kata lacks /dev/core)

# Capabilities
nerdctl run --rm alpine:3.20 sh -c "grep ^Cap /proc/1/status" > runc-caps.txt
nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 sh -c "grep ^Cap /proc/1/status" > kata-caps.txt

### 3. Performance benchmarks (Task 2)

# Startup time (5 runs each)
=== runc ===
1: 0.5344 s
2: 0.5069 s
3: 0.5117 s
4: 0.5089 s
5: 0.5376 s
Average: 0.5199 s

=== kata ===
1: 2.1820 s
2: 1.9696 s
3: 2.1509 s
4: 2.0381 s
5: 2.2453 s
Average: 2.1172 s
Overhead: ~4.07×

# I/O throughput (100MB dd to /dev/null)
=== runc I/O ===
104857600 bytes (100.0MB) copied, 0.007597 seconds, 12.9GB/s
=== kata I/O ===
104857600 bytes (100.0MB) copied, 0.008624 seconds, 11.3GB/s

### 4. Container escape PoC (Bonus)

# Prepare target file on host
echo "original" | sudo tee /tmp/lab12-target

# runc — escape succeeds
nerdctl run --rm --privileged -v /tmp:/host_tmp alpine:3.20 \
  sh -c 'echo "OVERWRITTEN BY RUNC" > /host_tmp/lab12-target'
sudo cat /tmp/lab12-target
# Output: OVERWRITTEN BY RUNC

# Reset target
echo "original" | sudo tee /tmp/lab12-target

# Kata — escape blocked
nerdctl run --rm --runtime=io.containerd.kata.v2 --privileged -v /tmp:/host_tmp alpine:3.20 \
  sh -c 'echo "ATTEMPTED OVERWRITE FROM KATA" > /host_tmp/lab12-target'
sudo cat /tmp/lab12-target
# Output: original (unchanged!)

## Artifacts & Screenshots

~ submissions/lab12.md — full report with all analysis
~ labs/lab12/results/*.txt — all raw benchmark and test outputs
~ No screenshots needed for this lab (all data is text‑based)

## Checklist
- [+] Title follows feat(lab12): <topic> style
- [+] No secrets or large temp files committed
- [+] Submission file exists at submissions/lab12.md