Lab 12: Kata vs runc isolation benchmark

[alberto-de-swerto]

What I did

• Task 1: installed Kata Containers 3.32.0 on a KVM-enabled Ubuntu 24.04 host and registered io.containerd.kata.v2 with containerd.
• Task 2: compared runc vs kata kernel view, /dev, capability sets, cold-start time, and 100MB dd throughput.
• Bonus: demonstrated privileged host write succeeds with runc and the same Kata attempt leaves the host file unchanged.

Notes

• Host used /dev/kvm on Ubuntu 24.04 with containerd 2.2.1 and nerdctl 2.1.3.
• Results are committed under labs/lab12/results/ because the lab deliverable asks for benchmark outputs.
• Startup overhead was high on the nested/cloud KVM host: runc avg 0.218s, kata avg 11.749s.

Checklist

• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + 5-run startup + I/O benchmark with trade-off analysis
• Bonus — Escape PoC succeeds on runc, fails on Kata (with host-side verification)