feat(lab12): complete kata vs runc comparison with escape PoC

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,25 @@
+## Goal
+<!-- One sentence: what does this PR deliver? -->
+
+## Changes
+<!-- Bullet list of all files added or modified -->
+- 
+
+## Testing
+<!-- Commands you ran and the output you observed -->
+```
+# Example:
+docker ps --filter name=juice-shop
+curl -s -o /dev/null -w "HTTP %{http_code}\n" http://127.0.0.1:3000
+```
+
+## Artifacts & Screenshots
+<!-- Links to files in this PR; embed screenshots where useful -->
+- `submissions/labN.md`
+
+---
+
+## Checklist
+- [ ] Title follows `feat(labN): <topic>` style
+- [ ] No secrets or large temp files committed
+- [ ] Submission file exists at `submissions/labN.md`

.github/workflows/lab1-smoke.yml

@@ -0,0 +1,70 @@
+name: lab1-smoke
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  smoke-test:
+    name: Juice Shop smoke test
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Pull and start Juice Shop
+        run: |
+          docker run -d --name juice-shop \
+            -p 127.0.0.1:3000:3000 \
+            bkimminich/juice-shop:v20.0.0
+
+      - name: Wait for Juice Shop to be ready (max 60s)
+        run: |
+          echo "Waiting for Juice Shop to start..."
+          for i in $(seq 1 30); do
+            if curl --silent --fail http://localhost:3000/rest/admin/application-version > /dev/null; then
+              echo "Juice Shop is up after $((i * 2))s"
+              exit 0
+            fi
+            echo "Attempt $i/30 — not ready yet, sleeping 2s..."
+            sleep 2
+          done
+          echo "ERROR: Juice Shop did not start within 60 seconds"
+          docker logs juice-shop
+          exit 1
+
+      - name: Verify homepage returns HTTP 200
+        run: |
+          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:3000)
+          echo "Homepage HTTP status: $HTTP_CODE"
+          if [ "$HTTP_CODE" != "200" ]; then
+            echo "ERROR: Expected 200, got $HTTP_CODE"
+            exit 1
+          fi
+          echo "HTTP 200 confirmed — smoke test passed."
+
+      - name: Verify version endpoint
+        run: |
+          RESPONSE=$(curl -s http://localhost:3000/rest/admin/application-version)
+          echo "Version endpoint response: $RESPONSE"
+          echo "$RESPONSE" | grep -q '"version":"20.0.0"' || (echo "ERROR: unexpected version response" && exit 1)
+          echo "Version check passed."
+
+      - name: Verify product count
+        run: |
+          COUNT=$(curl -s http://localhost:3000/api/Products | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d['data']))")
+          echo "Product count: $COUNT"
+          if [ "$COUNT" -lt 1 ]; then
+            echo "ERROR: No products returned"
+            exit 1
+          fi
+          echo "Product count check passed: $COUNT products found."
+
+      - name: Cleanup
+        if: always()
+        run: docker rm -f juice-shop || true

.pre-commit-config.yaml

@@ -0,0 +1,11 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.26.0
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: detect-private-key
+      - id: check-added-large-files

labs/lab11/reverse-proxy/nginx.conf

@@ -1,70 +1,14 @@
-user  nginx;
-worker_processes  auto;
-
-events { worker_connections 1024; }
-
 http {
-  include       /etc/nginx/mime.types;
-  default_type  application/octet-stream;
-  sendfile      on;
-  keepalive_timeout  10;
-  server_tokens off;
-  gzip off;
-
-  # Security-focused logs
-  log_format security '$remote_addr - $remote_user [$time_local] '
-                     '"$request" $status $body_bytes_sent '
-                     '"$http_referer" "$http_user_agent" '
-                     'rt=$request_time uct=$upstream_connect_time '
-                     'urt=$upstream_response_time';
-  access_log /var/log/nginx/access.log security;
-  error_log  /var/log/nginx/error.log warn;
-
-  # Upstream app
-  upstream juice {
-    server juice:3000;
-    keepalive 32;
-  }
-
-  # Rate limit zone for login
-  # ~10 req/min per IP, burst of 5
+  # Rate limiting zones (должны быть внутри http)
   limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
   limit_req_status 429;
 
-  map $http_upgrade $connection_upgrade { default upgrade; '' close; }
-
-  # Common proxy settings
-  proxy_set_header Host $host;
-  proxy_set_header X-Real-IP $remote_addr;
-  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-  proxy_set_header X-Forwarded-Proto $scheme;
-  proxy_http_version 1.1;
-  proxy_set_header Connection $connection_upgrade;
-  proxy_set_header Upgrade $http_upgrade;
-  # Prevent upstream TLS BREACH vector by disabling compression from upstream
-  proxy_set_header Accept-Encoding "";
-  proxy_read_timeout 30s;
-  proxy_send_timeout 30s;
-  proxy_connect_timeout 5s;
-  proxy_hide_header X-Powered-By;
-  # Hide upstream headers to avoid duplicates and enforce policy at the proxy
-  proxy_hide_header X-Frame-Options;
-  proxy_hide_header X-Content-Type-Options;
-  proxy_hide_header Referrer-Policy;
-  proxy_hide_header Permissions-Policy;
-  proxy_hide_header Cross-Origin-Opener-Policy;
-  proxy_hide_header Cross-Origin-Resource-Policy;
-  proxy_hide_header Content-Security-Policy;
-  proxy_hide_header Content-Security-Policy-Report-Only;
-  proxy_hide_header Access-Control-Allow-Origin;
-
-  # HTTP server (redirect to HTTPS)
+  # HTTP server — redirect to HTTPS
   server {
     listen 8080;
     listen [::]:8080;
     server_name _;
 
-    # Core headers (also on redirects)
     add_header X-Frame-Options "DENY" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -85,26 +29,25 @@ http {
 
     ssl_certificate     /etc/nginx/certs/localhost.crt;
     ssl_certificate_key /etc/nginx/certs/localhost.key;
-    ssl_session_timeout 10m;
-    ssl_session_cache   shared:SSL:10m;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:EECDH+AESGCM:EDH+AESGCM";
-    ssl_prefer_server_ciphers on;
+
+    ssl_protocols TLSv1.3;
+    ssl_prefer_server_ciphers off;
+
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+   # ssl_ciphers "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256";
+    ssl_ecdh_curve X25519:secp384r1;
+
     ssl_stapling off;
-    # If using a publicly-trusted certificate, you may enable OCSP stapling:
-    # ssl_stapling on;
-    # ssl_stapling_verify on;
-    # resolver 1.1.1.1 8.8.8.8 valid=300s;
-    # resolver_timeout 5s;
-    # ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+    ssl_stapling_verify off;
 
-    client_max_body_size 2m;
     client_body_timeout 10s;
     client_header_timeout 10s;
     keepalive_timeout 10s;
     send_timeout 10s;
 
-    # Security headers (include HSTS here only)
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
     add_header X-Frame-Options "DENY" always;
     add_header X-Content-Type-Options "nosniff" always;
@@ -117,11 +60,15 @@ http {
     location = /rest/user/login {
       limit_req zone=login burst=5 nodelay;
       limit_req_log_level warn;
-      proxy_pass http://juice;
+      proxy_pass http://juice:3000;
     }
 
     location / {
-      proxy_pass http://juice;
+      proxy_pass http://juice:3000;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
     }
   }
 }

labs/lab11/waf/docker-compose.override.yml

@@ -0,0 +1,23 @@
+services:
+  waf:
+    image: owasp/modsecurity-crs:nginx
+    container_name: lab11-waf
+    restart: unless-stopped
+    depends_on:
+      - nginx
+    environment:
+      BACKEND: "https://nginx:8443"
+      PROXY_SSL_VERIFY: "no"
+      PORT: "8080"
+
+      MODSEC_RULE_ENGINE: "on"
+      MODSEC_AUDIT_ENGINE: "RelevantOnly"
+      MODSEC_AUDIT_LOG_RELEVANT_STATUS: "^(?:5|4(?!04))"
+      MODSEC_AUDIT_LOG: "/dev/stdout"
+      MODSEC_AUDIT_LOG_FORMAT: "JSON"
+
+      PARANOIA: "1"
+      BLOCKING_PARANOIA: "1"
+      TX_ANOMALY_SCORE_THRESHOLD: "5"
+    ports:
+      - "8090:8080"

labs/lab12/results/dev-diff.txt

@@ -0,0 +1,2 @@
+1d0
+< core

labs/lab12/results/io-bench.txt

@@ -0,0 +1,4 @@
+=== runc I/O ===
+104857600 bytes (100.0MB) copied, 0.007597 seconds, 12.9GB/s
+=== kata I/O ===
+104857600 bytes (100.0MB) copied, 0.008624 seconds, 11.3GB/s

labs/lab12/results/kata-caps.txt

@@ -0,0 +1,5 @@
+CapInh:	0000000000000000
+CapPrm:	00000000a80425fb
+CapEff:	00000000a80425fb
+CapBnd:	00000000a80425fb
+CapAmb:	0000000000000000

labs/lab12/results/kata-devs.txt

@@ -0,0 +1,14 @@
+fd
+full
+mqueue
+null
+ptmx
+pts
+random
+shm
+stderr
+stdin
+stdout
+tty
+urandom
+zero

labs/lab12/results/kata-escape-attempt.txt

@@ -0,0 +1,2 @@
+time="2026-07-17T22:22:45+03:00" level=warning msg="cannot set cgroup manager to \"systemd\" for runtime \"io.containerd.kata.v2\""
+time="2026-07-17T22:22:47+03:00" level=fatal msg="failed to create shim task: Creating container device LinuxDevice { path: \"/dev/full\", typ: C, major: 1, minor: 7, file_mode: Some(438), uid: Some(0), gid: Some(0) }\n\nCaused by:\n    EEXIST: File exists\n\nStack backtrace:\n   0: <unknown>\n   1: <unknown>\n   2: <unknown>\n   3: <unknown>\n   4: <unknown>\n   5: <unknown>\n   6: <unknown>\n   7: <unknown>\n   8: <unknown>\n   9: <unknown>\n  10: <unknown>\n\nStack backtrace:\n   0: <unknown>\n   1: <unknown>\n   2: <unknown>\n   3: <unknown>\n   4: <unknown>\n   5: <unknown>\n   6: <unknown>\n   7: <unknown>\n   8: <unknown>\n   9: <unknown>\n  10: <unknown>\n  11: <unknown>\n  12: <unknown>\n  13: <unknown>\n  14: <unknown>\n  15: <unknown>\n  16: <unknown>\n  17: <unknown>\n  18: <unknown>\n  19: <unknown>\n  20: <unknown>\n  21: <unknown>\n  22: <unknown>: unknown"

labs/lab12/results/kata-kernel.txt

@@ -0,0 +1,5 @@
+time="2026-07-17T22:21:21+03:00" level=warning msg="cannot set cgroup manager to \"systemd\" for runtime \"io.containerd.kata.v2\""
+Linux 21ef90bc1e2f 6.18.35 #1 SMP Mon Jun 15 12:55:58 UTC 2026 x86_64 Linux
+processor	: 0
+vendor_id	: GenuineIntel
+cpu family	: 6

labs/lab12/results/runc-caps.txt

@@ -0,0 +1,5 @@
+CapInh:	0000000000000000
+CapPrm:	00000000a80425fb
+CapEff:	00000000a80425fb
+CapBnd:	00000000a80425fb
+CapAmb:	0000000000000000

labs/lab12/results/runc-devs.txt

@@ -0,0 +1,15 @@
+core
+fd
+full
+mqueue
+null
+ptmx
+pts
+random
+shm
+stderr
+stdin
+stdout
+tty
+urandom
+zero

labs/lab12/results/runc-kernel.txt

@@ -0,0 +1,4 @@
+Linux be6c2de605fc 6.12.33+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.12.33-1kali1 (2025-06-25) x86_64 Linux
+processor	: 0
+vendor_id	: GenuineIntel
+cpu family	: 6

labs/lab12/results/startup-bench.txt

@@ -0,0 +1,12 @@
+=== runc ===
+1: .534444087 s
+2: .506874467 s
+3: .511743839 s
+4: .508918350 s
+5: .537591629 s
+=== kata ===
+1: 2.182025002 s
+2: 1.969614788 s
+3: 2.150948127 s
+4: 2.038093392 s
+5: 2.245332786 s