Feature/lab12

[sedimentt]

Goal

Run the same container image on runc and on Kata Containers (VM-backed runtime), measure the startup, I/O and memory cost of the second kernel, and show a privileged bind-mount escape that works on runc and not on Kata.

Changes

• submissions/lab12.md — report for Task 1, Task 2 and the Bonus

(No host config is committed. Kata install, the containerd runtime block and all measurement output live outside the repo or under the gitignored labs/lab12/results/.)

Testing

Host: kernel 7.0.0-38-generic, /dev/kvm present, system containerd v2.3.6 driven via nerdctl 2.4.1. Kata pinned to 4.1.0 (runtime-rs / Dragonball). No CNI plugins on the host, so every run used --net none (equal for both runtimes).

• Kernel: runc container 7.0.0-38-generic (= host); Kata container 6.18.35 (guest kernel in a VM)
• /dev: runc 15 / privileged 236; Kata 14; Kata --privileged does not start (get host path failed — host device passthrough can't be satisfied for a VM)
• CapEff: runc a80425fb / privileged 000001ffffffffff; Kata a80425fb
• Startup (median of 5, warm-up discarded): runc 0.28 s, Kata 6.05 s (~22×)
• I/O (512 MiB, fsync): runc 1.1 GB/s, Kata 306.8 MB/s (~3.5×)
• Memory per container: runc shim 11.3 MiB, Kata shim+VMM 175.2 MiB (~164 MiB overhead)
• Bonus escape: privileged -v /tmp:/host_tmp — runc overwrote the host file; Kata command failed to start, host file unchanged
• Honest limit (checked): a non-privileged -v /tmp bind mount reaches the host even on Kata, shared into the guest via virtiofs (kataShared … type virtiofs)

Artifacts & Screenshots

• Report: submissions/lab12.md
• Raw measurement output: labs/lab12/results/ (gitignored, kept locally)

Checklist

• Title is clear (feat(lab12): kata vs runc isolation, cost and escape)
• No secrets/large temp files committed
• Submission file at submissions/lab12.md exists