Lab 12 — Kata Containers: VM-backed Container Sandboxing (Local)

[flowelx]

Goal

Add Kata Containers runtime support and compare security/performance with runc.

Changes

• Installed Kata Containers shim v3.23.0
• Configured containerd for io.containerd.kata.v2 runtime
• Added performance benchmarks and isolation tests
• Documented runtime selection guidelines

Testing

• Kata runtime: sudo nerdctl run --rm --runtime io.containerd.kata.v2 alpine:3.19 uname -a
• Performance: runc (1.025s) vs Kata (2.539s) startup time
• Isolation: Verified Kata VM with separate kernel 6.12.47
• Juice Shop: HTTP 200 from port 3012 (avg 3.7ms latency)

Artifacts & Screenshots

• Performance data: labs/lab12/bench/
• Security analysis: labs/submission12.md
• Isolation tests: labs/lab12/isolation/

Checklist

• [✅] Clear title
• [✅] Docs updated if needed
• [✅] No secrets/large temp files

---

• Task 1 — Kata install + runtime config
• Task 2 — runc vs kata runtime comparison
• Task 3 — Isolation tests
• Task 4 — Basic performance snapshot