feat(lab12): kata vs runc isolation + perf

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,32 @@
+## Goal
+<!-- One sentence: what this PR delivers -->
+
+## Changes
+<!-- Bullet list of artifacts added or modified -->
+
+-
+
+## Testing
+<!-- Commands run and observed output -->
+
+```bash
+# paste commands here
+```
+
+**Observed output:**
+
+```
+# paste output here
+```
+
+## Artifacts & Screenshots
+<!-- Links to files in this PR; embed screenshots where useful -->
+
+-
+
+---
+
+## Checklist
+- [ ] Title is clear (`feat(labN): <topic>` style)
+- [ ] No secrets/large temp files committed
+- [ ] Submission file at `submissions/labN.md` exists

.github/workflows/lab1-smoke.yaml

@@ -0,0 +1,35 @@
+# .github/workflows/lab1-smoke.yml
+name: Smoke Test Juice Shop
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  smoke-test:
+    runs-on: ubuntu-latest
+    services:
+      juice-shop:
+        image: bkimminich/juice-shop:v20.0.0
+        ports:
+          - 3000:3000
+    steps:
+      - name: Wait for Juice Shop to be ready
+        run: |
+          for i in $(seq 1 30); do
+            if curl --silent --fail http://localhost:3000/rest/admin/application-version >/dev/null; then
+              echo "Juice Shop is ready!"
+              exit 0
+            fi
+            echo "Waiting for Juice Shop... (attempt $i/30)"
+            sleep 2
+          done
+          echo "Error: Juice Shop failed to start within 60 seconds"
+          exit 1
+
+      - name: Verify homepage returns 200
+        run: |
+          curl -v http://localhost:3000/rest/admin/application-version
+          echo "smoke test passed"

.pre-commit-config.yaml

@@ -0,0 +1,11 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: detect-private-key
+      - id: check-added-large-files

labs/lab11/reverse-proxy/nginx.conf

@@ -30,6 +30,7 @@ http {
   # ~10 req/min per IP, burst of 5
   limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
   limit_req_status 429;
+  limit_conn_zone $binary_remote_addr zone=conn:10m;
 
   map $http_upgrade $connection_upgrade { default upgrade; '' close; }
 
@@ -60,9 +61,13 @@ http {
 
   # HTTP server (redirect to HTTPS)
   server {
-    listen 8080;
-    listen [::]:8080;
+    listen 80;
+    listen [::]:80;
     server_name _;
+    limit_conn conn 50;
+
+    client_body_timeout 10s;
+    client_header_timeout 10s;
 
     # Core headers (also on redirects)
     add_header X-Frame-Options "DENY" always;
@@ -73,23 +78,27 @@ http {
     add_header Cross-Origin-Resource-Policy "same-origin" always;
     add_header Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" always;
 
-    return 308 https://$host:8443$request_uri;
+    return 308 https://$host:443$request_uri;
   }
 
   # HTTPS server
   server {
-    listen 8443 ssl;
-    listen [::]:8443 ssl;
+    listen 443 ssl;
+    listen [::]:443 ssl;
     http2 on;
     server_name _;
+    limit_conn conn 50;
 
     ssl_certificate     /etc/nginx/certs/localhost.crt;
     ssl_certificate_key /etc/nginx/certs/localhost.key;
-    ssl_session_timeout 10m;
+    ssl_session_timeout 1d;
     ssl_session_cache   shared:SSL:10m;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:EECDH+AESGCM:EDH+AESGCM";
-    ssl_prefer_server_ciphers on;
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
+    ssl_ecdh_curve X25519:secp384r1;
+    ssl_prefer_server_ciphers off;
     ssl_stapling off;
     # If using a publicly-trusted certificate, you may enable OCSP stapling:
     # ssl_stapling on;
@@ -105,7 +114,7 @@ http {
     send_timeout 10s;
 
     # Security headers (include HSTS here only)
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
     add_header X-Frame-Options "DENY" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;