End-to-End Encryption for Container Checkpointing in Kubernetes
summary
Adds built-in CRE encryption to checkpoint/restore (CRIU) using the TLS key infrastructure, encrypting protocol-buffers with ChaCha20-Poly1305, intercepting third‑party tools via pipes, and encrypting memory pages with XTS and a single IV to allow in-place page deletion. Demonstrates working Kubernetes integration by converting checkpoints to OCI images, preserves TCP connections, and shows up to orders-of-magnitude faster checkpointing than post‑hook external encryption for compute‑intensive workloads and ~7× hardware‑accelerated throughput for memory pages.
AI-written summary · about
chapters (15)
- 0:00Container checkpointing basics
- 1:30Risks of unencrypted checkpoints
- 4:23Checkpoint encryption challenges
- 6:10Iterative checkpointing overhead
- 9:03CRIU built-in encryption
- 12:39Encrypting third-party images
- 13:25Efficient memory page encryption
- 15:12Restoring encrypted checkpoints
- 16:37Kubernetes encryption integration
- 18:01LLM checkpointing demo
- 20:34In-memory DB checkpoint demo
- 22:03Video streaming checkpoint demo
- 24:14Encryption performance evaluation
- 27:04Summary and future work
- 27:26Q&A
related talks
24mProtecting Sensitive Data in Container Checkpoints
13mEnabling Secure Container Checkpointing for Distributed Model Training
26mKubernetes and Checkpoint Restore
39mKubernetes and Checkpoint/Restore
32mForensic container checkpointing and analysis
33mFreeze,Investigate,Recover: Unlocking Forensic Container Checkpoint...
33mDon't Peek Into my Container!
42mForensic container checkpointing and analysis - Adrian Reber