Digital Forensics with Container Checkpointing
Talkat ContainerCon @ OSS EU 2023 · on Wednesday, 2023-09-20· at 16:50· Room 0A (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Container checkpointing captures a live container as a tar archive that includes process memory, file diffs and open sockets, preserves PIDs and process tree, and allows memory pages to be converted to core dumps for GDB. Demo uses podman checkpoint producing a ~45 MB checkpoint tar and a checkpoint+restore roundtrip that stalls the process for about 40 seconds; CRIU reports freeze time <1 ms for memory dumping. Kubernetes exposes checkpointing at kubelet since v1.25 (checkpoint only) and requires cri-o plus CRIU ≥3.16; restore is currently available via podman/crictl, not the kube API.
AI-written summary · about
chapters (11)
- 0:00Digital forensics basics
- 3:34Container checkpointing overview
- 5:01CRIU history
- 8:39Podman checkpoint demo
- 11:56Kubernetes checkpointing
- 14:04Kubernetes checkpoint demo
- 16:41Analyzing checkpoints
- 25:17Restoring containers
- 27:04Checkpointing limits
- 28:55Practical applications
- 30:40Q&A
related talks
31mDigital Forensics with Container Checkpointing
33mFreeze,Investigate,Recover: Unlocking Forensic Container Checkpoint...
37mCSI Forensics: Unraveling Kubernetes Crime Scenes
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
13mEnabling Secure Container Checkpointing for Distributed Model Training
39mCSI Container: Can You DFIR It?
32mEnd-to-End Encryption for Container Checkpointing in Kubernetes
34mContainer Forensics: What to Do When Your Cluster is a Cluster