Forensic Analysis of Container Checkpoints
summary
Kubernetes adds an alpha container checkpoint feature that serializes running process state into an on-disk archive (default /var/lib/kubelet/checkpoints) so investigators can extract memory, process trees, open sockets and ghost (deleted but still-open) files. Tools shown include a checkpoint control inspector and a checkpoint-restore image decoder (crit) that unpacks CRIU-style images; CRI-O/RunC integration arrives via a containerd PR and CRI-O 1.25 support. Checkpoints capture secrets in memory, require node/admin privileges, and certain syscalls and nested namespaces remain unsupported.
AI-written summary · about
chapters (17)
- 0:00Container checkpointing in Kubernetes
- 1:23Security in Kubernetes
- 4:36Monitoring container snapshots
- 5:59How checkpointing works
- 7:26Enabling checkpointing in K8s
- 8:33Demo: container checkpoint creation
- 10:31Inspecting checkpoint contents
- 12:58Decoding with CRIU tools
- 14:25Checkpointing limitations
- 17:18Unsupported features & attacks
- 18:05Forensic analysis with checkpoints
- 19:31Future work & contributors
- 20:13Handling secrets in checkpoints
- 21:17Checkpoint logging & investigation
- 22:23Performance overhead of CRIU
- 23:27Permissions for checkpointing
- 24:38Syncing checkpoints across containers
related talks
39mContainer Live Migration
33mLinux Container Internals
38mDeep Dive: containerd
26mExploring Container Mechanisms Through the Story of a Syscall
37mCRI-O: Under the Hood
37mOvercoming the Challenges of Debugging Containers - Jose Blanquicet
20mDebugging Kubernetes and Container Workloads with the Superpower of eBPF
59mOpenJDK Project CRaC (Coordinated Restore at Checkpoint): Challenges and Issues