Forensic Container Checkpointing
summary
Kubernetes adds forensic container checkpointing (alpha in 1.25, beta in 1.30) that captures all memory pages and changed files so a running container can be frozen (59 ms freeze shown), archived as a tar/OCI checkpoint, and restored on another host — demo moves a stateful counter across ~600 km and reproduces its value. Analysis tools shown: checkpoint-control (overview, memory search), creu plus crit/grab and conversion to core for GDB; GPU checkpointing works for AMD and NVIDIA.
AI-written summary · about
chapters (12)
- 0:00Forensic container checkpointing intro
- 1:05Checkpoint restore background
- 3:52Why CRIU in user space
- 6:02CRIU for container migration
- 8:34Forensic checkpointing in Kubernetes
- 10:16Beyond forensic use cases
- 14:13Demo setup for analysis
- 18:28Analyzing checkpoints
- 20:58Checkpoint archives deep dive
- 23:55Advanced forensic techniques
- 24:39Future of checkpoint restore
- 26:27Q&A on security
related talks
42mForensic container checkpointing and analysis - Adrian Reber
32mForensic container checkpointing and analysis
26mKubernetes and Checkpoint Restore
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
27mState of Checkpoint/Restore in Kubernetes – Now With GPUs
39mKubernetes and Checkpoint/Restore
39mCSI Container: Can You DFIR It?
28mContainer Checkpoint/Restore at Scale for Fast Pod Startup Time