Forensic container checkpointing and analysis
summary
Kubernetes 1.25 exposes Forensic Container Checkpointing using CRIU to snapshot container memory, threads, namespaces and only the changed rootfs files via the kubelet checkpoint API, producing a checkpoint archive that can be inspected or restored. Demo shows grep and GDB on raw page dumps to recover an in-memory secret ("random1432key") and convert per-process dumps to core files; CRIU scanned ~7000 pages and wrote ~2000 pages. Real-world wins include 8 minutes to 15 seconds cold-starts by restoring preinitialized checkpoints.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:35Checkpoint restoring user space
- 3:35Container engine integration
- 6:51Use cases
- 9:11Spot instances
- 10:33Forensic container analysis
- 11:30Checkpointing a container
- 14:10Checkpoint Control
- 16:13Checkpoint Archive
- 22:18Grab
- 22:48GDB
- 23:53Next steps
- 24:13Cubectl checkpoint
- 24:23Pot checkpoint
- 25:03Container migration
- 25:18Checkpoint image standard
- 26:30Summary
- 27:04Questions
related talks
42mForensic container checkpointing and analysis - Adrian Reber
32mForensic Container Checkpointing
26mKubernetes and Checkpoint Restore
39mKubernetes and Checkpoint/Restore
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
39mCSI Container: Can You DFIR It?
32mEnd-to-End Encryption for Container Checkpointing in Kubernetes
27mState of Checkpoint/Restore in Kubernetes – Now With GPUs