Digital Forensics with Container Checkpointing
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 16:50· Room 0A (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Container checkpointing captures a forensic snapshot of a running container including process memory, open file descriptors and sockets, and overlay FS diffs; cryo tooling (user‑space CRIU-style) plus podman produce tar checkpoints (example sizes: ~45 MB with podman, ~5 MB via kubelet) and can preserve container ID and PIDs on restore. Checkpoint freeze time measures under 1 ms for memory dump; a full podman checkpoint+restore demo takes ~40 s. Kubernetes 1.25 exposes checkpointing via the kubelet API but currently lacks built‑in restore.
AI-written summary · about
chapters (11)
- 0:00Digital forensics basics
- 3:34Container checkpointing overview
- 5:01CRIU history
- 8:39Podman checkpoint demo
- 11:56Kubernetes checkpointing
- 14:04Kubernetes checkpoint demo
- 16:41Analyzing checkpoints
- 25:17Restoring containers
- 27:04Checkpointing limits
- 28:55Practical applications
- 30:40Q&A
related talks
31mDigital Forensics with Container Checkpointing
37mCSI Forensics: Unraveling Kubernetes Crime Scenes
33mFreeze,Investigate,Recover: Unlocking Forensic Container Checkpoint...
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
39mCSI Container: Can You DFIR It?
39mKubernetes and Checkpoint/Restore
34mContainer Forensics: What to Do When Your Cluster is a Cluster
13mEnabling Secure Container Checkpointing for Distributed Model Training