Forensic container checkpointing and analysis - Adrian Reber
summary
Kubernetes 1.25 adds forensic container checkpointing that uses creu to write a tar checkpoint archive containing changed rootfs files plus raw memory pages; the demo unpacks that archive with checkpoint-control and crit, finds a secret written into memory, and even loads core registers into gdb. Checkpoint restore cuts cold-starts from 10 minutes to 10–30 seconds in one example, supports migration and spot‑instance rescue, and stores raw memory page dumps (so sensitive keys land on disk).
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker background
- 1:26Background on CRIU and checkpointing
- 8:10Forensic container checkpointing concept
- 10:41Use cases for checkpoint restore
- 15:58Live demo setup and checkpointing
- 20:30Analyzing checkpoint archives with tools
- 29:05Enhanced inspection with checkpoint control
- 31:33Future of checkpointing in Kubernetes
- 33:40Summary and Q&A session
related talks
32mForensic container checkpointing and analysis
32mForensic Container Checkpointing
26mKubernetes and Checkpoint Restore
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
39mKubernetes and Checkpoint/Restore
39mCSI Container: Can You DFIR It?
32mEnd-to-End Encryption for Container Checkpointing in Kubernetes
39mContainer Live Migration