Freeze,Investigate,Recover: Unlocking Forensic Container Checkpoint...
summary
Shows a working CRIU-based workflow that creates a tar checkpoint of a running container (memory pages, fds, namespaces, rootfs diff), inspects memory pages for secrets, and restores the exact process tree so a counter resumes from its prior value. Requires k8s 1.25+ feature-gates and a CRI-O runtime with CRIU enabled. Demonstrates commands: checkpointctl + crit to list/inspect checkpoints, export a sandboxable archive, and rebuild an image that restores execution seamlessly.
AI-written summary · about
chapters (9)
- 0:00Container forensics intro
- 2:04Why checkpoint and restore
- 6:36Cryo checkpointing tool
- 9:44Cryo with Kubernetes
- 12:54Cryo prerequisites
- 14:39Demo: Cryo checkpointing
- 26:23Compromised container scenario
- 28:11Resources and next steps
- 28:33Q&A
related talks
31mDigital Forensics with Container Checkpointing- 31mDigital Forensics with Container Checkpointing
37mCSI Forensics: Unraveling Kubernetes Crime Scenes
13mEnabling Secure Container Checkpointing for Distributed Model Training
24mProtecting Sensitive Data in Container Checkpoints
32mEnd-to-End Encryption for Container Checkpointing in Kubernetes
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
39mCSI Container: Can You DFIR It?