Secure Container Analysis: Forensic Checkpointing in Kubernetes

Forensic container checkpointing is based on Checkpoint/Restore In Userspace (CRIU) and allows for the creation of stateful copies of a running container without the container being aware of it. This copy can be analyzed and restored multiple times in a sandbox environment without the original container knowing. Forensic container checkpointing was introduced as an alpha feature in Kubernetes v1.25.

How does it work?

With the help of CRIU, it is possible to checkpoint and restore containers. CRIU is integrated into runc, crun, CRI-O, and containerd, and the forensic container checkpointing as implemented in Kubernetes leverages these existing CRIU integrations.

Why is it important?

Thanks to CRIU and the corresponding integrations, all information and states of a running container can be captured on disk for later forensic analysis. A forensic analysis is crucial to inspect a suspicious container without stopping or affecting it. If the container is indeed under attack, the attacker might notice attempts to inspect the container. Creating a checkpoint and analyzing the container in a sandboxed environment provides the opportunity to inspect the container without the original container and potentially the attacker being aware of the inspection.

Beyond the use case of forensic container checkpointing, it is also possible to migrate a container from one node to another without losing its internal state. Especially for stateful containers with long initialization times, restoring from a checkpoint can save time after a restart or enable significantly faster startup times.

How do I use container checkpointing?

The feature is hidden behind a Feature Gate, so you should ensure that you enable the ContainerCheckpoint gate before you can use the new feature.

The runtime environment must also support container checkpointing:

• containerd: Support is currently under discussion. More details can be found in the containerd pull request #6965.

• CRI-O: Version 1.25 supports forensic container checkpointing.

With these new capabilities, ayedo as a Kubernetes partner ensures that you can get the most out of your container applications. Take advantage of forensic container checkpointing and effectively protect your applications!

Source: Kubernetes Blog