Amazon Elastic Kubernetes Service (Amazon EKS)에서 포렌식 컨테이너 체크포인팅

When a container in your Amazon Elastic Kubernetes Service (Amazon EKS) cluster exhibits suspicious behavior, the runtime evidence is time sensitive. Kubernetes routinely reschedules and replaces workloads, so the moment Kubernetes terminates or evicts a container with unintended access, your runtime state is lost: in-memory credentials, active network connections, injected processes, and ephemeral file system changes.

According to the SANS 2024 Incident Response Survey , organizations that can’t preserve volatile evidence during container security events might face investigation delays of hours to days and risk compliance gaps with frameworks like PCI DSS and SOC 2 that require forensic evidence retention. Without a way to capture this state, you might face a choice between terminating the container to contain the issue (destroying evidence) or leaving it running to preserve evidence (extending your exposure window). Forensic container checkpointing with the Kubelet Checkpoint API addresses this tradeoff.

You can capture the container’s runtime state (memory pages, file descriptors, network sockets, and process metadata) typically in seconds, without stopping the workload. In our testing with typical microservice containers (200–400 MB resident memory) on m5. xlarge nodes, the CRIU capture typically completes in under 10 seconds and adds less than 5% CPU overhead on the node during the capture, and the full end-to-end flow, including packaging and pushing the checkpoint to Amazon Elastic Container Registry (Amazon ECR), typically completes in under 30 seconds.

Larger containers (1–2 GB resident memory) might take 30–60 seconds to capture. Checkpoint time typically scales roughly linearly with memory size. 25 introduced the Kubelet Checkpoint API ( KEP-2008 ), and v1. It delegates to CRIU (Checkpoint/Restore In Userspace) through containerd’s CheckpointContainer CRI RPC. 34, the underlying container runtime (containerd 2. x, at the time of this writing) implements this RPC, making the capability available on Amazon EKS. In this blog post, you deploy a checkpoint agent on Amazon EKS 1.