The presentation discusses the implementation of forensic container checkpointing in Kubernetes and other container engines, allowing for the analysis of containers without stopping them. The implementation involves taking a checkpoint of a running container and analyzing it in a sandbox environment.
- Forensic container checkpointing allows for the analysis of containers without stopping them
- The implementation involves taking a checkpoint of a running container and analyzing it in a sandbox environment
- The checkpoint archive is only readable by root to ensure security
- The use cases for forensic container checkpointing include reboot and save state, quick startup, and analyzing containers for potential issues