Amazon EKS 1.34+ enables forensic container checkpointing with Kubelet API
Amazon EKS 1.34 and later now support forensic container checkpointing, allowing users to capture a container's full runtime state without stopping the workload. This capability, powered by the Kubelet Checkpoint API and CRIU, addresses the critical need to preserve volatile evidence during security incidents. It helps organizations comply with frameworks like PCI DSS and SOC 2 by speeding up investigations and avoiding data loss. The solution captures states in seconds, packages them as OCI images, and stores them in Amazon ECR for analysis.
- →Forensic Container Checkpointing now available on Amazon EKS 1.34+
- →Leveraging Kubelet Checkpoint API and CRIU Integration
- →DaemonSet Architecture for Node-Wide Coverage
- →Detailed Walkthrough for Agent Deployment
Features (1) ›
- Forensic Container Checkpointing now available on Amazon EKS 1.34+
Amazon EKS 1.34 and later now support forensic container checkpointing, allowing users to capture a container's full runtime state (memory, files, network, processes) without stopping the workload. This helps preserve critical evidence during security incidents and enables compliance with frameworks like PCI DSS and SOC 2.
Notes (3) ›
- Leveraging Kubelet Checkpoint API and CRIU Integration
The feature utilizes the Kubelet Checkpoint API (promoted to beta in Kubernetes v1.30) which delegates to CRIU (Checkpoint/Restore In Userspace) via containerd 2.x. This enables rapid capture, typically within seconds, with minimal CPU overhead, packaging the checkpoint as an OCI image for storage in Amazon ECR.
- DaemonSet Architecture for Node-Wide Coverage
The checkpoint agent is designed to run as an unprivileged DaemonSet per node, providing node-wide coverage without requiring application changes or sidecar injection. This architecture allows a single agent to checkpoint pods on its node and optionally route requests to agents on other nodes via an Application Load Balancer.
- Detailed Walkthrough for Agent Deployment
A comprehensive walkthrough guides users through the deployment process, including installing CRIU on worker nodes, building and publishing the checkpoint agent container image, configuring RBAC for Kubelet Checkpoint API access, and deploying the DaemonSet with an ALB for exposure.
https://aws.amazon.com/blogs/containers/forensic-container-checkpointing-on-amazon-eks/
Related releases
- Amazon EKS now supports advanced Kubernetes control plane configuration AWS What's New ·
- Amazon EKS introduces advanced Kubernetes control plane configuration AWS Containers Blog ·
- Amazon EKS Auto Mode automates node failure detection and repair AWS Containers Blog ·
- AWS Network Firewall adds forward proxy functionality AWS What's New ·
- AWS EMR on EKS Adds Apache Spark Troubleshooting Agent AWS Big Data Blog ·
- CloudWatch adds managed Prometheus collectors AWS What's New ·