Forensic container checkpointing on Amazon Elastic Kubernetes Service (Amazon EKS)

This article explains how to implement forensic container checkpointing on Amazon EKS 1.34+ using the Kubelet Checkpoint API and CRIU to capture container runtime state for security investigations.

• Deploy a CRIU installer DaemonSet to enable checkpoint capability on worker nodes
• Build an unprivileged checkpoint agent that calls the kubelet API over HTTPS with service account tokens
• Package checkpoint archives as OCI images and push to Amazon ECR using IRSA for credentials
• Expose the checkpoint API through an ALB with automatic node-aware routing for cross-node requests
• Capture container memory, file descriptors, network sockets, and process metadata in under 30 seconds
• Analyze checkpoints offline or restore to isolated forensic clusters for investigation
• Use kro (Kube Resource Orchestrator) to simplify multi-cluster deployment

Forensic checkpointing preserves volatile evidence before container termination, enabling compliance with PCI DSS and SOC 2 requirements while avoiding the tradeoff between containment and evidence preservation.