CloudNativeSecurityCon North America 2024

Container checkpointing is an important feature that has been enabled in many container engines (e.g., Docker, Podman, CRI-O, containerd), and more recently in orchestration systems like Kubernetes. Checkpointing is particularly useful from a security perspective as it allows to transparently save important information about the runtime state of containers. This state, for example, can be used for analyzing security incidents and examining the processes, open files, and network connections within a container at a particular point in time. However, checkpoint data can also lead to serious information leakage. Container checkpoints include a snapshot of the raw application memory, which might contain confidential or sensitive data that should not be exposed to unauthorized users. In this talk, we are going to discuss the security risks, best practices and how to enable end-to-end encryption for container checkpoints in Kubernetes.