Forensic container checkpointing on Amazon Elastic Kubernetes Service (Amazon EKS)

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

When a container in your Amazon Elastic Kubernetes Service (Amazon EKS) cluster exhibits suspicious behavior, the runtime evidence is time sensitive. Kubernetes routinely reschedules and replaces workloads, so the moment Kubernetes terminates or evicts a container with unintended access, your runtime state is lost: in-memory credentials, active network connections, injected processes, and ephemeral file system changes. According to the SANS 2024 Incident Response Survey, organizations that can’t preserve volatile evidence during container security events might face investigation delays of hours to days and risk compliance gaps with frameworks like PCI DSS and SOC 2 that require forensic evidence retention. Without a way to capture this state, you might face a choice between terminating the container to contain the issue (destroying evidence) or leaving it running to preserve evidence (extending your exposure window). Forensic container checkpointing with the Kubelet Checkpoint API addresses this tradeoff. You can capture the container’s runtime state (memory pages, file descriptors, network sockets, and process metadata) typically in seconds, without stopping the workload. In our testing with typical microservice containers (200–400 MB resident memory) on m5.xlarge nodes, the CRIU capture typically completes in under 10 seconds and adds less than 5% CPU overhead on the node during the capture, and the full end-to-end flow, including packaging and pushing the checkpoint to Amazon Elastic Container Registry (Amazon ECR), typically completes in under 30 seconds. Larger …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://aws.amazon.com/blogs/containers/forensic-container-checkpointing-on-amazon-eks/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.