With the new Kubelet Checkpoint API support in Amazon EKS 1.34, operations teams can now seize live forensic snapshots of containers, capturing memory, network, and process states rapidly while containers keep running. This capability enhances cloud security investigations and compliance without introducing downtime, enabling faster analysis and safer containment strategies.
- Checkpoint containers live without stopping workloads
- Store forensic snapshots in Amazon ECR as OCI images
- Unprivileged agent minimizes access risk and deployment complexity
Infrastructure signal
Amazon EKS version 1.34 integrates the Kubernetes Kubelet Checkpoint API, which enables capturing container runtime state on-demand by leveraging CRIU through containerd. This allows the system to snapshot memory, file descriptors, network sockets, and processing metadata without halting the running container, significantly reducing investigative data loss during evictions or failures.
Checkpoint creation time scales linearly with container memory size, typically completing in under 30 seconds for common microservice container sizes (200-400 MB). This checkpoint data is packaged as OCI images and stored in Amazon Elastic Container Registry (ECR), leveraging existing artifact storage infrastructure for retention and subsequent forensic analysis.
Developer impact
The ability to checkpoint live containers without stopping them enhances developer and security incident workflows by providing timely access to full runtime evidence. Developers and incident responders can deploy an unprivileged checkpoint agent that interacts with the Kubelet API without requiring privileged access to container runtime sockets, reducing security risks and operational complexity.
This approach complements existing Kubernetes workflows by avoiding sidecar container overhead or socket mounting that could escalate privileges. Moreover, the OCI image format for checkpoints means teams can integrate snapshot storage and retrieval into automated CI/CD or incident response pipelines, leveraging standard container image tools for forensic investigations and resource auditing.
What teams should watch
Security, SRE, and developer teams running Kubernetes workloads on Amazon EKS should evaluate enabling the Kubelet Checkpoint API for enhanced forensic capabilities, especially in regulated or compliance-sensitive environments like PCI DSS and SOC 2. This feature helps meet forensic evidence retention mandates without service disruption or risk of extended exposure due to evasive containers.
Observability and incident response teams will want to watch progress on container restore capabilities, which are under active development upstream in containerd and Kubernetes. While current focus is on forensic checkpointing and storage, future workflows may enable rollback and live restore from checkpoints, improving recovery time objectives and disaster resilience.
Infrastructure teams should monitor resource overhead, as checkpointing adds a limited CPU cost (~5%) during capture and storage operations, and consider housekeeping policies for OCI checkpoint images in ECR to manage storage cost. Automated orchestration tooling like the Kube Resource Orchestrator (kro) can simplify multi-cluster deployment and management of checkpoint agents.