509
edits
Changes
mLine 71:
Line 71: − + − + − </pre>+ + + + + + − <pre>+ − + + + + +
→Forensic Analysis
Once a container checkpoint has been created, it's content can be analysed with the help of the [https://github.com/checkpoint-restore/checkpointctl checkpointctl] tool.
Once a container checkpoint has been created, it's content can be analysed with the help of the [https://github.com/checkpoint-restore/checkpointctl checkpointctl] tool.
<code>checkpointctl</code> provides <code>list</code> and <code>show</code> commands that can be used to display an overview of the existing checkpoints stored in <code>/var/lib/kubelet/checkpoints</code>.
<code>checkpointctl</code> provides <code>list</code> and <code>show</code> commands that display an overview of checkpoints stored in <code>/var/lib/kubelet/checkpoints</code>.
<pre>
<pre>
sudo checkpointctl list
$ sudo checkpointctl list
Listing checkpoints in path: /var/lib/kubelet/checkpoints/
NAMESPACE POD CONTAINER ENGINE TIME CHECKPOINTED CHECKPOINT NAME
--------- --- --------- ------ ----------------- ---------------
default counters counter containerd 07 Nov 25 11:58 UTC checkpoint-counters_default-counter-2025-11-07T11:58:58Z.tar
default counters counter containerd 07 Nov 25 12:09 UTC checkpoint-counters_default-counter-2025-11-07T12:09:07Z.tar
default counters counter containerd 07 Nov 25 12:30 UTC checkpoint-counters_default-counter-2025-11-07T12:30:00Z.tar
$ sudo checkpointctl show /var/lib/kubelet/checkpoints/checkpoint-counters_default-counter-2025-11-07T11:58:58Z.tar
sudo checkpointctl show /var/lib/kubelet/checkpoints/checkpoint-counters_default-counter-2025-11-07T11:58:58Z.tar
Displaying container checkpoint data from /var/lib/kubelet/checkpoints/checkpoint-counters_default-counter-2025-11-07T11:58:58Z.tar
CONTAINER IMAGE ID RUNTIME CREATED ENGINE CHKPT SIZE ROOT FS DIFF SIZE
--------- ----- -- ------- ------- ------ ---------- -----------------
counter docker.io/library/busybox:latest 52d907dc8f75 io.containerd.runc.v2 2025-11-07T11:48:41Z containerd 306.8 KiB 270 B
</pre>
</pre>