# Forensic container checkpointing on Amazon Elastic Kubernetes Service (Amazon EKS)

DevFeed: [Forensic container checkpointing on Amazon Elastic Kubernetes Service (Amazon EKS)](<https://devfeed.tech/articles/forensic-container-checkpointing-on-amazon-elastic-kubernetes-service-amazon-eks-4631.md>)

Original publisher: [Read original article](<https://aws.amazon.com/blogs/containers/forensic-container-checkpointing-on-amazon-eks/>)

Author: Varun DeviReddy

Published: 2026-08-12T17:38:15Z

Content type: tutorial

Language: en

Sources: [Containers](<https://devfeed.tech/sources/containers.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>)

Tags: [advanced-300](<https://devfeed.tech/tags/advanced-300.md>), [amazon-eks](<https://devfeed.tech/tags/amazon-eks.md>), [amazon-elastic-kubernetes-service](<https://devfeed.tech/tags/amazon-elastic-kubernetes-service.md>), [api](<https://devfeed.tech/tags/api.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [containers](<https://devfeed.tech/tags/containers.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [memory](<https://devfeed.tech/tags/memory.md>), [processes](<https://devfeed.tech/tags/processes.md>), [security](<https://devfeed.tech/tags/security.md>), [technical-how-to](<https://devfeed.tech/tags/technical-how-to.md>)

## AI overview

This tutorial explains how to preserve volatile runtime evidence from suspicious containers on Amazon EKS by using the Kubelet Checkpoint API. It deploys a checkpoint agent that captures container state without stopping the workload, packages the result as an OCI image, and stores it in Amazon ECR for later forensic analysis.

## Source excerpt

Amazon EKS 1.34 makes the Kubelet Checkpoint API functional, so you can capture a running container's full state (memory, processes, and network connections) without stopping the workload. This post shows how to deploy an unprivileged checkpoint agent that stores forensic checkpoints in Amazon ECR as OCI images for later analysis.