WG Checkpoint Restore Meeting for 2026-08-06
Source: YouTube · Kubernetes · published Aug 6, 2026 · 24:15
The Kubernetes SIG Node team is advancing the Pod Checkpoint/Restore API, emphasizing secure defaults, forensic timeline capabilities, and a phased approach that excludes GPU support in the initial phase.
Key Takeaways:
• The team is standardizing on the kubernetes.io API group and ensuring security is enabled by default, preventing users from bypassing authorization even when feature gates are active 1:22.
• DataDog’s incident response team highlighted the need for sequential checkpoints to build forensic timelines of cyber attacks, noting that while container checkpointing exists in beta since 1.30, pod-level support is the priority for production readiness 3:10.
• Experiments with CRIU compression revealed that larger box sizes do not significantly improve compression ratios or performance, though they do enable parallel decompression 12:40.
• GPU checkpointing is excluded from the initial proposal due to Dynamic Resource Allocation (DRA) complexities; the team will focus on same-node checkpointing first before addressing cross-node scenarios 18:48.
The immediate next steps involve addressing API review comments and developing a separate proposal for GPU checkpointing as an extension to the core functionality.
Sources:
- 1:22 Discussion on authorization bypass and security defaults.
- 3:10 DataDog's interest in forensic timeline capabilities.
- 8:32 Deprecation of container checkpointing in favor of pod-level.
- 12:40 CRIU compression box size experiments and performance results.
- [18:48](https://www.youtube.com/watch?v=ZxEtC2Gb
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
So I asked Peter he he's not uh he's away today so he won't be able to join the meeting but um there are a few questions that um essentially we need to answer um for uh for the API reviews. I guess the the main question is uh which um essentially which API group we should use for the uh P checkpoint object. Um one of the review comments is suggesting that we already have not kubernetes.io group. Um so I can update the patches I guess to use this one this group but later we can also change it. Um and the other question we have to answer is whether um the authorization for um P restore should be disa users should be able to disable this toization or whether we should just rely on the um I guess on the feature gate. So when the feature gate is enabled um users can bypass this authorization co…