Containers on the Move: An Experimental Analysis of Container Migration in Kubernetes

In the rapidly evolving landscape of cloud computing, demand for additional security measures is rising. One technique that provides capabilities to evade and react to cyber threats is Moving Target Defense (MTD). There is a broad spectrum of MTD actions, one of which is container live migration. This paper explores the topic of container live migration within Kubernetes environments, proposing an approach using CRIU (Checkpoint/Restore in Userspace) and Kubernetes' beta feature “ContainerCheckpoint.” A prototype algorithm has been implemented, which successfully migrates containers between multiple Kubernetes clusters while preserving their state for stateful application continuity. These migrations are conducted with a diverse set of benchmarking applications, each with varying memory, computational, and storage demands. To evaluate the migration's efficiency, the duration of the entire migration, checkpointing, and restoring phases are analyzed. Further, it is found that the checkpointing part of the migration process is much shorter than the restoration one. The proposed container live migration technique, while a proof of concept in its prototype form, could be further developed as a shuffling variant of MTD after refinements.