Skip to content

Added the diff command - for enabling forensic analysis of checkpoint differences in Kubernetes #192

Merged
rst0git merged 1 commit intocheckpoint-restore:mainfrom
Lorygold:add_diff_command
Feb 26, 2026
Merged

Added the diff command - for enabling forensic analysis of checkpoint differences in Kubernetes #192
rst0git merged 1 commit intocheckpoint-restore:mainfrom
Lorygold:add_diff_command

Conversation

@Lorygold
Copy link
Copy Markdown
Contributor

@Lorygold Lorygold commented Jan 24, 2026

Introduces a diff command to compare container checkpoints and highlight changes in tasks and runtime state. Supports tree and JSON views, helping security engineers investigate incidents by comparing two checkpoints, making changes more visible and easier to analyze.

Resolves #173

@github-actions

This comment was marked as outdated.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jan 24, 2026

Test Results

73 tests  +12   73 ✅ +12   3s ⏱️ -1s
 1 suites ± 0    0 💤 ± 0 
 1 files   ± 0    0 ❌ ± 0 

Results for commit 4c56c27. ± Comparison against base commit d4ddee6.

♻️ This comment has been updated with latest results.

@adrianreber
Copy link
Copy Markdown
Member

Did you forget to commit some changes? You reference the function DiffTasks() is not defined anywhere from what I can see.

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Jan 26, 2026

Codecov Report

❌ Patch coverage is 68.90080% with 116 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.41%. Comparing base (d4ddee6) to head (4c56c27).

Files with missing lines Patch % Lines
cmd/diff.go 67.64% 72 Missing and 27 partials ⚠️
internal/diff_types.go 74.24% 15 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #192      +/-   ##
==========================================
- Coverage   76.00%   74.41%   -1.60%     
==========================================
  Files          13       15       +2     
  Lines        1288     1661     +373     
==========================================
+ Hits          979     1236     +257     
- Misses        232      319      +87     
- Partials       77      106      +29     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@adrianreber
Copy link
Copy Markdown
Member

The current error is because the test will try to compile each commit. The best thing to do here, because it is all connected, just squash the commits.

@rst0git rst0git force-pushed the add_diff_command branch 2 times, most recently from 342d665 to 6bdd765 Compare January 26, 2026 18:12
@Lorygold Lorygold changed the title Added the diff command Enable forensic analysis of checkpoint differences in Kubernetes (added the diff command) Jan 26, 2026
@Lorygold Lorygold changed the title Enable forensic analysis of checkpoint differences in Kubernetes (added the diff command) Added the diff command - for enabling forensic analysis of checkpoint differences in Kubernetes Jan 26, 2026
Comment thread cmd/diff.go
Comment thread cmd/diff.go Outdated
@Lorygold Lorygold force-pushed the add_diff_command branch 2 times, most recently from 5e2f699 to 7120e7a Compare January 26, 2026 21:15
@adrianreber
Copy link
Copy Markdown
Member

Looks good so far. Please add tests. The goal is to have pretty good code coverage with our tests.

You could also add the diff feature to the README.md file.

@github-actions
Copy link
Copy Markdown

Library Size Check Failed

The library size increase exceeds the allowed threshold.

Size Check Output

@Lorygold
Copy link
Copy Markdown
Contributor Author

Lorygold commented Feb 15, 2026

Hello everybody, I've added bats tests and the diff command to the readme file

Let me know!

@adrianreber
Copy link
Copy Markdown
Member

The library size CI check failure is not a problem. This should go away if you do a rebase (git pull --rebase and then another force push should solve this).

From my point of view this is almost ready. Some smaller changes would be nice:

  • please add unit tests for this file internal/diff_types.go
  • the formatting does not always look correct
┌─ Memory Changes ─────────────────────────────────────────────┐
│ = No change
└───────────────────────────────────────────────────────────────┘
┌─ Process Changes ────────────────────────────────────────────┐
└───────────────────────────────────────────────────────────────┘

The upper border seems to be on character shorter than the lower border.

With these changes I think we could merge this is a first step and then if necessary adapt it to future needs.

@rst0git rst0git added the bloat-ok Ignore increase in binary size label Feb 26, 2026
Forensic investigations typically require analyzing the changes
between two or more checkpoints to understand how the container
state has changed over time. This method allows investigators to
infer different types of events that occurred during a security
incident and make educated conclusions. The `diff` command aims
to identify and highlight such checkpoint changes and make them
easier to analyze.

Signed-off-by: Lorygold <lory.goldoni@gmail.com>
Signed-off-by: Radostin Stoyanov <radostin@redhat.com>
@rst0git rst0git merged commit b6a92e6 into checkpoint-restore:main Feb 26, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bloat-ok Ignore increase in binary size

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature: Checkpoint Diffing (Compare Two Checkpoints)

4 participants