Ephemeral containers

Short-lived workloads limit how long a compromise survives and also how much evidence there is afterwards.

An attacker's foothold disappears when the pod is replaced, which is genuinely valuable. So does everything an investigator would want. Capturing what matters before the container goes is something that has to be designed in, because by default the answer is that it is gone.