What would be a good way to take snapshots of a container from within the container itself?

Context:
--------

I have a container Foo

When certain events happen on container Foo, I want to take a snapshot of container Foo, label the image, and optionally push that snapshot to a repository. 

I've seen [this answer](https://stackoverflow.com/a/49873529/21539) which would let me run arbitrary commands from the container to the host system, but I'd prefer to avoid that since that gives Foo too much freedom on the host system. 

**I'm hoping you all can provide a simpler option.**

*Regarding security:* For my scenario, security issues are not too much of a concern (trust me on this), but I would like not not make it easy for my users to shoot themselves in the foot.