Repository navigation
Conversation
A container with its own user namespace cannot create device nodes, so the devices are bind mounted from the host. CRIU was only told about the bind mounts listed in the configuration, so the checkpoint failed with: mnt: ./dev/urandom doesn't have a proper root mount If the container has a user namespace, enable the autodetection of external bind mounts on checkpoint and restore. Other containers keep the strict handling of the unlisted bind mounts. Add a checkpoint/restore test with a user namespace. Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org>
Collaborator
|
It's probably better to list those mounts explicitly (like it's done in mounts and masked_paths), rather than rely on CRIU autodetect. Besides, if we want to enforce mount flags on restore rather than relying on what's in the image (like commit 6dfaa3e does), we need to add them explicitly on restore. I will show the code soon. |
Collaborator
it was more than I hoped for so here's the alternative PR: #2465 |
Member
Author
|
closed in favor of #2465 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A container with its own user namespace cannot create device nodes, so the devices are bind mounted from the host. CRIU was only told about the bind mounts listed in the configuration, so the checkpoint failed with:
mnt: ./dev/urandom doesn't have a proper root mount
If the container has a user namespace, enable the autodetection of external bind mounts on checkpoint and restore. Other containers keep the strict handling of the unlisted bind mounts.
Add a checkpoint/restore test with a user namespace.