mirror of
https://github.com/containers/podman.git
synced 2026-07-09 06:44:58 -04:00
2c7aeab70b
When checkpointing a container with --leave-running, libpod dumps the container's memory via the OCI runtime (CRIU) first and only captures the rootfs diff and named volumes afterwards. CRIU thaws the container as soon as the memory dump finishes, so the processes inside the container continue to run between the memory snapshot and the file-system capture. As a result, the checkpoint can be inconsistent: have CRIU images and a file system that reflect different points in time. To fix this, we freeze the container's cgroup before invoking the OCI runtime and thaw it again only after the checkpoint image/archive has been written. The OCI runtime calls CRIU with the freezer cgroup and restores it to its previous state once the dump completes, so a container that was already frozen stays frozen across the dump and the file system is captured at the same instant as the CRIU images. This mirrors the approach other engines (e.g. CRI-O and containerd). The default (stopping) checkpoint functionality is not affected by this issue because CRIU leaves the tasks dead after the dump. This patch also adds a regression test for the consistency of live (--leave-running) checkpoints. The container runs a workload that keeps an in-memory counter in sync with a value written to a file on its root file system, maintaining the invariant that the on-disk value never gets ahead of the in-memory counter. Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>