containerd
diff --git a/‎.github/workflows/ci.yml
Copy file name to clipboard
+17-1Lines changed: 17 additions & 1 deletion b/‎.github/workflows/ci.yml
Copy file name to clipboard
+17-1Lines changed: 17 additions & 1 deletion
diff --git a/‎api/go.mod
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions b/‎api/go.mod
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
diff --git a/‎api/go.sum
Copy file name to clipboard
+2-1Lines changed: 2 additions & 1 deletion b/‎api/go.sum
Copy file name to clipboard
+2-1Lines changed: 2 additions & 1 deletion
diff --git a/‎client/container.go
Copy file name to clipboard
+95-32Lines changed: 95 additions & 32 deletions b/‎client/container.go
Copy file name to clipboard
+95-32Lines changed: 95 additions & 32 deletions
diff --git a/‎contrib/checkpoint/checkcriu.go
Copy file name to clipboard
+32Lines changed: 32 additions & 0 deletions b/‎contrib/checkpoint/checkcriu.go
Copy file name to clipboard
+32Lines changed: 32 additions & 0 deletions
@@ -375,7 +375,7 @@ jobs:
   integration-linux:
     name: Linux Integration
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 40
+    timeout-minutes: 60
     needs: [project, linters, protos, man]
 
     strategy:
@@ -489,6 +489,22 @@ jobs:
           env
           sudo -E PATH=$PATH ./script/critest.sh "${{github.workspace}}/report"
 
+      - name: Install tools
+        # The GitHub Actions image already has buildah and podman included. Not the
+        # ubuntu-24.04-arm images. buildah and podman  is needed to convert the
+        # Kubernetes checkpoint archive to an OCI image.
+        # See contrib/checkpoint/checkpoint-restore-cri-test.sh
+        if: matrix.os == 'ubuntu-24.04-arm'
+        run: sudo apt-get install -y buildah podman
+
+      - name: Checkpoint/Restore via CRI
+        env:
+          TEST_RUNTIME: ${{ matrix.runtime }}
+          CGROUP_DRIVER: ${{ matrix.cgroup_driver }}
+        run: |
+          env
+          sudo -E PATH=$PATH ./contrib/checkpoint/checkpoint-restore-cri-test.sh
+
       # Log the status of this VM to investigate issues like
       # https://github.com/containerd/containerd/issues/4969
       - name: Host Status
 
@@ -20,4 +20,5 @@ require (
 	golang.org/x/net v0.33.0 // indirect
 	golang.org/x/sys v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -75,5 +75,6 @@ google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ
 google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -85,6 +85,9 @@ type Container interface {
 	Update(context.Context, ...UpdateContainerOpts) error
 	// Checkpoint creates a checkpoint image of the current container
 	Checkpoint(context.Context, string, ...CheckpointOpts) (Image, error)
+	// Restore restores a container and returns the PID of the
+	// restored containers init process.
+	Restore(context.Context, cio.Creator, string) (int, error)
 }
 
 func containerFromRecord(client *Client, c containers.Container) *container {
@@ -242,41 +245,13 @@ func (c *container) NewTask(ctx context.Context, ioCreate cio.Creator, opts ...N
 		Stdout:      cfg.Stdout,
 		Stderr:      cfg.Stderr,
 	}
-	r, err := c.get(ctx)
-	if err != nil {
+	if err := c.handleMounts(ctx, request); err != nil {
 		return nil, err
 	}
-	if r.SnapshotKey != "" {
-		if r.Snapshotter == "" {
-			return nil, fmt.Errorf("unable to resolve rootfs mounts without snapshotter on container: %w", errdefs.ErrInvalidArgument)
-		}
 
-		// get the rootfs from the snapshotter and add it to the request
-		s, err := c.client.getSnapshotter(ctx, r.Snapshotter)
-		if err != nil {
-			return nil, err
-		}
-		mounts, err := s.Mounts(ctx, r.SnapshotKey)
-		if err != nil {
-			return nil, err
-		}
-		spec, err := c.Spec(ctx)
-		if err != nil {
-			return nil, err
-		}
-		for _, m := range mounts {
-			if spec.Linux != nil && spec.Linux.MountLabel != "" {
-				if ml := label.FormatMountLabel("", spec.Linux.MountLabel); ml != "" {
-					m.Options = append(m.Options, ml)
-				}
-			}
-			request.Rootfs = append(request.Rootfs, &types.Mount{
-				Type:    m.Type,
-				Source:  m.Source,
-				Target:  m.Target,
-				Options: m.Options,
-			})
-		}
+	r, err := c.get(ctx)
+	if err != nil {
+		return nil, err
 	}
 	info := TaskInfo{
 		runtime: r.Runtime.Name,
@@ -348,6 +323,94 @@ func (c *container) Update(ctx context.Context, opts ...UpdateContainerOpts) err
 	return nil
 }
 
+func (c *container) handleMounts(ctx context.Context, request *tasks.CreateTaskRequest) error {
+	r, err := c.get(ctx)
+	if err != nil {
+		return err
+	}
+
+	if r.SnapshotKey != "" {
+		if r.Snapshotter == "" {
+			return fmt.Errorf("unable to resolve rootfs mounts without snapshotter on container: %w", errdefs.ErrInvalidArgument)
+		}
+
+		// get the rootfs from the snapshotter and add it to the request
+		s, err := c.client.getSnapshotter(ctx, r.Snapshotter)
+		if err != nil {
+			return err
+		}
+		mounts, err := s.Mounts(ctx, r.SnapshotKey)
+		if err != nil {
+			return err
+		}
+		spec, err := c.Spec(ctx)
+		if err != nil {
+			return err
+		}
+		for _, m := range mounts {
+			if spec.Linux != nil && spec.Linux.MountLabel != "" {
+				if ml := label.FormatMountLabel("", spec.Linux.MountLabel); ml != "" {
+					m.Options = append(m.Options, ml)
+				}
+			}
+			request.Rootfs = append(request.Rootfs, &types.Mount{
+				Type:    m.Type,
+				Source:  m.Source,
+				Target:  m.Target,
+				Options: m.Options,
+			})
+		}
+	}
+
+	return nil
+}
+
+func (c *container) Restore(ctx context.Context, ioCreate cio.Creator, rootDir string) (int, error) {
+	errorPid := -1
+	i, err := ioCreate(c.id)
+	if err != nil {
+		return errorPid, err
+	}
+	defer func() {
+		if err != nil && i != nil {
+			i.Cancel()
+			i.Close()
+		}
+	}()
+	cfg := i.Config()
+
+	request := &tasks.CreateTaskRequest{
+		ContainerID: c.id,
+		Terminal:    cfg.Terminal,
+		Stdin:       cfg.Stdin,
+		Stdout:      cfg.Stdout,
+		Stderr:      cfg.Stderr,
+	}
+
+	if err := c.handleMounts(ctx, request); err != nil {
+		return errorPid, err
+	}
+
+	request.Checkpoint = &types.Descriptor{
+		Annotations: map[string]string{
+			// The following annotation is used to restore a checkpoint
+			// via CRI. This is mainly used to restore a container
+			// in Kubernetes.
+			"RestoreFromPath": rootDir,
+		},
+	}
+	// (adrianreber): it is not totally clear to me, but it seems the only
+	// way to restore a container in containerd is going through Create().
+	// This functions sets up Create() in such a way to handle container
+	// restore coming through the CRI.
+	response, err := c.client.TaskService().Create(ctx, request)
+	if err != nil {
+		return errorPid, errgrpc.ToNative(err)
+	}
+
+	return int(response.GetPid()), nil
+}
+
 func (c *container) Checkpoint(ctx context.Context, ref string, opts ...CheckpointOpts) (Image, error) {
 	index := &ocispec.Index{
 		Versioned: ver.Versioned{
 
@@ -0,0 +1,32 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// checkcriu is a tool to check if CRIU is actually available and
+// at least criu.PodCriuVersion (3.16). This is the first version
+// of CRIU which can handle checkpointing and restoring containers
+// out of pods and into pods (shared pid namespace).
+
+package main
+
+import (
+	criu "github.com/checkpoint-restore/go-criu/v7/utils"
+)
+
+func main() {
+	if err := criu.CheckForCriu(criu.PodCriuVersion); err != nil {
+		panic(err)
+	}
+}
Original file line number	Diff line number	Diff line change
`@@ -20,4 +20,5 @@ require (`
`20`	`20`	`golang.org/x/net v0.33.0 // indirect`
`21`	`21`	`golang.org/x/sys v0.28.0 // indirect`
`22`	`22`	`golang.org/x/text v0.21.0 // indirect`
	`23`	`+ gopkg.in/yaml.v3 v3.0.1 // indirect`
`23`	`24`	`)`