[question] why containerd can not dump and restore net ns

[Ace-Tang]

Hi, @avagin , I come from the containerd project, and see you pr to fix broken criu in moby. I am new to criu, as I know, criu is support dump and restore network namespace, so I am wondering why you write this,

checkpoint: don't restore a container network namespace
A network namespace should not be dumped and restored, it is created by
Docker even for restored containers.

Is this related to moby?

[avagin]

Here I mean that runc doesn't restore network devices and their configurations. When a container is started, its network namespace is configured by third-party tools from a pre-start hook. A container network namespace is connected with an external network and containerd, runc know nothing about this. I mean that we know nothing about how a container is connected into an external network.

So when we were doing the integration of criu with docker, we decided that criu will create an empty network namespace and call a pre-start hook, which will create (restore) network devices and configure them. It is the same hook what is called when a container is started.

[Ace-Tang]

Thanks very much for you detail explain, I think I have understand.

[Ace-Tang]

Oh, sorry, I forget to ask one more question. So we should always set empty-ns with network in runc restore? but I found that default umask nsmask := unix.CLONE_NEWNET is only set in runc checkpoint, but not in runc restore, is restore process need to set this by default?

[avagin]

@Ace-Tang It will work even if we set unix.CLONE_NEWNET only on dump, but it is better to set it on restore too. Do you want to fix this in runc?

[Ace-Tang]

@avagin , sure, I want to do this, we are using checkpoint/restore to support our business， I find if we are not set this mask, it will cost more time(millisecond or less), if you don't mind, I will try to create a pr for runc, see if runc can accept this.

[avagin]

@Ace-Tang I don't mind:). Add me into CC of this pr or post a link here. Thanks.

[Ace-Tang]

I create a pr opencontainers/runc#1871 in runc, @avagin please help me to check that, thanks.