libcriu: add API for join-ns option

[rst0git]

We use the join-ns RPC API in runc to enable checkpoint/restore of containers with shared namespaces. Shared namespaces are often used when containers run inside Kubernetes Pod. However, crun is using libcriu to interface with CRIU and libcriu currently doesn't provide an API for join-ns. This pull request adds the libcriu API necessary to enable checkpoint/restore of containers with shared namespaces with crun.

[adrianreber]

I was a bit confused about the interface. Path names instead of file descriptors. Looking at the RPC and CLI interface I think your implementation is correct as RPC and CLI also use path names and not file descriptors. Which is confusing because inherit-fd uses file descriptors.

Everything looks good. Unfortunately the arm tests are currently not running. I will wait for the results from those tests and then it looks ready to be merged.

[rst0git]

Thank you Adrian for the code review. I was hoping to ask for feedback for the test case of join-ns. It would currently check that checkpoint/restore has succeeded. While this is sufficient to check if the join-ns option has been passed to CRIU (example below), we don't currently have tests to verify that --join-ns actually works. Perhaps we could add the tests in runc/crun?

sudo make -C test/others/libcriu/ run
sudo cat test/others/libcriu/wdir/i/test_join_ns/restore.log | grep 'join namespace'
(00.000244) Added ipc:/proc/66302/ns/ipc join namespace
(00.000264) Added uts:/proc/66302/ns/uts join namespace
(00.000281) Added time:/proc/66302/ns/time join namespace

@avagin do you have any advice?

[adrianreber]

Thank you Adrian for the code review. I was hoping to ask for feedback for the test case of join-ns. It would currently check that checkpoint/restore has succeeded. While this is sufficient to check if the join-ns option has been passed to CRIU (example below), we don't currently have tests to verify that --join-ns actually works. Perhaps we could add the tests in runc/crun?

sudo make -C test/others/libcriu/ run
sudo cat test/others/libcriu/wdir/i/test_join_ns/restore.log | grep 'join namespace'
(00.000244) Added ipc:/proc/66302/ns/ipc join namespace
(00.000264) Added uts:/proc/66302/ns/uts join namespace
(00.000281) Added time:/proc/66302/ns/time join namespace

@avagin do you have any advice?

I would compare /proc/<PID>/ns/<namespace> just as we do in other tests.

[rst0git]

I would compare /proc/<PID>/ns/<namespace> just as we do in other tests.

Thanks, I've updated the test case.

[codecov-commenter]

Codecov Report

Merging #1617 (29459f9) into criu-dev (afbfaca) will decrease coverage by 0.03%.
The diff coverage is 46.66%.

❗ Current head 29459f9 differs from pull request most recent head 2aa4af9. Consider uploading reports for the commit 2aa4af9 to get more accurate results

@@             Coverage Diff              @@
##           criu-dev    #1617      +/-   ##
============================================
- Coverage     68.84%   68.80%   -0.04%     
============================================
  Files           137      137              
  Lines         33299    33359      +60     
============================================
+ Hits          22924    22953      +29     
- Misses        10375    10406      +31     

Impacted Files	Coverage Δ
lib/c/criu.c	34.55% <46.66%> (+0.76%)	⬆️
criu/uffd.c	76.94% <0.00%> (-0.99%)	⬇️
criu/cr-restore.c	66.62% <0.00%> (-0.20%)	⬇️
criu/cr-service.c	63.33% <0.00%> (+0.19%)	⬆️
criu/namespaces.c	69.59% <0.00%> (+0.96%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update afbfaca...2aa4af9. Read the comment docs.

[adrianreber]

I see that you changed run.sh. Could you add it to the shellcheck test targets?