Add support for checkpoint image

[rst0git]

This is an enhancement proposal for the checkpoint / restore feature of Podman that enables container migration across multiple systems with standard image distribution infrastructure.

A new option --create-image <image> has been added to the podman container checkpoint command. This option tells Podman to create a container image. This is a standard image with a single layer, tar archive, that that contains all checkpoint files. This is similar to the current approach for container migration using --export / --import.

The checkpoint image can be pushed to a container registry and pulled on a different system. It can also be exported locally with podman image save and inspected with podman inspect. Inspecting the image would display additional information (stored as annotations) about the host and the versions of Podman, criu, crun/runc, kernel, etc.

podman container restore has also been extended to support checkpoint image provided as input.

Simple example:

podman run -d --name looper busybox /bin/sh -c 'i=0; while true; do echo $i; i=$(expr $i + 1); sleep 1; done'
podman container checkpoint --create-image checkpoint-image-test looper
podman rm looper
podman container restore checkpoint-image-test

Example with multiple containers:

podman run -d --name looper-1 busybox /bin/sh -c 'i=0; while true; do echo $i; i=$(expr $i + 1); sleep 1; done'
podman run -d --name looper-2 busybox /bin/sh -c 'i=0; while true; do echo $i; i=$(expr $i + 1); sleep 1; done'
podman container checkpoint --create-image checkpoint-1 looper-1
podman container checkpoint --create-image checkpoint-2 looper-2
podman rm looper-1 looper-2
podman container restore checkpoint-1 checkpoint-2

Example using container registry:

podman run -d --name looper busybox /bin/sh -c 'i=0; while true; do echo $i; i=$(expr $i + 1); sleep 1; done'
podman container checkpoint --create-image quay.io/rst0git/checkpoint-image-test-1 looper
podman push quay.io/rst0git/checkpoint-image-test-1
podman rm -a
podman rmi -a
podman pull quay.io/rst0git/checkpoint-image-test-1
podman inspect quay.io/rst0git/checkpoint-image-test-1
podman container restore quay.io/rst0git/checkpoint-image-test-1

[vrothberg]

@adrianreber PTAL

[adrianreber]

Overall I like this approach a lot. This is also very helpful when looking at our upcoming CRI-O changes. With something like this we might get container restore in Kubernetes without Kubernetes knowing that it is a restore. At some point, not now, this can be enhanced to have podman run registry/image:latest automatically do a restore if the image is a checkpoint image.

@rst0git Do you also store the name of the container engine (in this case Podman) in the image metadata? Just to make sure we have something in the image to quickly see if it is an image that we can also restore in CRI-O. I have already restored Podman checkpoints in CRI-O using the existing checkpoint archive. My assumption is that it should also be possible with this image format.

[rst0git]

Do you also store the name of the container engine (in this case Podman) in the image metadata?

@adrianreber Not explicitly, but the annotation keys contain the name of the container engine (e.g., io.podman.annotations.).

[rst0git]

I would be happy to squash the commits but Build Each Commit fails when a single commit increases the size of bin/podman with more than 51200 bytes: https://cirrus-ci.com/task/6191166545723392?logs=main#L144

We can overwrite this with a label.

@Luap99 Would it be possible to add a label to overwrite this requirement?

[TomSweeneyRedHat]

@Luap99 is this GTG? PTAL

[vrothberg]

LGTM, thanks!

@Luap99 PTAL

[rhatdan]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhatdan, rst0git

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Luap99]

/lgtm

Sorry for the delay.