--manage-cgroups-mode can not be ignore when checkpoint and restore containers

[loheagn]

Description

I am attempting to use runc to checkpoint and restore containers (by calling CRIU), and I do not want CRIU to dump and restore cgroups. I found in the documentation for restore that this can be achieved by setting the --manage-cgroups-mode parameter to ignore during the checkpoint and restore process.

However, I discovered through the code that if I set --manage-cgroups-mode to ignore, this parameter will not ultimately take effect in the final concatenation of the call to CRIU's rpc options, as the value of ignore is 0.

runc/libcontainer/criu_linux.go

Lines 389 to 393 in 313ec8b

	// append optional manage cgroups mode
	if criuOpts.ManageCgroupsMode != 0 {
	mode := criuOpts.ManageCgroupsMode
	rpcOpts.ManageCgroupsMode = &mode
	}

Steps to reproduce the issue

Describe the results you received and expected

If a user sets --manage-cgroups-mode to ignore while using the checkpoint or restore commands, runc should translate this value into the corresponding enumeration value given in go-criu (which is 0) and append it to rpcOpts. However, the current logic fails to retain the user's setting of ignore, and does not pass the corresponding --manage-cgroups option to CRIU, resulting in CRIU using soft instead of ignore as the default value.

What version of runc are you using?

runc version 1.1.10
commit: v1.1.10-0-g18a0cb0f-dirty
spec: 1.0.2-dev
go: go1.21.6
libseccomp: 2.5.4

Host OS information

PRETTY_NAME="Ubuntu 23.10"
NAME="Ubuntu"
VERSION_ID="23.10"
VERSION="23.10 (Mantic Minotaur)"
VERSION_CODENAME=mantic
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=mantic
LOGO=ubuntu-logo

Host kernel information

Linux lima-ccr-dev 6.5.0-14-generic #14-Ubuntu SMP PREEMPT_DYNAMIC Tue Nov 14 15:13:47 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

[loheagn]

If this is a bug, I'd like to submit a PR to fix it :)

[lifubang]

Thanks, I think it's not a bug:

func (x *CriuOpts) GetManageCgroupsMode() CriuCgMode {
	if x != nil && x.ManageCgroupsMode != nil {
		return *x.ManageCgroupsMode
	}
	return CriuCgMode_IGNORE
}

But it seems that it doesn't fit to the doc you provided: Default is SOFT

[loheagn]

Thanks, I think it's not a bug:

func (x *CriuOpts) GetManageCgroupsMode() CriuCgMode {
	if x != nil && x.ManageCgroupsMode != nil {
		return *x.ManageCgroupsMode
	}
	return CriuCgMode_IGNORE
}

But it seems that it doesn't fit to the doc you provided: Default is SOFT

@lifubang Thanks for the reply.

However, I don't think the code you provided is helpful in answering this question. This piece of code is not used by the code being run, and I am not sure if it will be used by CRIU to determine the value of --manage-cgroups. (In fact, I think this code looks like it was automatically generated using a proto tool, and in itself does not have any significance.) In fact, according to CRIU's documentation, the default value for --manage-cgroups is not ignore, but soft.

[CoderSherlock]

In fact, according to CRIU's documentation, the default value for --manage-cgroups is not ignore, but soft.

IIUC, If you don't set --manage-cgroups, it should be able to pass ignore as a --manage-cgroup-mode.

https://github.com/checkpoint-restore/criu/blob/cb39c62f8a2be2a686dbfc60a2730729dd082624/criu/cr-service.c#L656-L664

[kolyshkin]

Please note that --manage-cgroups-mode ignore (#3546) only appeared in runc 1.2.

It looks like you're using runc 1.1.10 which does not have it.

Please give https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.1 a try and see if it helps.