`--manage-cgroups-mode` can not be `ignore` when checkpoint and restore containers

[loheagn]

Description

I am attempting to use runc to checkpoint and restore containers (by calling CRIU), and I do not want CRIU to dump and restore cgroups. I found in the documentation for restore that this can be achieved by setting the --manage-cgroups-mode parameter to ignore during the checkpoint and restore process.

However, I discovered through the code that if I set --manage-cgroups-mode to ignore, this parameter will not ultimately take effect in the final concatenation of the call to CRIU's rpc options, as the value of ignore is 0.

https://github.com/opencontainers/runc/blob/313ec8bcabe62b31fdab24c11fbf2d3c0a65e5fa/libcontainer/criu_linux.go#L389-L393

Steps to reproduce the issue

Describe the results you received and expected

If a user sets --manage-cgroups-mode to ignore while using the checkpoint or restore commands, runc should translate this value into the corresponding enumeration value given in go-criu (which is 0) and append it to rpcOpts. However, the current logic fails to retain the user's setting of ignore, and does not pass the corresponding --manage-cgroups option to CRIU, resulting in CRIU using soft instead of ignore as the default value.

What version of runc are you using?

runc version 1.1.10 commit: v1.1.10-0-g18a0cb0f-dirty spec: 1.0.2-dev go: go1.21.6 libseccomp: 2.5.4

Host OS information

PRETTY_NAME="Ubuntu 23.10" NAME="Ubuntu" VERSION_ID="23.10" VERSION="23.10 (Mantic Minotaur)" VERSION_CODENAME=mantic ID=ubuntu ID_LIKE=debian HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" UBUNTU_CODENAME=mantic LOGO=ubuntu-logo

Host kernel information

Linux lima-ccr-dev 6.5.0-14-generic #14-Ubuntu SMP PREEMPT_DYNAMIC Tue Nov 14 15:13:47 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

[loheagn]

If this is a bug, I'd like to submit a PR to fix it :)

[lifubang]

Thanks, I think it's not a bug:

func (x *CriuOpts) GetManageCgroupsMode() CriuCgMode {
	if x != nil && x.ManageCgroupsMode != nil {
		return *x.ManageCgroupsMode
	}
	return CriuCgMode_IGNORE
}

But it seems that it doesn't fit to the doc you provided: Default is SOFT

[loheagn]

Thanks, I think it's not a bug:

func (x *CriuOpts) GetManageCgroupsMode() CriuCgMode {
	if x != nil && x.ManageCgroupsMode != nil {
		return *x.ManageCgroupsMode
	}
	return CriuCgMode_IGNORE
}

But it seems that it doesn't fit to the doc you provided: Default is SOFT

@lifubang Thanks for the reply.

However, I don't think the code you provided is helpful in answering this question. This piece of code is not used by the code being run, and I am not sure if it will be used by CRIU to determine the value of --manage-cgroups. (In fact, I think this code looks like it was automatically generated using a proto tool, and in itself does not have any significance.) In fact, according to CRIU's documentation, the default value for --manage-cgroups is not ignore, but soft.

[CoderSherlock]

In fact, according to CRIU's documentation, the default value for --manage-cgroups is not ignore, but soft.

IIUC, If you don't set --manage-cgroups, it should be able to pass ignore as a --manage-cgroup-mode.

https://github.com/checkpoint-restore/criu/blob/cb39c62f8a2be2a686dbfc60a2730729dd082624/criu/cr-service.c#L656-L664

[kolyshkin]

Please note that --manage-cgroups-mode ignore (https://github.com/opencontainers/runc/pull/3546) only appeared in runc 1.2.

It looks like you're using runc 1.1.10 which does not have it.

Please give https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.1 a try and see if it helps.

[kolyshkin]

@loheagn please let us know if this helps.

[xhejtman]

Hello, for me it helped.