mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Adrian Reber
535f25c44f
Restoring an SELinux enabled container with Podman will result in a container with the exactly same SELinux process labels as during checkpointing. CRIU takes care of all the process labels. Restoring multiple copies of a checkpointed container will result in all containers having the same SELinux process labels, which might be undesired. When looking at Pods all container in a Pod share the process label of the infrastructure container. To restore a container into and existing Pod it is necessary to tell CRIU to restore the container with the infrastructure container process label. CRIU supports setting different process labels using --lsm-profile for a long time and this just passes the process label information from runc to CRIU. Unfortunately CRIU has a bug as no one was using the --lsm-profile option so this changes requires the upcoming CRIU version 3.16. Signed-off-by: Adrian Reber <areber@redhat.com>
34 lines
1.8 KiB
Go
34 lines
1.8 KiB
Go
package libcontainer
|
|
|
|
import criu "github.com/checkpoint-restore/go-criu/v5/rpc"
|
|
|
|
type CriuPageServerInfo struct {
|
|
Address string // IP address of CRIU page server
|
|
Port int32 // port number of CRIU page server
|
|
}
|
|
|
|
type VethPairName struct {
|
|
ContainerInterfaceName string
|
|
HostInterfaceName string
|
|
}
|
|
|
|
type CriuOpts struct {
|
|
ImagesDirectory string // directory for storing image files
|
|
WorkDirectory string // directory to cd and write logs/pidfiles/stats to
|
|
ParentImage string // directory for storing parent image files in pre-dump and dump
|
|
LeaveRunning bool // leave container in running state after checkpoint
|
|
TcpEstablished bool // checkpoint/restore established TCP connections
|
|
ExternalUnixConnections bool // allow external unix connections
|
|
ShellJob bool // allow to dump and restore shell jobs
|
|
FileLocks bool // handle file locks, for safety
|
|
PreDump bool // call criu predump to perform iterative checkpoint
|
|
PageServer CriuPageServerInfo // allow to dump to criu page server
|
|
VethPairs []VethPairName // pass the veth to criu when restore
|
|
ManageCgroupsMode criu.CriuCgMode // dump or restore cgroup mode
|
|
EmptyNs uint32 // don't c/r properties for namespace from this mask
|
|
AutoDedup bool // auto deduplication for incremental dumps
|
|
LazyPages bool // restore memory pages lazily using userfaultfd
|
|
StatusFd int // fd for feedback when lazy server is ready
|
|
LsmProfile string // LSM profile used to restore the container
|
|
}
|