Add support for checkpoint and restore via CRIU

.gitignore

@@ -49,6 +49,7 @@ src/lxc/lxc-attach
 src/lxc/lxc-autostart
 src/lxc/lxc-cgroup
 src/lxc/lxc-checkconfig
+src/lxc/lxc-checkpoint
 src/lxc/lxc-clone
 src/lxc/lxc-console
 src/lxc/lxc-config

configure.ac

@@ -644,6 +644,7 @@ AC_CONFIG_FILES([
 	doc/lxc-autostart.sgml
 	doc/lxc-cgroup.sgml
 	doc/lxc-checkconfig.sgml
+	doc/lxc-checkpoint.sgml
 	doc/lxc-clone.sgml
 	doc/lxc-config.sgml
 	doc/lxc-console.sgml

doc/Makefile.am

@@ -20,6 +20,7 @@ man_MANS = \
 	lxc-autostart.1 \
 	lxc-cgroup.1 \
 	lxc-checkconfig.1 \
+	lxc-checkpoint.1 \
 	lxc-clone.1 \
 	lxc-config.1 \
 	lxc-console.1 \

doc/lxc-checkpoint.sgml.in

+<!--
+
+(C) Copyright Canonical Ltd. 2014
+
+Authors:
+Tycho Andersen <tycho.andersen@canonical.com>
+
+This library is free software; you can redistribute it and/or
+modify it under the terms of the GNU Lesser General Public
+License as published by the Free Software Foundation; either
+version 2.1 of the License, or (at your option) any later version.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public
+License along with this library; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+-->
+
+<!DOCTYPE refentry PUBLIC @docdtd@ [
+
+<!ENTITY commonoptions SYSTEM "@builddir@/common_options.sgml">
+<!ENTITY seealso SYSTEM "@builddir@/see_also.sgml">
+]>
+
+<refentry>
+
+  <docinfo><date>@LXC_GENERATE_DATE@</date></docinfo>
+
+  <refmeta>
+    <refentrytitle>lxc-checkpoint</refentrytitle>
+    <manvolnum>1</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>lxc-checkpoint</refname>
+
+    <refpurpose>
+      checkpoint a container
+    </refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>lxc-checkpoint</command>
+      <arg choice="req">-n <replaceable>name</replaceable></arg>
+      <arg choice="req">-D <replaceable>PATH</replaceable></arg>
+      <arg choice="opt">-r</arg>
+      <arg choice="opt">-s</arg>
+      <arg choice="opt">-v</arg>
+      <arg choice="opt">-d</arg>
+      <arg choice="opt">-F</arg>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+    <para>
+      <command>lxc-checkpoint</command> checkpoints and restores containers.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>Options</title>
+    <variablelist>
+
+      <varlistentry>
+        <term>
+          <option>-r, --restore</option>
+        </term>
+        <listitem>
+          <para>
+            Restore the checkpoint for the container, instead of dumping it.
+            This option is incompatible with <option>-s</option>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>
+          <option>-D <replacable>PATH</replacable>, --checkpoint-dir=<replacable>PATH</replacable></option>
+        </term>
+        <listitem>
+          <para>
+            The directory to dump the checkpoint metadata.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>
+          <option>-s, --stop</option>
+        </term>
+        <listitem>
+          <para>
+            Optionally stop the container after dumping. This option is
+            incompatible with <option>-r</option>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>
+          <option>-v, --verbose</option>
+        </term>
+        <listitem>
+          <para>
+            Enable verbose criu logging.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>
+          <option>-d, --daemon</option>
+        </term>
+        <listitem>
+          <para>
+            Restore the container in the background (this is the default).
+            Only available when providing <option>-r</option>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>
+          <option>-F, --foreground</option>
+        </term>
+        <listitem>
+          <para>
+            Restore the container in the foreground. Only available when
+            providing <option>-r</option>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+  </refsect1>
+
+  &commonoptions;
+
+  <refsect1>
+    <title>Examples</title>
+    <variablelist>
+
+      <varlistentry>
+        <term>lxc-checkpoint -n foo -D /tmp/checkpoint</term>
+        <listitem>
+          <para>
+            Checkpoint the container foo into the directory /tmp/checkpoint.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>lxc-checkpoint -r -n foo -D /tmp/checkpoint</term>
+        <listitem>
+          <para>
+            Restore the checkpoint from the directory /tmp/checkpoint.
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+  </refsect1>
+
+  &seealso;
+
+  <refsect1>
+    <title>Author</title>
+    <para>Tycho Andersen <email>tycho.andersen@canonical.com</email></para>
+  </refsect1>
+</refentry>
+
+<!-- Keep this comment at the end of the file
+Local variables:
+mode: sgml
+sgml-omittag:t
+sgml-shorttag:t
+sgml-minimize-attributes:nil
+sgml-always-quote-attributes:t
+sgml-indent-step:2
+sgml-indent-data:t
+sgml-parent-document:nil
+sgml-default-dtd-file:nil
+sgml-exposed-tags:nil
+sgml-local-catalogs:nil
+sgml-local-ecat-files:nil
+End:
+-->

src/lxc/Makefile.am

@@ -184,6 +184,7 @@ bin_PROGRAMS = \
 	lxc-attach \
 	lxc-autostart \
 	lxc-cgroup \
+	lxc-checkpoint \
 	lxc-clone \
 	lxc-config \
 	lxc-console \
@@ -205,6 +206,8 @@ sbin_PROGRAMS = init.lxc
 pkglibexec_PROGRAMS = \
 	lxc-monitord \
 	lxc-user-nic
+pkglibexec_SCRIPTS = \
+	lxc-restore-net
 
 AM_LDFLAGS = -Wl,-E
 if ENABLE_RPATH
@@ -234,6 +237,7 @@ lxc_create_SOURCES = lxc_create.c
 lxc_snapshot_SOURCES = lxc_snapshot.c
 lxc_usernsexec_SOURCES = lxc_usernsexec.c
 lxc_user_nic_SOURCES = lxc_user_nic.c network.c network.h
+lxc_checkpoint_SOURCES = lxc_checkpoint.c
 
 if HAVE_STATIC_LIBCAP
 sbin_PROGRAMS += init.lxc.static

src/lxc/lxc-restore-net

+#!/bin/sh
+
+[ -z "$CRTOOLS_IMAGE_DIR" ] && exit 1
+
+set -e
+
+dir="$CRTOOLS_IMAGE_DIR"
+
+i=0
+while [ -f "$dir/eth$i" ] && [ -f "$dir/veth$i" ] && [ -f "$dir/bridge$i" ]; do
+	veth=$(cat "$dir/veth$i")
+	bridge=$(cat "$dir/bridge$i")
+
+	if [ "$CRTOOLS_SCRIPT_ACTION" = "network-lock" ]; then
+		brctl delif $bridge $veth
+	fi
+
+	if [ "$CRTOOLS_SCRIPT_ACTION" = "network-unlock" ]; then
+		brctl addif $bridge $veth
+		ifconfig $veth 0.0.0.0 up
+	fi
+
+	i=$((i+1))
+done

src/lxc/lxc_checkpoint.c

+/*
+ *
+ * Copyright © 2014 Tycho Andersen <tycho.andersen@canonical.com>.
+ * Copyright © 2014 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+
+#include <lxc/lxccontainer.h>
+
+#include "log.h"
+#include "config.h"
+#include "lxc.h"
+#include "arguments.h"
+
+static char *checkpoint_dir = NULL;
+static bool stop = false;
+static bool verbose = false;
+static bool do_restore = false;
+static bool daemonize_set = false;
+
+static const struct option my_longopts[] = {
+	{"checkpoint-dir", required_argument, 0, 'D'},
+	{"stop", no_argument, 0, 's'},
+	{"verbose", no_argument, 0, 'v'},
+	{"restore", no_argument, 0, 'r'},
+	{"daemon", no_argument, 0, 'd'},
+	{"foreground", no_argument, 0, 'F'},
+	LXC_COMMON_OPTIONS
+};
+
+static int my_checker(const struct lxc_arguments *args)
+{
+	if (do_restore && stop) {
+		lxc_error(args, "-s not compatible with -r.");
+		return -1;
+
+	} else if (!do_restore && daemonize_set) {
+		lxc_error(args, "-d/-F not compatible with -r.");
+		return -1;
+	}
+
+	if (checkpoint_dir == NULL) {
+		lxc_error(args, "-D is required.");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int my_parser(struct lxc_arguments *args, int c, char *arg)
+{
+	switch (c) {
+	case 'D':
+		checkpoint_dir = strdup(arg);
+		if (!checkpoint_dir)
+			return -1;
+		break;
+	case 's':
+		stop = true;
+		break;
+	case 'v':
+		verbose = true;
+		break;
+	case 'r':
+		do_restore = true;
+		break;
+	case 'd':
+		args->daemonize = 1;
+		daemonize_set = true;
+		break;
+	case 'F':
+		args->daemonize = 0;
+		daemonize_set = true;
+		break;
+	}
+	return 0;
+}
+
+static struct lxc_arguments my_args = {
+	.progname  = "lxc-checkpoint",
+	.help      = "\
+--name=NAME\n\
+\n\
+lxc-checkpoint checkpoints and restores a container\n\
+  Serializes a container's running state to disk to allow restoring it in\n\
+  its running state at a later time.\n\
+\n\
+Options :\n\
+  -n, --name=NAME           NAME for name of the container\n\
+  -r, --restore             Restore container\n\
+  -D, --checkpoint-dir=DIR  directory to save the checkpoint in\n\
+  -v, --verbose             Enable verbose criu logs\n\
+  Checkpoint options:\n\
+  -s, --stop                Stop the container after checkpointing.\n\
+  Restore options:\n\
+  -d, --daemon              Daemonize the container (default)\n\
+  -F, --foreground          Start with the current tty attached to /dev/console\n\
+",
+	.options   = my_longopts,
+	.parser    = my_parser,
+	.daemonize = 1,
+	.checker   = my_checker,
+};
+
+bool checkpoint(struct lxc_container *c)
+{
+	bool ret;
+
+	if (!c->is_running(c)) {
+		fprintf(stderr, "%s not running, not checkpointing.\n", my_args.name);
+		lxc_container_put(c);
+		return false;
+	}
+
+	ret = c->checkpoint(c, checkpoint_dir, stop, verbose);
+	lxc_container_put(c);
+
+	if (!ret) {
+		fprintf(stderr, "Checkpointing %s failed.\n", my_args.name);
+		return false;
+	}
+
+	return true;
+}
+
+bool restore(struct lxc_container *c)
+{
+	pid_t pid = 0;
+	bool ret = true;
+
+	if (c->is_running(c)) {
+		fprintf(stderr, "%s is running, not restoring.\n", my_args.name);
+		lxc_container_put(c);
+		return false;
+	}
+
+	if (my_args.daemonize)
+		pid = fork();
+
+	if (pid == 0) {
+		ret = c->restore(c, checkpoint_dir, verbose);
+
+		if (!ret) {
+			fprintf(stderr, "Restoring %s failed.\n", my_args.name);
+		}
+	}
+
+	lxc_container_put(c);
+
+	return ret;
+}
+
+int main(int argc, char *argv[])
+{
+	struct lxc_container *c;
+	bool ret;
+
+	if (lxc_arguments_parse(&my_args, argc, argv))
+		exit(1);
+
+	c = lxc_container_new(my_args.name, my_args.lxcpath[0]);
+	if (!c) {
+		fprintf(stderr, "System error loading %s\n", my_args.name);
+		exit(1);
+	}
+
+	if (!c->may_control(c)) {
+		fprintf(stderr, "Insufficent privileges to control %s\n", my_args.name);
+		lxc_container_put(c);
+		exit(1);
+	}
+
+	if (!c->is_defined(c)) {
+		fprintf(stderr, "%s is not defined\n", my_args.name);
+		lxc_container_put(c);
+		exit(1);
+	}
+
+
+	if (do_restore)
+		ret = restore(c);
+	else
+		ret = checkpoint(c);
+
+	return !ret;
+}

src/lxc/lxccontainer.h

@@ -760,6 +760,31 @@ struct lxc_container {
 	 * \return \c true on success, else \c false.
 	 */
 	bool (*remove_device_node)(struct lxc_container *c, const char *src_path, const char *dest_path);
+
+	/*!
+	 * \brief Checkpoint a container.
+	 *
+	 * \param c Container.
+	 * \param directory The directory to dump the container to.
+	 * \param stop Whether or not to stop the container after checkpointing.
+	 * \param verbose Enable criu's verbose logs.
+	 *
+	 * \return \c true on success, else \c false.
+	 * present at compile time).
+	 */
+	bool (*checkpoint)(struct lxc_container *c, char *directory, bool stop, bool verbose);
+
+	/*!
+	 * \brief Restore a container from a checkpoint.
+	 *
+	 * \param c Container.
+	 * \param directory The directory to restore the container from.
+	 * \param verbose Enable criu's verbose logs.
+	 *
+	 * \return \c true on success, else \c false.
+	 *
+	 */
+	bool (*restore)(struct lxc_container *c, char *directory, bool verbose);
 };
 
 /*!

src/lxc/start.c

@@ -300,14 +300,14 @@ static int signal_handler(int fd, uint32_t events, void *data,
 	return 1;
 }
 
-static int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
+int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state)
 {
 	handler->state = state;
 	lxc_monitor_send_state(name, state, handler->lxcpath);
 	return 0;
 }
 
-static int lxc_poll(const char *name, struct lxc_handler *handler)
+int lxc_poll(const char *name, struct lxc_handler *handler)
 {
 	int sigfd = handler->sigfd;
 	int pid = handler->pid;
@@ -485,7 +485,7 @@ static void lxc_fini(const char *name, struct lxc_handler *handler)
 	free(handler);
 }
 
-static void lxc_abort(const char *name, struct lxc_handler *handler)
+void lxc_abort(const char *name, struct lxc_handler *handler)
 {
 	int ret, status;
 

src/lxc/start.h

@@ -74,6 +74,10 @@ struct lxc_handler {
 	void *cgroup_data;
 };
 
+
+extern int lxc_poll(const char *name, struct lxc_handler *handler);
+extern int lxc_set_state(const char *name, struct lxc_handler *handler, lxc_state_t state);
+extern void lxc_abort(const char *name, struct lxc_handler *handler);
 extern struct lxc_handler *lxc_init(const char *name, struct lxc_conf *, const char *);
 
 extern int lxc_check_inherited(struct lxc_conf *conf, int fd_to_ignore);

src/lxc/utils.c

@@ -1446,3 +1446,17 @@ out1:
 	free(retv);
 	return NULL;
 }
+
+int print_to_file(const char *file, const char *content)
+{
+	FILE *f;
+	int ret = 0;
+
+	f = fopen(file, "w");
+	if (!f)
+		return -1;
+	if (fprintf(f, "%s", content) != strlen(content))
+		ret = -1;
+	fclose(f);
+	return ret;
+}

src/lxc/utils.h

@@ -282,3 +282,4 @@ int detect_ramfs_rootfs(void);
 char *on_path(char *cmd, const char *rootfs);
 bool file_exists(const char *f);
 char *choose_init(const char *rootfs);
+int print_to_file(const char *file, const char *content);

src/tests/Makefile.am

@@ -51,7 +51,7 @@ bin_PROGRAMS = lxc-test-containertests lxc-test-locktests lxc-test-startone \
 bin_SCRIPTS = lxc-test-autostart
 
 if DISTRO_UBUNTU
-bin_SCRIPTS += lxc-test-usernic lxc-test-ubuntu lxc-test-unpriv
+bin_SCRIPTS += lxc-test-usernic lxc-test-ubuntu lxc-test-unpriv lxc-test-checkpoint
 endif
 
 endif

src/tests/lxc-test-checkpoint-restore

+#!/bin/sh
+
+# Do an end to end checkpoint and restore with criu.
+
+set -e
+
+FAIL() {
+	echo -n "Failed " >&2
+	echo "$*" >&2
+	exit 1
+}
+
+if [ "$(id -u)" != "0" ]; then
+	echo "ERROR: Must run as root."
+	exit 1
+fi
+
+if [ "$(criu --version | head -n1 | cut -d' ' -f 2)" != "1.3-rc2" ]; then
+	echo "SKIP: skipping test because no (or wrong) criu installed."
+	exit 0
+fi
+
+name=lxc-test-criu
+lxc-create -t ubuntu -n $name || FAIL "creating container"
+
+cat >> "$(lxc-config lxc.lxcpath)/$name/config" <<EOF
+# hax for criu
+lxc.console = none
+lxc.tty = 0
+lxc.cgroup.devices.deny = c 5:1 rwm
+EOF
+
+lxc-start -n $name -d || FAIL "starting container"
+lxc-wait -n $name -s RUNNING || FAIL "waiting for container to run"
+
+# Let the container boot and get into a steady state.
+sleep 5s
+
+# The first time this usually fails because CRIU cannot checkpoint things with
+# data on a socket.
+lxc-checkpoint -n $name -v -s -D /tmp/checkpoint || FAIL "failed checkpointing"
+lxc-wait -n u1 -s STOPPED
+lxc-checkpoint -n $name -v -r -D /tmp/checkpoint || FAIL "failed restoring"
+
+lxc-stop -n $name -t 1
+lxc-destroy -f -n $name