Unprivileged CRIU

on YouTube ↗24m

" summary

Goal is running CRIU without root by using specific capabilities rather than full root; original patch series lands from 2020 and a rebased PR appears a few months ago adding RPC and libcriu support and switching the cache to xdg runtime directory. Implementation relies on cap_checkpoint_restore (with cap_sys_admin as fallback) and a constellation of other caps (PTRACE, NET_ADMIN, pagemap issues). It works for many JVM start/restore cases but several failure modes and policy choices remain unresolved (how to handle missing caps, user namespaces, and silent degraded restores).

AI-written summary · about

" chapters (5)

1. 0:00Introduction to unprivileged CRIU
2. 1:49Problem and current state
3. 8:52Unresolved questions
4. 18:52Java JVM startup challenges
5. 23:04Why CRIU for JVMs

" related talks

• 20mCRIU and SELinuxAdrian Reber · Linux Security Summit Europe 2019
• 20mGet More Computing Power by Helping the OS SchedulerAntti Kervinen, Alexander Kanevskiy · Kubernetes Batch + HPC Day Europe 2022
• 37mCRI-O: Under the HoodSascha Grunert, Mrunal Patel · KubeCon + CloudNativeCon North America 2019
• 45mRCU Office HourPaul E. McKenney · Linux Plumbers Conference 2023
• 43mresctrl filesystemPeter Newman · Linux Plumbers Conference 2023
• 31mTowards unprivileged container buildsAlban Crequy · ContainerDays Hamburg 2018
• 38mUnderstanding root inside and outside a containerScott McCarty · DevConf.CZ 2021
• 39mContainer Live MigrationAdrian Reber · DevConf.CZ 2021