On cgroup v2, restoring into a new cgroup with --manage-cgroups-mode=ignore loses the container's private cgroup namespace.
Before checkpoint, the container sees its cgroup namespace root:
host: 0::/runc-cgroupns-a
container: 0::/
After checkpoint, I change linux.cgroupsPath from /runc-cgroupns-a to /runc-cgroupns-b and restore the container.
The process moves to the new cgroup, but the container now sees the cgroup path from the host:
host: 0::/runc-cgroupns-b
container: 0::/runc-cgroupns-b
The container should remain 0::/.
From what I can tell, runc starts the CRIU worker before moving it into the container cgroup, while CRIU skips cgroup namespace setup in ignore mode. The restored process therefore ends up in the correct cgroup but with the wrong cgroup namespace view.
Versions
runc 1.4.0
criu 4.2
Ubuntu 26.04
Linux 7.0.0-29
On cgroup v2, restoring into a new cgroup with
--manage-cgroups-mode=ignoreloses the container's private cgroup namespace.Before checkpoint, the container sees its cgroup namespace root:
After checkpoint, I change
linux.cgroupsPathfrom/runc-cgroupns-ato/runc-cgroupns-band restore the container.The process moves to the new cgroup, but the container now sees the cgroup path from the host:
The container should remain
0::/.From what I can tell, runc starts the CRIU worker before moving it into the container cgroup, while CRIU skips cgroup namespace setup in
ignoremode. The restored process therefore ends up in the correct cgroup but with the wrong cgroup namespace view.Versions