The --exec-cmd option specifies a command that will be execvp()-ed on successful
restore. This way the command specified here will become the parent process of
the restored process tree.
Waiting for the restored processes to finish is responsibility of this command.
All service FDs are closed before we call execvp(). Standad output and error of
the command are redirected to the log file when we are restoring through the RPC
service.
This option will be used when restoring LinuX Containers and it seems helpful
for perf or other use cases when restored processes must be supervised by a
parent.
Two directions were researched in order to integrate CRIU and LXC:
1. We tell to CRIU, that after restoring container is should execve()
lxc properly explaining to it that there's a new container hanging
around.
2. We make LXC set himself as child subreaper, then fork() criu and ask
it to detach (-d) from restore container afterwards. Being a subreaper,
it should get the container's init into his child list after it.
The main reason for choosing the first option is that the second one can't work
with the RPC service. If we call restore via the service then criu service will
be the top-most task in the hierarchy and will not be able to reparent the
restore trees to any other task in the system. Calling execve from service
worker sub-task (and daemonizing it) should solve this.
Signed-off-by: Deyan Doychev <deyandoichev@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
We will carry rlimits inside Core itself instead of separate image.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
When migrating container with copying its FS, the inode numbers
and thus their handles wil change. This will make the restore of
inotify/fanotify fail, since they do it via fhandles.
We've already faced the problems with fsnotifies on NFS -- they
don't work there. To address this an irmap cache is created on
pre-dump, so to resolve the issue with changed inodes during
migration, we can force the irmap cache build.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This is the first time restorer gets info back from CRIU
service. At that time it makes perfect sense to report
what PID we're working with.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The following issue is possibly caused by using busybox make.
protobuf/packet-sock.pb-c.c: In function 'packet_sock_entry__init':
protobuf/packet-sock.pb-c.c:98:3: error: this decimal constant is unsigned only in ISO C90 [-Werror]
Use a belt-and-suspenders approach to ensure it doesn't happen.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
We're aligning members and number in protobuf
files from the very beginning for readability
sake. So fix up newer ones which were not.
Also use /* */ comments, not //.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
There are two reasons to ban subdirs in logfile name.
First, process might be in different namespace, so it is right to give us fd
for work dir, just like we did with images dir. Second, as service might be ran
as root, it is unsafe to give an opportunity to fill any dir with trash.
If you wan't to put logs/stats somwhere else than images_dir, you could
set work_dir_fd.
Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
When writing VMAs we perform too many small writes into vma-.img files.
This can be easily fixed by moving the vma-s into mm-s, all the more
so they cannot be splitted from each other.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
It's useful to know this value.
W/o cache (first pre-dump) on minimal container the irmap
resolve time is ~0.2 sec. With cache (next pre-dumps or
final dump) on the same container the irmap resolve time
is 10 times less.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Service shouldn't call client provided scripts, as it
creates a security issue (client may be unpriviledged,
while the service is).
In order to let caller do what it would normally do with
criu-scripts, make criu notify it about scripts. Caller
then do whatever it needs and responds back.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
If we failed to open inode by handle, try doing the irmap
search. If that's successful, dump the "real" path for the
inode.
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
External bind mounts are those with source sitting outside of the
current FS view. Such are detected in validate_mounts(), so we
just go ahead and call plugins.
The plugin is provided with the mountpoint to decide whether it's
his or not (what else does the guy need?) and an ID with this it
can identify the mountpoint in /proc. The same ID will be used at
restore time to find the needed restore info.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Here is nothing interecting. If a file can't be dumped by criu,
plugins are called. If one of plugins knows how to dump the file,
the file entry is marked as need_callback. On restore if we see
this mark, we execute plugins for restoring the file.
v2: Callbacks are called for all files, which are not supported by CRIU.
v3: Call plugins for a file instead of file descriptor. A few file
descriptors can be associated with one file.
v4: A file descriptor is opened in a callback. It's required for
restoring anon vmas.
v5: Add a separate type for unsupported files
v6: define FD_TYPES__UNSUPP
v7: s/unsupp/ext (external)
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Remove space before tab characters.
Found by git grep ' ' (Space, Ctrl-V, Tab in shell).
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
TCP send queue contains two types of data:
* unacknowledged data, which have been sent out
* data, which have not been sent
Currently only the size of all data is save, but it's not enough for
proper restoring of TCP connections.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
At moment we generate protobuf dependencies having in
mind that protobuf/ directory is _always_ in the source
code root. This may change one day in future so better to
be on safe side and escape slashes immediately.
I meet this problem when been needed to build protobuf
builtin in $(root)/src/protobuf directory.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This kind of netdevice will serve for external
links such as venet, macvlan/vlan and etc.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Lets rename CriuDumpReq to CriuOpts, for the sake of readability and to
avoid coping code for restore mechanism, as CriuDumpReq and
CriuRestoreResp would have almost the same fields. Also, it would be
easier to introduce other types of requests.
Signed-off-by: Ruslan Kuprieiev <kurpuser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
[xemul: Simplified !log_file case and renumbered .proto fields]
Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Now we don't have generic criu_msg thing -- instead, we have
explicit request (with per-type args) and explicit responce
(yet again -- with per-type args).
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The most of fields are to be changed to "optional", because they are
optional in fact.
Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
They are required for restoring shared and slave mounts
v2: use the same names of variables in image and in code
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
There will be two entities handled:
1. tun file -- an opened char device with misc major and tun minor
that can be attached to item #2
2. tun netdevice -- another type of links
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
On restore we compare pages' contents with memcmp to check which
of them can remain shared. Report this info in restore stats.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Will need it to store thread alternative signal stack.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
pages_scanned -- the amount of pages criu looked at for decision
pages_skipped_parent -- the amount of pages that were skipped, due to
they are present in parent image
pages_writted -- the amount of pages criu transfered into image
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Dumping memory is draining it from parasite, for pre-dump
this time would be reasonably small. _Writing_ the memory
would occur _after_ tasks unseize and resume.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
