Added tcp-established to checkpoint/restore

CRIU can checkpoint and restore processes/containers with established
TCP connections if the correct option is specified. To implement
checkpoint and restore with support for established TCP connections with
Podman this commit adds the necessary options to runc during checkpoint
and also tells conmon during restore to use 'runc restore' with
'--tcp-established'.

For this Podman feature to work a corresponding conmon change is
required.

Example:

$ podman run --tmpfs /tmp --name podman-criu-test -d docker://docker.io/yovfiatbeb/podman-criu-test
$ nc `podman inspect -l | jq -r '.[0].NetworkSettings.IPAddress'` 8080
GET /examples/servlets/servlet/HelloWorldExample
Connection: keep-alive

1
GET /examples/servlets/servlet/HelloWorldExample
Connection: keep-alive

2
$ # Using HTTP keep-alive multiple requests are send to the server in the container
$ # Different terminal:
$ podman container checkpoint -l
criu failed: type NOTIFY errno 0
$ # Looking at the log file would show errors because of established TCP connections
$ podman container checkpoint -l --tcp-established
$ # This works now and after the restore the same connection as above can be used for requests
$ podman container restore -l --tcp-established

The restore would fail without '--tcp-established' as the checkpoint image
contains established TCP connections.

Signed-off-by: Adrian Reber <areber@redhat.com>

4 files changed, 26 insertions, 4 deletions

diff --git a/cmd/podman/checkpoint.go b/cmd/podman/checkpoint.go
index ddfd12bc3..824c97662 100644
--- a/cmd/podman/checkpoint.go
+++ b/cmd/podman/checkpoint.go
@@ -28,6 +28,10 @@ var (
 			Usage: "leave the container running after writing checkpoint to disk",
 		},
 		cli.BoolFlag{
+			Name:  "tcp-established",
+			Usage: "checkpoint a container with established TCP connections",
+		},
+		cli.BoolFlag{
 			Name:  "all, a",
 			Usage: "checkpoint all running containers",
 		},
@@ -55,8 +59,9 @@ func checkpointCmd(c *cli.Context) error {
 	defer runtime.Shutdown(false)
 
 	options := libpod.ContainerCheckpointOptions{
-		Keep:        c.Bool("keep"),
-		KeepRunning: c.Bool("leave-running"),
+		Keep:           c.Bool("keep"),
+		KeepRunning:    c.Bool("leave-running"),
+		TCPEstablished: c.Bool("tcp-established"),
 	}
 
 	if err := checkAllAndLatest(c); err != nil {
diff --git a/cmd/podman/restore.go b/cmd/podman/restore.go
index 6383ebf0b..afdbc36e0 100644
--- a/cmd/podman/restore.go
+++ b/cmd/podman/restore.go
@@ -27,6 +27,10 @@ var (
 		// dedicated state for container which are checkpointed.
 		// TODO: add ContainerStateCheckpointed
 		cli.BoolFlag{
+			Name:  "tcp-established",
+			Usage: "checkpoint a container with established TCP connections",
+		},
+		cli.BoolFlag{
 			Name:  "all, a",
 			Usage: "restore all checkpointed containers",
 		},
@@ -54,7 +58,8 @@ func restoreCmd(c *cli.Context) error {
 	defer runtime.Shutdown(false)
 
 	options := libpod.ContainerCheckpointOptions{
-		Keep: c.Bool("keep"),
+		Keep:           c.Bool("keep"),
+		TCPEstablished: c.Bool("tcp-established"),
 	}
 
 	if err := checkAllAndLatest(c); err != nil {
diff --git a/libpod/container_api.go b/libpod/container_api.go
index 396f06c20..aee87cc04 100644
--- a/libpod/container_api.go
+++ b/libpod/container_api.go
@@ -833,8 +833,14 @@ func (c *Container) Refresh(ctx context.Context) error {
 // ContainerCheckpointOptions is a struct used to pass the parameters
 // for checkpointing (and restoring) to the corresponding functions
 type ContainerCheckpointOptions struct {
-	Keep        bool
+	// Keep tells the API to not delete checkpoint artifacts
+	Keep bool
+	// KeepRunning tells the API to keep the container running
+	// after writing the checkpoint to disk
 	KeepRunning bool
+	// TCPEstablished tells the API to checkpoint a container
+	// even if it contains established TCP connections
+	TCPEstablished bool
 }
 
 // Checkpoint checkpoints a container
diff --git a/libpod/oci.go b/libpod/oci.go
index 6aedc5662..5a041b7d6 100644
--- a/libpod/oci.go
+++ b/libpod/oci.go
@@ -291,6 +291,9 @@ func (r *OCIRuntime) createOCIContainer(ctr *Container, cgroupParent string, res
 
 	if restoreOptions != nil {
 		args = append(args, "--restore", ctr.CheckpointPath())
+		if restoreOptions.TCPEstablished {
+			args = append(args, "--restore-arg", "--tcp-established")
+		}
 	}
 
 	logrus.WithFields(logrus.Fields{
@@ -862,6 +865,9 @@ func (r *OCIRuntime) checkpointContainer(ctr *Container, options ContainerCheckp
 	if options.KeepRunning {
 		args = append(args, "--leave-running")
 	}
+	if options.TCPEstablished {
+		args = append(args, "--tcp-established")
+	}
 	args = append(args, ctr.ID())
 	return utils.ExecCmdWithStdStreams(os.Stdin, os.Stdout, os.Stderr, nil, r.path, args...)
 }