4 files changed, 160 insertions, 2 deletions
diff --git a/pkg/adapter/containers.go b/pkg/adapter/containers.go
index d4e8e30d9..931c55a57 100644
--- a/pkg/adapter/containers.go
+++ b/pkg/adapter/containers.go
@@ -257,7 +257,10 @@ func (r *LocalRuntime) Log(c *cliconfig.LogsValues, options *libpod.LogOptions)
 func (r *LocalRuntime) CreateContainer(ctx context.Context, c *cliconfig.CreateValues) (string, error) {
 	results := shared.NewIntermediateLayer(&c.PodmanCommand, false)
 	ctr, _, err := shared.CreateContainer(ctx, &results, r.Runtime)
-	return ctr.ID(), err
+	if err != nil {
+		return "", err
+	}
+	return ctr.ID(), nil
 }
 
 // Run a libpod container
@@ -443,3 +446,67 @@ func (r *LocalRuntime) Attach(ctx context.Context, c *cliconfig.AttachValues) er
 	}
 	return nil
 }
+
+// Checkpoint one or more containers
+func (r *LocalRuntime) Checkpoint(c *cliconfig.CheckpointValues, options libpod.ContainerCheckpointOptions) error {
+	var (
+		containers     []*libpod.Container
+		err, lastError error
+	)
+
+	if c.All {
+		containers, err = r.Runtime.GetRunningContainers()
+	} else {
+		containers, err = shortcuts.GetContainersByContext(false, c.Latest, c.InputArgs, r.Runtime)
+	}
+	if err != nil {
+		return err
+	}
+
+	for _, ctr := range containers {
+		if err = ctr.Checkpoint(context.TODO(), options); err != nil {
+			if lastError != nil {
+				fmt.Fprintln(os.Stderr, lastError)
+			}
+			lastError = errors.Wrapf(err, "failed to checkpoint container %v", ctr.ID())
+		} else {
+			fmt.Println(ctr.ID())
+		}
+	}
+	return lastError
+}
+
+// Restore one or more containers
+func (r *LocalRuntime) Restore(c *cliconfig.RestoreValues, options libpod.ContainerCheckpointOptions) error {
+	var (
+		containers     []*libpod.Container
+		err, lastError error
+		filterFuncs    []libpod.ContainerFilter
+	)
+
+	filterFuncs = append(filterFuncs, func(c *libpod.Container) bool {
+		state, _ := c.State()
+		return state == libpod.ContainerStateExited
+	})
+
+	if c.All {
+		containers, err = r.GetContainers(filterFuncs...)
+	} else {
+		containers, err = shortcuts.GetContainersByContext(false, c.Latest, c.InputArgs, r.Runtime)
+	}
+	if err != nil {
+		return err
+	}
+
+	for _, ctr := range containers {
+		if err = ctr.Restore(context.TODO(), options); err != nil {
+			if lastError != nil {
+				fmt.Fprintln(os.Stderr, lastError)
+			}
+			lastError = errors.Wrapf(err, "failed to restore container %v", ctr.ID())
+		} else {
+			fmt.Println(ctr.ID())
+		}
+	}
+	return lastError
+}
diff --git a/pkg/adapter/containers_remote.go b/pkg/adapter/containers_remote.go
index 9ca823760..50cff9fa0 100644
--- a/pkg/adapter/containers_remote.go
+++ b/pkg/adapter/containers_remote.go
@@ -537,3 +537,75 @@ func (r *LocalRuntime) Attach(ctx context.Context, c *cliconfig.AttachValues) er
 	}
 	return <-errChan
 }
+
+// Checkpoint one or more containers
+func (r *LocalRuntime) Checkpoint(c *cliconfig.CheckpointValues, options libpod.ContainerCheckpointOptions) error {
+	var lastError error
+	ids, err := iopodman.GetContainersByContext().Call(r.Conn, c.All, c.Latest, c.InputArgs)
+	if err != nil {
+		return err
+	}
+	if c.All {
+		// We dont have a great way to get all the running containers, so need to get all and then
+		// check status on them bc checkpoint considers checkpointing a stopped container an error
+		var runningIds []string
+		for _, id := range ids {
+			ctr, err := r.LookupContainer(id)
+			if err != nil {
+				return err
+			}
+			if ctr.state.State == libpod.ContainerStateRunning {
+				runningIds = append(runningIds, id)
+			}
+		}
+		ids = runningIds
+	}
+
+	for _, id := range ids {
+		if _, err := iopodman.ContainerCheckpoint().Call(r.Conn, id, options.Keep, options.KeepRunning, options.TCPEstablished); err != nil {
+			if lastError != nil {
+				fmt.Fprintln(os.Stderr, lastError)
+			}
+			lastError = errors.Wrapf(err, "failed to checkpoint container %v", id)
+		} else {
+			fmt.Println(id)
+		}
+	}
+	return lastError
+}
+
+// Restore one or more containers
+func (r *LocalRuntime) Restore(c *cliconfig.RestoreValues, options libpod.ContainerCheckpointOptions) error {
+	var lastError error
+	ids, err := iopodman.GetContainersByContext().Call(r.Conn, c.All, c.Latest, c.InputArgs)
+	if err != nil {
+		return err
+	}
+	if c.All {
+		// We dont have a great way to get all the exited containers, so need to get all and then
+		// check status on them bc checkpoint considers restoring a running container an error
+		var exitedIDs []string
+		for _, id := range ids {
+			ctr, err := r.LookupContainer(id)
+			if err != nil {
+				return err
+			}
+			if ctr.state.State != libpod.ContainerStateRunning {
+				exitedIDs = append(exitedIDs, id)
+			}
+		}
+		ids = exitedIDs
+	}
+
+	for _, id := range ids {
+		if _, err := iopodman.ContainerRestore().Call(r.Conn, id, options.Keep, options.TCPEstablished); err != nil {
+			if lastError != nil {
+				fmt.Fprintln(os.Stderr, lastError)
+			}
+			lastError = errors.Wrapf(err, "failed to restore container %v", id)
+		} else {
+			fmt.Println(id)
+		}
+	}
+	return lastError
+}
diff --git a/pkg/rootless/rootless_linux.c b/pkg/rootless/rootless_linux.c
index 9cb79ed4d..d6a2793a7 100644
--- a/pkg/rootless/rootless_linux.c
+++ b/pkg/rootless/rootless_linux.c
@@ -16,6 +16,8 @@
 #include <sys/types.h>
 #include <sys/prctl.h>
 #include <dirent.h>
+#include <termios.h>
+#include <sys/ioctl.h>
 
 static const char *_max_user_namespaces = "/proc/sys/user/max_user_namespaces";
 static const char *_unprivileged_user_namespaces = "/proc/sys/kernel/unprivileged_userns_clone";
@@ -178,6 +180,11 @@ reexec_userns_join (int userns, int mountns)
       _exit (EXIT_FAILURE);
     }
 
+  if (isatty (1) && ioctl (1, TIOCSCTTY, 0) == -1) {
+      fprintf (stderr, "cannot ioctl(TIOCSCTTY): %s\n", strerror (errno));
+      _exit (EXIT_FAILURE);
+  }
+
   if (setns (userns, 0) < 0)
     {
       fprintf (stderr, "cannot setns: %s\n", strerror (errno));
diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go
index 1d1b1713d..2c99f41a4 100644
--- a/pkg/rootless/rootless_linux.go
+++ b/pkg/rootless/rootless_linux.go
@@ -28,6 +28,10 @@ extern int reexec_userns_join(int userns, int mountns);
 */
 import "C"
 
+const (
+	numSig = 65 // max number of signals
+)
+
 func runInUser() error {
 	os.Setenv("_CONTAINERS_USERNS_CONFIGURED", "done")
 	return nil
@@ -283,7 +287,15 @@ func BecomeRootInUserNS() (bool, int, error) {
 
 	c := make(chan os.Signal, 1)
 
-	gosignal.Notify(c)
+	signals := []os.Signal{}
+	for sig := 0; sig < numSig; sig++ {
+		if sig == int(syscall.SIGTSTP) {
+			continue
+		}
+		signals = append(signals, syscall.Signal(sig))
+	}
+
+	gosignal.Notify(c, signals...)
 	defer gosignal.Reset()
 	go func() {
 		for s := range c {