相信很多用过Unix系统的人都不会对 ctrl+z 的 job 挂起不会陌生，然而这个功能却只能在用户空间中，而不能在磁盘上持久化就感觉对PC用户不是非常完美。而最近我发现一个叫criu的工具通过kernel直接镜像进程的cpu和内存状态存储的本地磁盘。
安装
这里我建议Ubuntu 22.04以下的直接用make
# apt install libbsd-dev libdrm-dev gnutls-dev libnftables-dev
# apt install libprotobuf-dev libprotobuf-c-dev protobuf-c-compiler protobuf-compiler python3-protobuf
# apt-get install libnet1-dev
# apt-get install libcap-dev
# wget https://bootstrap.pypa.io/get-pip.py
# /usr/bin/python3 get-pip.py
# git clone https://github.com/checkpoint-restore/criu.git
# cd criu
# make install
其他用包安装就可以了，注意要在3.17版本以上，否则会有问题。
WSL 亦可以使用
使用
保存检查点
sudo criu dump -t <PID> -v4 -o dump.log -D <image_dir> --shell-job
还原
sudo criu restore --shell-job -D <image_dir> -v2 -o restore.log
我用clamav的clamscan进程测试过可以暂停和恢复
详细
$ criu -h
Usage:
criu dump|pre-dump -t PID [<options>]
criu restore [<options>]
criu check [--feature FEAT]
criu page-server
criu service [<options>]
criu dedup
criu lazy-pages -D DIR [<options>]
Commands:
dump checkpoint a process/tree identified by pid
pre-dump pre-dump task(s) minimizing their frozen time
restore restore a process/tree
check checks whether the kernel support is up-to-date
page-server launch page server
service launch service
dedup remove duplicates in memory dump
cpuinfo dump writes cpu information into image file
cpuinfo check validates cpu information read from image file
Most of the true / false long options (the ones without arguments) can be
prefixed with --no- to negate the option (example: --display-stats and
--no-display-stats).
Dump/Restore options:
* Generic:
-t|--tree PID checkpoint a process tree identified by PID
-d|--restore-detached detach after restore
-S|--restore-sibling restore root task as sibling
-s|--leave-stopped leave tasks in stopped state after checkpoint
-R|--leave-running leave tasks in running state after checkpoint
-D|--images-dir DIR directory for image files
--pidfile FILE write root task, service or page-server pid to FILE
-W|--work-dir DIR directory to cd and write logs/pidfiles/stats to
(if not specified, value of --images-dir is used)
--cpu-cap [CAP] CPU capabilities to write/check. CAP is comma-separated
list of: cpu, fpu, all, ins, none. To disable
a capability, use ^CAP. Empty argument implies all
--exec-cmd execute the command specified after '--' on successful
restore making it the parent of the restored process
--freeze-cgroup use cgroup freezer to collect processes
--weak-sysctls skip restoring sysctls that are not available
--lazy-pages restore pages on demand
this requires running a second instance of criu
in lazy-pages mode: 'criu lazy-pages -D DIR'
--lazy-pages and lazy-pages mode require userfaultfd
--stream dump/restore images using criu-image-streamer
--mntns-compat-mode Use mount engine in compatibility mode. By default criu
tries to use mount-v2 mode with more reliable algorithm
based on MOVE_MOUNT_SET_GROUP kernel feature
--network-lock METHOD network locking/unlocking method; argument
can be 'nftables' or 'iptables' (default).
--unprivileged accept limitations when running as non-root
consult documentation for further details
* External resources support:
--external RES dump objects from this list as external resources:
Formats of RES on dump:
tty[rdev:dev]
file[mnt_id:inode]
dev[major/minor]:NAME
unix[ino]
mnt[MOUNTPOINT]:COOKIE
mnt[]{:AUTO_OPTIONS}
Formats of RES on restore:
dev[NAME]:DEVPATH
veth[IFNAME]:OUTNAME{@BRIDGE}
macvlan[IFNAME]:OUTNAME
mnt[COOKIE]:ROOT
netdev[IFNAME]:ORIGNAME
* Special resources support:
--tcp-established checkpoint/restore established TCP connections
--skip-in-flight skip (ignore) in-flight TCP connections
--tcp-close don't dump the state of, or block, established tcp
connections, and restore them in closed state.
-r|--root PATH change the root filesystem (when run in mount namespace)
--evasive-devices use any path to a device file if the original one
is inaccessible
--link-remap allow one to link unlinked files back when possible
--ghost-limit size limit max size of deleted file contents inside image
--ghost-fiemap enable dumping of deleted files using fiemap
--action-script FILE add an external action script
-j|--shell-job allow one to dump and restore shell jobs
-l|--file-locks handle file locks, for safety, only used for container
-L|--libdir path to a plugin directory (by default /usr/lib/criu/)
--timeout NUM a timeout (in seconds) on collecting tasks during dump
(default 10 seconds)
--force-irmap force resolving names for inotify/fsnotify watches
--irmap-scan-path FILE
add a path the irmap hints to scan
--manage-cgroups [m] dump/restore process' cgroups; argument can be one of
'none', 'props', 'soft' (default), 'full', 'strict'
or 'ignore'
--cgroup-root [controller:]/newroot
on dump: change the root for the controller that will
be dumped. By default, only the paths with tasks in
them and below will be dumped.
on restore: change the root cgroup the controller will
be installed into. No controller means that root is the
default for all controllers not specified
--cgroup-props STRING
define cgroup controllers and properties
to be checkpointed, which are described
via STRING using simplified YAML format
--cgroup-props-file FILE
same as --cgroup-props, but taking description
from the path specified
--cgroup-dump-controller NAME
define cgroup controller to be dumped
and skip anything else present in system
--cgroup-yard PATH
instead of trying to mount cgroups in CRIU, provide
a path to a directory with already created cgroup yard.
Useful if you don't want to grant CAP_SYS_ADMIN to CRIU
--lsm-profile TYPE:NAME
Specify an LSM profile to be used during restore.
The type can be either 'apparmor' or 'selinux'.
--lsm-mount-context CTX
Specify a mount context to be used during restore.
Only mounts with an existing context will have their
mount context replaced with CTX.
--skip-mnt PATH ignore this mountpoint when dumping the mount namespace
--enable-fs FSNAMES a comma separated list of filesystem names or "all"
force criu to (try to) dump/restore these filesystem's
mountpoints even if fs is not supported
--inherit-fd fd[NUM]:RES
Inherit file descriptors, treating fd NUM as being
already opened via an existing RES, which can be:
tty[rdev:dev]
pipe[inode]
socket[inode]
file[mnt_id:inode]
/memfd:name
path/to/file
--empty-ns net Create a namespace, but don't restore its properties
(assuming it will be restored by action scripts)
-J|--join-ns NS:{PID|NS_FILE}[,OPTIONS]
Join existing namespace and restore process in it.
Namespace can be specified as either pid or file path.
OPTIONS can be used to specify parameters for userns:
user:PID,UID,GID
--file-validation METHOD
pass the validation method to be used; argument
can be 'filesize' or 'buildid' (default).
--skip-file-rwx-check
Skip checking file permissions
(r/w/x for u/g/o) on restore.
Check options:
Without options, "criu check" checks availability of absolutely required
kernel features, critical for performing dump and restore.
--extra add check for extra kernel features
--experimental add check for experimental kernel features
--all same as --extra --experimental
--feature FEAT only check a particular feature, one of:
mnt_id, mem_dirty_track, aio_remap, timerfd, tun,
tun_ns, userns, fdinfo_lock, seccomp_suspend,
seccomp_filters, loginuid, cgroupns, autofs,
tcp_half_closed, compat_cr, uffd, uffd-noncoop,
can_map_vdso, sk_ns, sk_unix_file, net_diag_raw,
nsid, link_nsid, kcmp_epoll, timens,
external_net_ns, clone3_set_tid, newifindex,
nftables, has_ipt_legacy, pidfd_store, ns_pid,
apparmor_stacking, network_lock_nftables,
sockopt_buf_lock, memfd_hugetlb,
move_mount_set_group, openat2, get_rseq_conf,
ipv6_freebind, pagemap_scan, overlayfs_maps
* Logging:
-o|--log-file FILE log file name
--log-pid enable per-process logging to separate FILE.pid files
-v[v...]|--verbosity increase verbosity (can use multiple v)
-vNUM|--verbosity=NUM set verbosity to NUM (higher level means more output):
-v1 - only errors and messages
-v2 - also warnings (default level)
-v3 - also information messages and timestamps
-v4 - lots of debug
--display-stats print out dump/restore stats
* Memory dumping options:
--track-mem turn on memory changes tracker in kernel
--prev-images-dir DIR path to images from previous dump (relative to -D)
--page-server send pages to page server (see options below as well)
--auto-dedup when used on dump it will deduplicate "old" data in
pages images of previous dump
when used on restore, as soon as page is restored, it
will be punched from the image
--pre-dump-mode splice - parasite based pre-dumping (default)
read - process_vm_readv syscall based pre-dumping
Page/Service server options:
--address ADDR address of server or service
--port PORT port of page server
--ps-socket FD use specified FD as page server socket
-d|--daemon run in the background after creating socket
--status-fd FD write \0 to the FD and close it once process is ready
to handle requests
--tls-cacert FILE trust certificates signed only by this CA
--tls-cacrl FILE path to CA certificate revocation list file
--tls-cert FILE path to TLS certificate file
--tls-key FILE path to TLS private key file
--tls use TLS to secure remote connection
--tls-no-cn-verify do not verify common name in server certificate
Configuration file options:
--config FILEPATH pass a specific configuration file
--no-default-config forbid usage of default configuration files
Other options:
-h|--help show this text
-V|--version show version
