Difference between freezing a process group manually with cgroups and using criu --freeze-cgroup ?

[yummypeng]

Hey friends, may I ask what the difference is between manually using the freezer cgroup to freeze a process group and using criu --freeze-cgroup? I tried the former and found that criu gets stuck when running.

[avagin]

Where does the criu stuck? Could you attach criu verbose logs?

[yummypeng]

@avagin
I started an Nginx container using crictl, and its cgroup path is /sys/fs/cgroup/k8s.io/e3d4d8ca15eeae19e5e0bbf380bc0fb0a2d501967461dfcf7908bafc5814440f/ (I am using cgroupv2). If I first execute echo 1 > /sys/fs/cgroup/k8s.io/e3d4d8ca15eeae19e5e0bbf380bc0fb0a2d501967461dfcf7908bafc5814440f/cgroup.freeze
and then dump the Nginx thread using criu, criu will get stuck, and the complete log is as follows.

dump.log

However, if I use criu dump --freeze-cgroup /sys/fs/cgroup/k8s.io/e3d4d8ca15eeae19e5e0bbf380bc0fb0a2d501967461dfcf7908bafc5814440f/, it seems that criu can continue executing. From the code, I see that the implementation of --freeze-cgroup is probably similar to echo 1 > /sys/fs/cgroup/k8s.io/e3d4d8ca15eeae19e5e0bbf380bc0fb0a2d501967461dfcf7908bafc5814440f/cgroup.freeze, so I am very curious why executing this command manually before criu dump causes criu to hang.

[adrianreber]

Please provide the information from the template and describe what you are trying to do.

You didn't mention initially that you are using Kubernetes with containerd. Container engines (not all of them) actually pause the container before taking a checkpoint. This usually is done using the cgroup.

You mention you are using cgroup v2, but CRIU says it detected a cgroup v1 system.

Why are you trying to freeze the cgroup before checkpointing the process? Just out of curiosity?