runc-restore(8)

💖 runc-restore 💖

okay so bestie, welcome to runc-restore(8) from the System Manager's Manual ✨ this is the glow-up page that tells you how to bring a container back from the dead. sit down, hydrate, let's go 🫶

---

🌸 NAME 🌸

runc-restore — restore a container from a previous checkpoint 💅

---

✨ SYNOPSIS ✨

runc restore [option ...] container-id

---

🦋 DESCRIPTION 🦋

okay so picture this: you already ran runc checkpoint at some point, right? and now you want that container back. That's literally the whole vibe here — runc restore restores the container instance from a previously performed runc checkpoint. it's giving resurrection, it's giving main character energy, no cap 🔥

---

💅 OPTIONS 💅

• --console-socket path — path to an AF_UNIX socket that's gonna receive a file descriptor pointing at the master end of the console's pseudoterminal. see docs/terminals https://github.com/opencontainers/runc/blob/master/docs/terminals.md. 🎀
• --image-path path — set the path to grab the criu image files you're restoring from.
• --work-path path — set the path for saving criu work files and logs. the default is to reuse the image files directory, periodt.
• --tcp-established — allow checkpoint/restore of established TCP connections. see the criu --tcp-establised option at https://criu.org/CLI/opt/--tcp-established. 🌈
• --ext-unix-sk — allow checkpoint/restore of external unix sockets. see the criu --ext-unix-sk option at https://criu.org/CLI/opt/--ext-unix-sk.
• --shell-job — allow checkpoint/restore of shell jobs. 🐚
• --file-locks — allow checkpoint/restore of file locks. see the criu --file-locks option at https://criu.org/CLI/opt/--file-locks.
• --manage-cgroups-mode soft|full|strict|ignore. — cgroups mode. default is soft. see the criu --manage-cgroups option at https://criu.org/CLI/opt/--manage-cgroups. 💜

specifically, if you wanna restore the container into a different cgroup, you have to use --manage-cgroups-mode ignore during both checkpoint and restore, and the _containerid (or the cgroupsPath property in the OCI config, if it's set) has to be changed. that's the rule, i don't make them 😭

• --bundle, -b path — path to the root of the bundle directory. default is the current directory. 📁
• --detach, -d — detach from the container's process. bye bestie 👋
• --pid-file path — specify the file to write the initial container process' PID to.
• --no-subreaper — disable the use of the subreaper used to reap reparented processes.
• --no-pivot — do not use pivot root to jail the process inside the rootfs.

⚠️ lowkey this should not be used except in exceptional circumstances, and it may be unsafe from the security standpoint. fr fr, be careful 🚨

• --empty-ns namespace — create a namespace, but don't restore its properties. see the criu --empty-ns option at https://criu.org/CLI/opt/--empty-ns.
• --auto-dedup — enable auto deduplication of memory images. see the criu --auto-dedup option at https://criu.org/CLI/opt/--auto-dedup. ✨
• --lazy-pages — use the lazy migration mechanism. this requires a running criu lazy-pages daemon. see the criu --lazy-pages option at https://criu.org/CLI/opt/--lazy-pages. 💤
• --lsm-profile type:label — specify an LSM profile to be used during restore. here type can either be apparamor or selinux, and label is a valid LSM label. for example, --lsm-profile "selinux:system_u:system_r:container_t:s0:c82,c137". by default, the checkpointed LSM profile is used upon restore. 👑
• --lsm-mount-context context — specify an LSM mount context to be used during restore. only mounts with an existing context will have their context replaced. with this option it's possible to change SELinux mount options. instead of mounting with the checkpointed context, the specified context will be used. for example, --lsm-mount-context "system_u:object_r:container_file_t:s0:c82,c137". 🌸

---

👀 SEE ALSO 👀

criu(8), runc-checkpoint(8), runc(8).

---

and that's the whole page bestie 💖 this one was signed off as runc-restore(8), from the System Manager's Manual — go forth and restore, you've got this 🫶✨💅