{"action":"created","issue":{"url":"https://api.github.com/repos/checkpoint-restore/criu/issues/551","repository_url":"https://api.github.com/repos/checkpoint-restore/criu","labels_url":"https://api.github.com/repos/checkpoint-restore/criu/issues/551/labels{/name}","comments_url":"https://api.github.com/repos/checkpoint-restore/criu/issues/551/comments","events_url":"https://api.github.com/repos/checkpoint-restore/criu/issues/551/events","html_url":"https://github.com/checkpoint-restore/criu/issues/551","id":357657418,"node_id":"MDU6SXNzdWUzNTc2NTc0MTg=","number":551,"title":"iptables issues for Ubuntu 18.04","user":{"login":"crosbymichael","id":749551,"node_id":"MDQ6VXNlcjc0OTU1MQ==","avatar_url":"https://avatars1.githubusercontent.com/u/749551?v=4","gravatar_id":"","url":"https://api.github.com/users/crosbymichael","html_url":"https://github.com/crosbymichael","followers_url":"https://api.github.com/users/crosbymichael/followers","following_url":"https://api.github.com/users/crosbymichael/following{/other_user}","gists_url":"https://api.github.com/users/crosbymichael/gists{/gist_id}","starred_url":"https://api.github.com/users/crosbymichael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crosbymichael/subscriptions","organizations_url":"https://api.github.com/users/crosbymichael/orgs","repos_url":"https://api.github.com/users/crosbymichael/repos","events_url":"https://api.github.com/users/crosbymichael/events{/privacy}","received_events_url":"https://api.github.com/users/crosbymichael/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-06T13:33:48Z","updated_at":"2018-09-06T15:37:33Z","closed_at":null,"author_association":"NONE","body":"I am unable to checkpoint a container on ubuntu 18.04 because of iptables -w and it segfaulting\r\n\r\n```\r\n(00.000042) Version: 3.11 (gitid 0)\r\n(00.000072) Running on deathstar Linux 4.15.0-20-generic #21-Ubuntu SMP Tue Apr 24 06:16:15 UTC 2018 x86_64\r\n(00.000119) ========================================\r\n(00.000124) Dumping processes (pid: 99698)\r\n(00.000128) ========================================\r\n(00.000134) Running pre-dump scripts\r\n(00.000138) \tRPC\r\n(00.000397) irmap: Searching irmap cache in work dir\r\n(00.000415) No irmap-cache image\r\n(00.000419) irmap: Searching irmap cache in parent\r\n(00.000428) irmap: No irmap cache\r\n(00.000456) cpu: fpu:1 fxsr:1 xsave:1\r\n(00.000574) cg-prop: Parsing controller \"cpu\"\r\n(00.000580) cg-prop: \tStrategy \"replace\"\r\n(00.000584) cg-prop: \tProperty \"cpu.shares\"\r\n(00.000588) cg-prop: \tProperty \"cpu.cfs_period_us\"\r\n(00.000591) cg-prop: \tProperty \"cpu.cfs_quota_us\"\r\n(00.000595) cg-prop: \tProperty \"cpu.rt_period_us\"\r\n(00.000598) cg-prop: \tProperty \"cpu.rt_runtime_us\"\r\n(00.000602) cg-prop: Parsing controller \"memory\"\r\n(00.000605) cg-prop: \tStrategy \"replace\"\r\n(00.000609) cg-prop: \tProperty \"memory.limit_in_bytes\"\r\n(00.000613) cg-prop: \tProperty \"memory.memsw.limit_in_bytes\"\r\n(00.000616) cg-prop: \tProperty \"memory.swappiness\"\r\n(00.000619) cg-prop: \tProperty \"memory.soft_limit_in_bytes\"\r\n(00.000623) cg-prop: \tProperty \"memory.move_charge_at_immigrate\"\r\n(00.000626) cg-prop: \tProperty \"memory.oom_control\"\r\n(00.000629) cg-prop: \tProperty \"memory.use_hierarchy\"\r\n(00.000633) cg-prop: \tProperty \"memory.kmem.limit_in_bytes\"\r\n(00.000636) cg-prop: \tProperty \"memory.kmem.tcp.limit_in_bytes\"\r\n(00.000639) cg-prop: Parsing controller \"cpuset\"\r\n(00.000643) cg-prop: \tStrategy \"replace\"\r\n(00.000646) cg-prop: \tProperty \"cpuset.cpus\"\r\n(00.000650) cg-prop: \tProperty \"cpuset.mems\"\r\n(00.000653) cg-prop: \tProperty \"cpuset.memory_migrate\"\r\n(00.000656) cg-prop: \tProperty \"cpuset.cpu_exclusive\"\r\n(00.000660) cg-prop: \tProperty \"cpuset.mem_exclusive\"\r\n(00.000663) cg-prop: \tProperty \"cpuset.mem_hardwall\"\r\n(00.000667) cg-prop: \tProperty \"cpuset.memory_spread_page\"\r\n(00.000673) cg-prop: \tProperty \"cpuset.memory_spread_slab\"\r\n(00.000676) cg-prop: \tProperty \"cpuset.sched_load_balance\"\r\n(00.000680) cg-prop: \tProperty \"cpuset.sched_relax_domain_level\"\r\n(00.000683) cg-prop: Parsing controller \"blkio\"\r\n(00.000687) cg-prop: \tStrategy \"replace\"\r\n(00.000690) cg-prop: \tProperty \"blkio.weight\"\r\n(00.000694) cg-prop: Parsing controller \"freezer\"\r\n(00.000697) cg-prop: \tStrategy \"replace\"\r\n(00.000700) cg-prop: Parsing controller \"perf_event\"\r\n(00.000704) cg-prop: \tStrategy \"replace\"\r\n(00.000707) cg-prop: Parsing controller \"net_cls\"\r\n(00.000711) cg-prop: \tStrategy \"replace\"\r\n(00.000714) cg-prop: \tProperty \"net_cls.classid\"\r\n(00.000718) cg-prop: Parsing controller \"net_prio\"\r\n(00.000721) cg-prop: \tStrategy \"replace\"\r\n(00.000724) cg-prop: \tProperty \"net_prio.ifpriomap\"\r\n(00.000728) cg-prop: Parsing controller \"pids\"\r\n(00.000731) cg-prop: \tStrategy \"replace\"\r\n(00.000735) cg-prop: \tProperty \"pids.max\"\r\n(00.000738) cg-prop: Parsing controller \"devices\"\r\n(00.000741) cg-prop: \tStrategy \"replace\"\r\n(00.000745) cg-prop: \tProperty \"devices.list\"\r\n(00.000790) Perparing image inventory (version 1)\r\n(00.000824) Add pid ns 1 pid 99769\r\n(00.000835) Add net ns 2 pid 99769\r\n(00.000845) Add ipc ns 3 pid 99769\r\n(00.000855) Add uts ns 4 pid 99769\r\n(00.000865) Add mnt ns 5 pid 99769\r\n(00.000875) Add user ns 6 pid 99769\r\n(00.000884) Add cgroup ns 7 pid 99769\r\n(00.000889) cg: Dumping cgroups for 99769\r\n(00.000918) cg:  `- New css ID 1\r\n(00.000923) cg:     `- [blkio] -> [/system.slice/containerd.service] [0]\r\n(00.000926) cg:     `- [cpu,cpuacct] -> [/system.slice/containerd.service] [0]\r\n(00.000990) cg:     `- [cpuset] -> [/] [0]\r\n(00.000997) cg:     `- [devices] -> [/system.slice/containerd.service] [0]\r\n(00.001001) cg:     `- [freezer] -> [/] [0]\r\n(00.001004) cg:     `- [hugetlb] -> [/] [0]\r\n(00.001007) cg:     `- [memory] -> [/system.slice/containerd.service] [0]\r\n(00.001011) cg:     `- [name=systemd] -> [/system.slice/containerd.service] [0]\r\n(00.001014) cg:     `- [net_cls,net_prio] -> [/] [0]\r\n(00.001017) cg:     `- [perf_event] -> [/] [0]\r\n(00.001020) cg:     `- [pids] -> [/system.slice/containerd.service] [0]\r\n(00.001024) cg:     `- [rdma] -> [/] [0]\r\n(00.001033) cg: Set 1 is criu one\r\n(00.001043) freezing processes: 100000 attempts with 100 ms steps\r\n(00.001066) freezer.state=FROZEN\r\n(00.001100) SEIZE 99698: success\r\n(00.001137) SEIZE 99741: success\r\n(00.001168) SEIZE 99742: success\r\n(00.001203) SEIZE 99743: success\r\n(00.001407) Seized task 99698, state 1\r\n(00.001414) seccomp: Collected tid_real 99698 mode 0x2\r\n(00.001437) \tSeizing 99698's 99741 thread\r\n(00.001484) seccomp: Collected tid_real 99741 mode 0x2\r\n(00.001488) \tSeizing 99698's 99742 thread\r\n(00.001530) seccomp: Collected tid_real 99742 mode 0x2\r\n(00.001534) \tSeizing 99698's 99743 thread\r\n(00.001575) seccomp: Collected tid_real 99743 mode 0x2\r\n(00.001603) Collected (-1 attempts, 0 in_progress)\r\n(00.001649) Collected (0 attempts, 0 in_progress)\r\n(00.001660) Collected 99698 in 1 state\r\n(00.001683) Will take pid namespace in the image\r\n(00.001687) Add pid ns 8 pid 99698\r\n(00.001698) Will take net namespace in the image\r\n(00.001701) Add net ns 9 pid 99698\r\n(00.001711) Will take ipc namespace in the image\r\n(00.001715) Add ipc ns 10 pid 99698\r\n(00.001725) Will take uts namespace in the image\r\n(00.001729) Add uts ns 11 pid 99698\r\n(00.001738) Will take mnt namespace in the image\r\n(00.001742) Add mnt ns 12 pid 99698\r\n(00.001757) Lock network\r\n(00.001760) Running network-lock scripts\r\n(00.001764) \tRPC\r\niptables-restore: invalid option -- 'w'\r\n(00.200695) Error (criu/util.c:815): killed by signal 11: Segmentation fault\r\nip6tables-restore: invalid option -- 'w'\r\n(00.491239) Error (criu/util.c:815): killed by signal 11: Segmentation fault\r\n(00.491280) Error (criu/net.c:2560): Locking network failed: iptables-restore returned -1. This may be connected to disabled CONFIG_NETFILTER_XT_MARK kernel build config option.\r\n(00.491313) Unlock network\r\n(00.491320) Running network-unlock scripts\r\n(00.491325) \tRPC\r\niptables-restore: invalid option -- 'w'\r\n(00.658659) Error (criu/util.c:815): killed by signal 11: Segmentation fault\r\nip6tables-restore: invalid option -- 'w'\r\n(00.830050) Error (criu/util.c:815): killed by signal 11: Segmentation fault\r\n(00.830139) Unfreezing tasks into 1\r\n(00.830148) \tUnseizing 99698 into 1\r\n(00.830272) Error (criu/cr-dump.c:1724): Dumping FAILED.\r\n```\r\n\r\n## Reproduction\r\n\r\nrunc bundle:\r\n\r\nhttp://crosbymichael.com/checkpoint-repo.tar.gz\r\n\r\nDownload and extract the runc bundle:\r\n\r\n```bash\r\n> cd <extracted bundle>\r\n> runc run redis\r\n```\r\n\r\nIn another terminal:\r\n\r\n```bash\r\n> runc checkpoint redis\r\n```\r\n\r\nUsing criu master and runc master with the latest changes for an empty netns."},"comment":{"url":"https://api.github.com/repos/checkpoint-restore/criu/issues/comments/419141020","html_url":"https://github.com/checkpoint-restore/criu/issues/551#issuecomment-419141020","issue_url":"https://api.github.com/repos/checkpoint-restore/criu/issues/551","id":419141020,"node_id":"MDEyOklzc3VlQ29tbWVudDQxOTE0MTAyMA==","user":{"login":"adrianreber","id":8724298,"node_id":"MDQ6VXNlcjg3MjQyOTg=","avatar_url":"https://avatars3.githubusercontent.com/u/8724298?v=4","gravatar_id":"","url":"https://api.github.com/users/adrianreber","html_url":"https://github.com/adrianreber","followers_url":"https://api.github.com/users/adrianreber/followers","following_url":"https://api.github.com/users/adrianreber/following{/other_user}","gists_url":"https://api.github.com/users/adrianreber/gists{/gist_id}","starred_url":"https://api.github.com/users/adrianreber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrianreber/subscriptions","organizations_url":"https://api.github.com/users/adrianreber/orgs","repos_url":"https://api.github.com/users/adrianreber/repos","events_url":"https://api.github.com/users/adrianreber/events{/privacy}","received_events_url":"https://api.github.com/users/adrianreber/received_events","type":"User","site_admin":false},"created_at":"2018-09-06T15:37:33Z","updated_at":"2018-09-06T15:37:33Z","author_association":"MEMBER","body":"I would say we have two problems here. iptables-restore segfaulting is one. Unfortunate but unrelated to CRIU (not totally as CRIU has problems with it, but not something we can fix).\r\n\r\nThe other problem is the missing '-w' which CRIU is using.\r\n\r\nA quick look around a few distros I see that -w is support on Fedora 27 (1.6.2), Fedora 28 (1.6.2) and CentOS 7 (1.4.21, it seems '-w' was backported in https://bugzilla.redhat.com/show_bug.cgi?id=1438597). On Ubuntu 18.04 iptables 1.6.1 is available and this does not seem to have '-w'.\r\n\r\nSo questions for @avagin: can we try to be smarter with how to call iptables-restore? I have seen a lot of error reports concerning the not working '-w'.\r\n\r\n@crosbymichael maybe opening a bug report for iptables-restore for Ubuntu would also be a good idea, especially as 18.04 will be around for some time."}}
{"actor":{"display_login":"adrianreber"}}