The release of CRIU 4.0 (Checkpoint and Restore In Userspace) has been published, designed for the preservation and restoration of processes in user space. The tool allows saving the state of one or a group of processes, and then resuming work from the saved position, even after a system reboot or on another server without breaking already established network connections. The project code is written in C and is distributed under the GPLv2 license. CRIU is used in container management systems such as OpenVZ, LXC/LXD, and Docker. Necessary changes for CRIU operation are included in the main Linux kernel.
Notable applications of CRIU technology include ensuring OS reboots without interrupting the continuity of long-running processes, live migration of isolated containers, accelerating the startup of slow processes (allowing work to begin from a state saved after initialization), performing kernel updates without restarting services, periodically saving the state of long-running computational tasks for resuming work in case of a crash, load balancing across nodes in clusters, duplicating processes to another machine (forking to a remote system), and creating snapshots of user applications during operation for analysis on another system or in case further actions in the program need to be canceled.
In the new release:
- A CUDA plugin has been added, providing the ability to save and restore the state of applications based on NVIDIA CUDA technology.
- Support for the Shadow Stack mechanism has been added, which has been supported since Linux kernel 6.6 and allows blocking many exploits by utilizing the hardware capabilities of Intel processors (after control is transferred to a function, the return addresses are saved by the processor not only in the regular stack but also in a separate 'shadow' stack that cannot be modified directly; before exiting the function, the return address is retrieved from the shadow stack and verified against the return address from the main stack).
- Support for the ioctl command PAGEMAP_SCAN has been added to retrieve information about the content of memory page tables, which, among other things, allows for determining write events in a specific memory area when used with userfaultfd().
- The ability to restore a thread in the correct cgroup v1 has been implemented.
Source: opennet.ru
