In this lesson, you will learn how to leverage CRIU to migrate an active container from one host to another by serializing its internal kernel state into persistent files.
The Mechanics of State Serialization
CRIU (Checkpoint and Restore in Userspace) works by "freezing" a running process tree. Instead of merely saving a process's memory, CRIU captures the entire environment—the process identifiers (PIDs), open file descriptors, established network connections, and the state of namespaces.
When you trigger a checkpoint on a source host, CRIU inspects the /proc filesystem and uses the ptrace system call to dump the execution context. This state is written to a collection of image files on disk. To move the workload, you transfer these image files to a destination host. Because CRIU is "container-aware," it can restore these processes by recreating the identical namespace and process tree structure on the new kernel, effectively transparently resuming the container from the exact moment it was paused.
Practical Migration Workflow
To migrate an active container, you typically interface with your container runtime (such as runc) to invoke the CRIU dump command. A simplified representation of the checkpoint operation looks like this:
# Checkpoint the container to a directory
runc checkpoint --image-path /tmp/migration_dir my-container
# On the destination host, restore the container from those images
runc restore --image-path /tmp/migration_dir my-container
When you initiate the restore command, CRIU maps the saved memory pages back into the process address space, reopens the file descriptors, and restores the socket states, allowing the application to continue running without knowing it has been relocated across different physical hardware.
Critical Considerations
Migration via CRIU requires that the source and destination hosts have compatible kernel configurations, especially regarding namespaces and cgroup versions. Because CRIU relies on deep kernel introspection, the security policies governing the container (such as those established in your previous lessons on rootless architecture and namespace restrictions) must remain consistent across both hosts to ensure the restored process can successfully re-acquire its resources.
Key Takeaway: CRIU achieves live migration by serializing the kernel-managed state—including PIDs, file descriptors, and namespace contexts—into image files, enabling the restoration of a container's execution state on a remote host.