In this lesson, you will learn how to maintain container network and mount session state across host kernel upgrades to ensure zero-downtime infrastructure maintenance.
When a host kernel is upgraded, the kernel itself must be reloaded, which traditionally destroys all transient kernel objects—including the namespaces that provide container isolation. However, in advanced container architectures, we must decouple the lifecycle of the container's virtual environment from the lifecycle of the host kernel.
The Mechanism of Persistence
To survive a kernel update, you cannot rely on the default behavior of process-bound namespaces. Instead, you utilize persistent namespace handles. By using the nsenter utility or direct mount calls on the /proc/[pid]/ns/ file descriptors, you can pin a namespace to a bind-mounted file in the filesystem (e.g., /var/run/netns/my-container).
Because the namespace handle is now a file on the persistent storage layer, the namespace object remains tracked by the kernel's reference counting mechanism even if the original processes are migrated or paused.
Orchestrating Across Upgrades
To achieve persistence during an upgrade, we follow these three steps:
- State Serialization: Before the kernel reboot, use
CRIU(Checkpoint and Restore in Userspace) to dump the process state into images on disk. - Handle Pinning: Ensure the network namespace remains bound to its persistent path in
/var/run/netns/. - Session Reattachment: Upon the new kernel’s initialization, the container runtime reloads the namespace handle from the persistent filesystem path rather than requesting the creation of a new, blank namespace.
This allows the network stack (including established socket connections and routing tables) and the mount namespace (including private /var/lib/docker/overlay2 mounts) to re-attach to the new kernel's process scheduler without resetting the container's internal view of the world.
# Pinning a network namespace to a persistent file
ip netns add persistent-ns
mount --bind /proc/self/ns/net /var/run/netns/persistent-ns
By maintaining these file descriptors, you decouple the ephemeral process execution from the persistent virtual topology, allowing the underlying host kernel to evolve without terminating the container's active session.
Key Takeaway: Namespace persistence is achieved by decoupling the namespace handle from the process lifecycle and pinning it to a persistent filesystem object, allowing the kernel environment to survive host reboots.