CRIU

Mentors: Student: Rupam-It

The Checkpoint-Restore Operator manages checkpoint retention well but has no way to create checkpoints automatically. This project adds a new CheckpointSchedule CRD and controller that triggers checkpoint creation through four mechanisms: cron-based time schedules, CPU/memory resource thresholds, Kubernetes cluster events (node drain, pod eviction, preemption), and pod annotations for application-level signaling. All triggers call the existing Kubelet Checkpoint API via the Kubernetes API server proxy. Deliverables include the CheckpointSchedule CRD, a CheckpointCreator that calls the Kubelet API, four independent trigger subsystems, a TriggerManager to coordinate them, a full controller-runtime reconciler, RBAC updates, unit and BATS integration tests, and sample configuration. Together with the existing retention policies, this turns the operator into a complete checkpoint lifecycle manager — admins declare both when checkpoints are created and how long they are kept, with no custom scripting required.

Mentors: Student: Deepak Anand

CRIU currently supports unprivileged checkpoint/restore in limited cases, but rootless containers remain unsupported because they introduce additional challenges around user namespaces, ptrace permissions, seccomp suspension, cgroup handling, and UID/GID mapping. This project aims to add a dedicated rootless-container checkpoint/restore path to CRIU rather than extending the existing --unprivileged mode. The implementation will introduce a user-namespace-aware helper architecture for dump, preserve cgroup state when delegation permits it, correctly capture and restore UID/GID mappings using newuidmap and newgidmap, and establish proper restore ordering for user and mount namespaces. Deliverables include the new rootless-container support path in CRIU, cgroup handling improvements, UID/GID mapping support, expanded rootless zdtm coverage, and documentation for the workflow and limitations.

Mentors: Student: Ahmed Khalid Elaidy

Currently, CRIU cannot checkpoint or restore systemd-managed containers if there are SCM_CREDENTIALS messages waiting in a Unix socket queue. Because systemd uses these credentials for almost all service communications, any in-flight message causes CRIU to fail. We aim to solve this problem by adding support for SCM_CREDENTIALS and the newer SCM_PIDFD to CRIU’s socket queue logic. I will implement PID remapping to ensure credentials remain valid after restore and add support for modern socket options like SO_PASSPIDFD. The final deliverables will include core code updates to the socket subsystem and extend image formats.

Mentors: Student: Shailja Shaktawat

In Kubernetes, container termination during security incidents results in the loss of critical forensic data. This project automates the capture of container states by building an event-driven pipeline. Using Falco for detection, a custom Kubernetes Controller for CRIU checkpointing, and checkpointctl for automated analysis, this project extends the capabilities of the existing Medusa framework and ensures that volatile evidence (such as memory, process trees, and open files) is preserved and reported. This enables forensic investigators to perform deep forensic analysis on frozen container states, which otherwise might have been ephemeral.

Mentors: Student: Behouba Manassé

The goal of this project is to address the challenge of checkpointing distributed applications, which generally run across multiple nodes with active TCP connections. While Kubernetes has recently introduced checkpointing support, it lacks a proper synchronization mechanism for distributed workloads, especially in managing network state during checkpoint and restore. To solve this, the project proposes to extend the existing criu-coordinator tool with support for network connection management via CRIU’s hook mechanisms. The work will involve implementing network-lock and network-unlock hooks, developing a pod-level network locking mechanism, and differentiating between internal and external TCP connections during checkpointing.