Description
The Containers and Checkpoint/Restore micro-conference focuses on both userspace and kernel related work.
The micro-conference targets the wider container ecosystem ideally with participants from all major container runtimes as well as init system developers.
The microconference will be discussing recent advancements in container technologies with some of the usual candidates being:
- VFS API improvements (new system calls, idmap, โฆ)
- CGroupV2 feature parity with CGroupV1 and migration path
- Dealing with the eBPF-ification of the world
- Mediating and intercepting complex system calls
- Making user namespaces more accessible
- Verifying the integrity of containers
- Improving the set of resource limits available
On the checkpoint/restore front, some of the potential topics include:
- Making CRIU work with modern Linux distributions
- Handling GPUs
- Restoring FUSE daemons
- Dealing with restartable sequences
- Use of eBPF
- Support of new kernel features
- Supporting shadow stack (x86, arm64)
- Support for madvise(MADV_GUARD_INSTALL)
- Support for mseal()
- Support for pidfd C/R, including process exit information
And quite likely a variety of other container and checkpoint/restore topics as things evolve between now and the event.
Past editions of this micro-conference have been the source of many developments in the Linux kernel, including:
- PIDfds
- VFS idmap (and adding it to a slew of filesystems)
- FUSE in user namespaces
- Unprivileged overlayfs
- Time namespace
- A variety of CRIU features and checkpoint/restore kernel interfaces with the latest among them being
- Unpriviledged checkpoint/restore
- Support of rseq(2) checkpointing
- IMA/TPM attestation work
-
Michal Koutnรฝ (SUSE)07/10/2026, 10:00
Triggered by:
Subject: [PATCH 0/4] bpf: add a few hooks for sandboxing
Message-Id: 20260220-work-bpf-namespace-v1-0-866207db7b83@kernel.orgProblem statements:
Go to contribution page
- Users (admins) are sometimes confused by some entity (PAM, systemd, container
runtimes) migrating their processes away from intended cgroup.
- Coarse-grained DAC doesn't express well who (migrating process) can operate
... -
Shailja Shaktawat07/10/2026, 10:20
CRIUโs incremental checkpointing is being used for forensic container snapshot(Stoyanov et al., DFRWS 2026) chains. Soft-dirty tracking cuts snapshot size by about 10ร and makes high-frequency capture practical. Live migration only needs a correct final state. Forensics needs the path that led there. Soft-dirty was built for migration and is now being reused for forensics.
A forensic...
Go to contribution page -
Radostin Stoyanov (University of Oxford)07/10/2026, 10:40
With the increased adoption of AI workloads, efficient GPU checkpointing mechanisms are becoming crucial for inference, training, fine-tuning, and reinforcement learning workloads. One of the key challenges with GPU checkpointing today is the lack of memory-tracking support that enables incremental snapshots. When the GPU state is checkpointed into host memory, all pages appear modified,...
Go to contribution page -
Andrei Zhadchenko (Virtuozzo)07/10/2026, 11:00
Container storage commonly relies on directory overlays, filesystem-native subvolumes, or thin-provisioned block devices. We will explore another approach: exposing QCOW2 images directly as Linux block devices through a device-mapper target. QCOW2 is the standard virtual-disk format across much of the QEMU/KVM ecosystem. Its widespread adoption, mature tooling, and features such as...
Go to contribution page -
Jori Koolstra (N/A)07/10/2026, 12:00
For quite a while there has been a wish from container runtime to be able to restrict how we can reuse a particular file descriptor. For instance, CVE-2019-5736 showcased a privilege escalation in runc, whereby the possibility of reopening
Go to contribution page/proc/self/exeas writeable allowed a malicious image to overwrite the runc binary. That was patched on the user space side by copying runc to a sealed... -
Pavel Tikhomirov07/10/2026, 12:20
After moving OpenVZ containers to cgroup-v2 we are struggling a bit to reach
feature parity with what we had before. One such feature is running nested
Docker containers inside an OpenVZ (system) container โ part of making our
containers behave as close to a regular server as possible.In cgroup-v2 the device controller was reformed drastically: device
Go to contribution page
availability can only be... -
Andrei Vagin07/10/2026, 12:40
Checkpoint/Restore (C/R) is increasingly used for both startup acceleration (restoring pre-warmed snapshot instances on demand) and live migration. However, deploying static snapshots or migrating tasks across heterogeneous clusters creates severe runtime bottlenecks when source and target nodes possess differing CPU capabilities. While CRIU and container runtimes can accurately preserve...
Go to contribution page -
Michal Koutnรฝ (SUSE)07/10/2026, 13:00
Triggered by:
a) various rstat fixups as well as people reporting issues with (memory).stat reading vs writing performance & precision
b) occasional reports/attempts to make container startup quickerProblem statements:
Go to contribution page
a) cgroup rstats need to balance latency requirements of updaters (writers) and readers while preserving sufficient precision. The improvement for one may cause some...