Skip to content

Commit 35f1c2d

Browse files
cweld510gvisor-bot
authored andcommitted
Add flag to disable container spec validation when restoring checkpoints
This PR adds a new flag entitled `skip-restore-spec-validation-unsafe`, defaulting to false. If the flag is set, the container spec given when restoring a checkpoint will no longer be validated against the original container spec given when the checkpoint was taken. In practice, many spec differences are benign, and it can be useful to allow the container specs to vary somewhat between checkpoint and restore. See #11307 . FUTURE_COPYBARA_INTEGRATE_REVIEW=#11323 from cweld510:cweld/skip-spec-validation-unsafe 17b2c1b PiperOrigin-RevId: 710752422
1 parent 6c5bc5e commit 35f1c2d

File tree

3 files changed

+11
-4
lines changed

3 files changed

+11
-4
lines changed

runsc/boot/restore.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ func (r *restorer) restoreContainerInfo(l *Loader, info *containerInfo) error {
132132

133133
if len(r.containers) == r.totalContainers {
134134
// Trigger the restore if this is the last container.
135-
return r.restore(l)
135+
return r.restore(l, info.conf.UnsafeSkipRestoreSpecValidation)
136136
}
137137
return nil
138138
}
@@ -544,7 +544,7 @@ func validateSpecs(oldSpecs, newSpecs map[string]*specs.Spec) error {
544544
return nil
545545
}
546546

547-
func (r *restorer) restore(l *Loader) error {
547+
func (r *restorer) restore(l *Loader, unsafeSkipRestoreSpecValidation bool) error {
548548
log.Infof("Starting to restore %d containers", len(r.containers))
549549

550550
// Create a new root network namespace with the network stack of the
@@ -650,8 +650,10 @@ func (r *restorer) restore(l *Loader) error {
650650
if err != nil {
651651
return fmt.Errorf("failed to pop container specs from checkpoint: %w", err)
652652
}
653-
if err := validateSpecs(oldSpecs, l.containerSpecs); err != nil {
654-
return fmt.Errorf("failed to validate restore spec: %w", err)
653+
if !unsafeSkipRestoreSpecValidation {
654+
if err := validateSpecs(oldSpecs, l.containerSpecs); err != nil {
655+
return fmt.Errorf("failed to validate restore spec: %w", err)
656+
}
655657
}
656658

657659
// Since we have a new kernel we also must make a new watchdog.

runsc/config/config.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,10 @@ type Config struct {
384384

385385
// TestOnlySaveRestoreNetstack indicates netstack should be saved and restored.
386386
TestOnlySaveRestoreNetstack bool `flag:"TESTONLY-save-restore-netstack"`
387+
388+
// UnsafeSkipRestoreSpecValidation optionally skips validation of the container spec for restored
389+
// containers.
390+
UnsafeSkipRestoreSpecValidation bool `flag:"unsafe-skip-restore-spec-validation"`
387391
}
388392

389393
func (c *Config) validate() error {

runsc/config/flags.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ func RegisterFlags(flagSet *flag.FlagSet) {
106106
flagSet.Bool("enable-core-tags", false, "enables core tagging. Requires host linux kernel >= 5.14.")
107107
flagSet.String("pod-init-config", "", "path to configuration file with additional steps to take during pod creation.")
108108
flagSet.Var(HostSettingsCheck.Ptr(), "host-settings", "how to handle non-optimal host kernel settings: check (default, advisory-only), ignore (do not check), adjust (best-effort auto-adjustment), or enforce (auto-adjustment must succeed).")
109+
flagSet.Bool("unsafe-skip-restore-spec-validation", false, "Enables skipping validation of the restore-time container spec when restoring checkpoints.")
109110

110111
// Flags that control sandbox runtime behavior: MM related.
111112
flagSet.Bool("app-huge-pages", true, "enable use of huge pages for application memory; requires /sys/kernel/mm/transparent_hugepage/shmem_enabled = advise")

0 commit comments

Comments
 (0)