Using CRIU for checkpointing docker containers

[gowripratyusha (Gowri Pratyusha Yerra)]

I am trying to checkpoint a Docker container in Ubuntu 22.04 and 24.04 versions. I used the following commands and it works correctly:

sudo docker run -d --name looper \

–cap-add=CHECKPOINT_RESTORE \

–cap-add=SYS_ADMIN \

–security-opt seccomp=unconfined \

–security-opt apparmor=unconfined \

–userns=host \

–network=host \

busybox sh -c ‘while true; do date; sleep 1; done’

sudo docker checkpoint create looper checkpoint_fixed

sudo docker start --checkpoint checkpoint_fixed looper

But when the remove the –network=host flag, I get the following error -

Error response from daemon: bind-mount /proc/0/ns/net → /var/run/docker/netns/b8fbcca5bab2: no such file or directory

I want to try without using host network as I am have to create multiple containers on same host and checkpoint them and still want the isolation which would be stripped of if I use host network. Can somebody help me with this issue?

I have tried bunch of fixes like creating a subnet and attach to it but still I get the same error

[rimelek (Ákos Takács)]

It is not clear to me when you get the error message. When you want to restore a container from checkpoint or when you want to create a container without host network. I tried to reproduce the issue, it it worked for me. host network couldn’t be a requirement as it is usually not even recommended to use host network.

If you share more code or command, or logs, please,.use the standard markdown syntax for code blocks, not quotes and you will not have problems with the backslashes either

How to format your forum posts

The Docker forum is using Discourse, which supports several ways to format your posts: Markdown; see commonmark.org/help for an interactive tutorial BBCode A small selection of HTML Any combination of the above Blank lines for formatting and readability Quite often you’ll need an empty line above specific formatting to make it work. You also need to type blank lines to create proper paragraphs; just pressing Return once and then typing a new block of text right below a previous block only …

[gowripratyusha (Gowri Pratyusha Yerra)]

Hi, I am getting the error when I try to restore the container. I used the below commands
```

gyerra@node0:~$ sudo docker run -d --name looper \
  --cap-add=CHECKPOINT_RESTORE \
  --cap-add=SYS_ADMIN \
  --security-opt seccomp=unconfined \
  --security-opt apparmor=unconfined \
  --userns=host \
  busybox sh -c 'while true; do date; sleep 1; done'
Unable to find image 'busybox:latest' locally
latest: Pulling from library/busybox
90b9666d4aed: Pull complete 
Digest: sha256:f9a104fddb33220ec80fc45a4e606c74aadf1ef7a3832eb0b05be9e90cd61f5f
Status: Downloaded newer image for busybox:latest
b74db825d7c41616202c778bddbaca0d9594877d9b9b54cd2d4840b36557b778
gyerra@node0:~$ sudo docker logs -f looper
Thu Aug 14 16:00:14 UTC 2025
Thu Aug 14 16:00:15 UTC 2025
Thu Aug 14 16:00:16 UTC 2025
Thu Aug 14 16:00:17 UTC 2025
Thu Aug 14 16:00:18 UTC 2025
Thu Aug 14 16:00:19 UTC 2025
Thu Aug 14 16:00:20 UTC 2025
Thu Aug 14 16:00:21 UTC 2025
Thu Aug 14 16:00:22 UTC 2025
Thu Aug 14 16:00:23 UTC 2025
Thu Aug 14 16:00:24 UTC 2025
Thu Aug 14 16:00:25 UTC 2025
Thu Aug 14 16:00:26 UTC 2025
Thu Aug 14 16:00:27 UTC 2025
Thu Aug 14 16:00:28 UTC 2025
Thu Aug 14 16:00:29 UTC 2025
Thu Aug 14 16:00:30 UTC 2025
^Cgyerra@node0:~sudo docker checkpoint create looper checkpoint_fixed
checkpoint_fixed
gyerra@node0:~$ sudo docker start --checkpoint checkpoint_fixed looper
Error response from daemon: bind-mount /proc/0/ns/net -> /var/run/docker/netns/dcb45570a73f: no such file or directory
gyerra@node0:~$ 

I do not get this error during restore when I use –network=host

```

gyerra@node0:~$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 24.04.3 LTS
Release:	24.04
Codename:	noble

[rimelek (Ákos Takács)]

Let me share a question template and please, ignore the parts you already answered.

We usually need the following information to understand the issue:

1. What platform are you using? Windows, Linux or macOS? Which version of the operating systems? In case of Linux, which distribution?

2. How did you install Docker? Sharing the platform almost answers it, but only almost. Direct links to the followed guide can be useful.

3. On debian based Linux, the following commands can give us some idea and recognize incorrectly installed Docker:

   docker info
   docker version
   

   Review the output before sharing and remove confidential data if any appears (public IP for example)

   dpkg -l 'docker*' | grep '^ii'
   snap list docker
   

   When you share the outputs, always format your posts according to the following guide: How to format your forum posts

[gowripratyusha (Gowri Pratyusha Yerra)]

Platform details:

gyerra@node0:~$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 24.04.3 LTS
Release:	24.04
Codename:	noble
gyerra@node0:~$ dpkg --print-architecture
amd64
 

Docker installation steps:

# Install Java (both OpenJDK 11 and 8)
sudo apt-get install openjdk-11-jdk openjdk-8-jdk

# Prepare for Docker installation
sudo apt-get update
sudo apt-get install \
    ca-certificates \
    curl \
    gnupg \
    lsb-release -y

# Add Docker’s official GPG key
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# Set up Docker’s official stable repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine, CLI, and plugins
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y

Versions:

gyerra@node0:~$ sudo docker info
Client: Docker Engine - Community
 Version:    28.3.3
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.26.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.39.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 1
 Server Version: 28.3.3
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
 runc version: v1.2.5-0-g59923ef
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.8.0-71-generic
 Operating System: Ubuntu 24.04.3 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 32
 Total Memory: 125.6GiB
 Name: <>
 ID: <>
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: true
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false

gyerra@node0:~$ 

I have removed the name and Docker ID for sensitivity purposes

gyerra@node0:~$ sudo docker version
Client: Docker Engine - Community
 Version:           28.3.3
 API version:       1.51
 Go version:        go1.24.5
 Git commit:        980b856
 Built:             Fri Jul 25 11:34:09 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          28.3.3
  API version:      1.51 (minimum version 1.24)
  Go version:       go1.24.5
  Git commit:       bea959c
  Built:            Fri Jul 25 11:34:09 2025
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
gyerra@node0:~$ 

gyerra@node0:~$ sudo dpkg -l 'docker*' | grep '^ii'
ii  docker-buildx-plugin      0.26.1-1~ubuntu.24.04~noble   amd64        Docker Buildx cli plugin.
ii  docker-ce                 5:28.3.3-1~ubuntu.24.04~noble amd64        Docker: the open-source application container engine
ii  docker-ce-cli             5:28.3.3-1~ubuntu.24.04~noble amd64        Docker CLI: the open-source application container engine
ii  docker-ce-rootless-extras 5:28.3.3-1~ubuntu.24.04~noble amd64        Rootless support for Docker.
ii  docker-compose-plugin     2.39.1-1~ubuntu.24.04~noble   amd64        Docker Compose (V2) plugin for the Docker CLI.

gyerra@node0:~$ snap list docker
error: no matching snaps installed

gyerra@node0:~$ criu --version
Version: 4.1.1

[rimelek (Ákos Takács)]

You would definitely win the most detailed reply to asked information competition. Thanks for that. I could reproduce it with your command and I realized I didn’t finish testing it previously so I was wrong when I said I tested it. I just wanted to test it and I was distructed by another issue and forgot to run the docker start command.

It looks like a bug where Docker tries to use a network namespace which is not created yet. You could report these kind of bugs in the Moby repository.

moby/moby

[gowripratyusha (Gowri Pratyusha Yerra)]

Hahaha, I have been struggling with it for days, so I wanted to get help to resolve it asap. Is there a workaround for this? This should be a basic issue in checkpointing Docker containers right?

[rimelek (Ákos Takács)]

The checkpoint feature is still experimental so I wouldn’t use it for anything in production. It seems that the “workaround” is the host network as you pointed out, which is not really a workaround, so you will need to wait until it is fixed. Which will be fixed if someone reports it When it will be fixed, I can’t tell, especially as an exprimental feature.