CRaC can't checkpoint of spring app running inside a docker container (Mac OSX x86_64)

[sbaldin]

Hi, I trying to run spring boot from your examples with forked tomcat inside docker with latest build 17-crac+5, getting error on the attempt to checkout app, can you give any advice?

root@bacc339c8eaf:/# jcmd 9 JDK.checkpoint
9:
CR: Checkpoint ...
--------------------
023-05-03T07:55:34.079Z  INFO 9 --- [Attach Listener] jdk.crac                                 : /opt/app/spring-boot-0.0.1-SNAPSHOT.jar is recorded as always available on restore
JVM: invalid info for restore provided: queued code -1
An exception during a checkpoint operation:
jdk.crac.CheckpointException
        at java.base/jdk.crac.Core.checkpointRestore1(Core.java:141)
        at java.base/jdk.crac.Core.checkpointRestore(Core.java:246)
        at java.base/jdk.crac.Core.checkpointRestoreInternal(Core.java:262)

Also output of criu check --all contains a lot of not supported and denied lines maybe it is the reason?

 ./criu check --all
Warn  (criu/kerndat.c:1470): CRIU was built without libnftables support
Error (criu/cr-check.c:750): couldn't suspend seccomp: Operation not permitted
Error (criu/cr-check.c:793): Dumping seccomp filters not supported: Permission denied
Warn  (criu/cr-check.c:813): Dirty tracking is OFF. Memory snapshot will not work.
Error (criu/cr-check.c:1208): UFFD is not supported
Error (criu/cr-check.c:1208): UFFD is not supported
Error (criu/cr-check.c:1273): Time namespaces are not supported
Warn  (criu/cr-check.c:1334): Nftables based locking requires libnftables and set concatenations support
Error (criu/cr-check.c:996): failed to mount autofs: No such device
Looks good but some kernel features are missing
which, depending on your process tree, may cause
dump or restore failure.

[AntonKozlov]

Could you post complete command line for the app. And dump4.log from the CRaC image directory.

[sbaldin]

I followed the article "How to Run a Java Application with CRaC in a Docker Container" to run the app with CRaC inside a Docker container. I repeated the entire process again to gather the most recent information.

My docker file looks like:

FROM ubuntu:20.04


ENV JAVA_HOME /opt/jdk
ENV PATH $JAVA_HOME/bin:$PATH

RUN apt-get update -y

ADD "https://github.com/CRaC/openjdk-builds/releases/download/17-crac%2B5/openjdk-17-crac+5_linux-x64.tar.gz" $JAVA_HOME/openjdk.tar.gz
RUN tar --extract --file $JAVA_HOME/openjdk.tar.gz --directory "$JAVA_HOME" --strip-components 1; rm $JAVA_HOME/openjdk.tar.gz;

RUN mkdir -p /opt/crac-files

COPY build/libs/crac_spring-0.0.1-SNAPSHOT.jar /opt/app/crac_spring-0.0.1-SNAPSHOT.jar

Then I launched container docker run -it --privileged --rm --name my_app_on_crac my_app_on_crac and inside it run
command java -XX:CRaCCheckpointTo=/opt/crac-files -jar crac_spring-0.0.1-SNAPSHOT.jar.
After that, I connected to it in another terminal and created a checkpoint using the command: jcmd 11 JDK.checkpoint(In this case PID was equal 11).

The application log shows the following:

2023-05-16T07:50:55.163Z  INFO 11 --- [           main] com.example.springboot.Application       : Started Application in 1.646 seconds (process running for 2.436)
2023-05-16T07:51:55.542Z  INFO 11 --- [Attach Listener] jdk.crac                                 : /opt/app/crac_spring-0.0.1-SNAPSHOT.jar is recorded as always available on restore
JVM: invalid info for restore provided: queued code -1
An exception during a checkpoint operation:
jdk.crac.CheckpointException
        at java.base/jdk.crac.Core.checkpointRestore1(Core.java:141)
        at java.base/jdk.crac.Core.checkpointRestore(Core.java:246)
        at java.base/jdk.crac.Core.checkpointRestoreInternal(Core.java:262)

The dump4.log file contains the following content:

(00.000142) Version: 3.17.1-crac (gitid 8926431+1)
(00.000268) Running on 9e90a9d2f5e0 Linux 5.15.49-linuxkit #1 SMP Tue Sep 13 07:51:46 UTC 2022 x86_64
(00.000288) File /run/criu.kdat does not exist
(00.000313) sockets: Probing sock diag modules
(00.008742) sockets: Done probing
(00.008834) Pagemap is fully functional
(00.008908) Found anon-shmem device at 1
(00.008975) Hugetlb size 2 Mb is supported but cannot get dev's number
(00.008991) Reset 89's dirty tracking
(00.009672)  ... done
(00.009715) Dirty tracking support is OFF
(00.009806) Found task size of 7ffffffff000
(00.016570) Restoring netdev veth idx 10
(00.021434) Dumping netns links
(00.021720)     LD: Got link 1, type 772
(00.021746)     LD: Got link 2, type 768
(00.021753)     LD: Got link 3, type 769
(00.021757)     LD: Got link 10, type 1
(00.023239) uffd: Lazy pages are not available: Function not implemented
(00.023854) vdso: Parsing at 7ffdcd782000 7ffdcd784000
(00.023968) vdso: PT_LOAD p_vaddr: 0
(00.023983) vdso: DT_HASH: 120
(00.023988) vdso: DT_STRTAB: 2d8
(00.024011) vdso: DT_SYMTAB: 1b8
(00.024015) vdso: DT_STRSZ: 72
(00.024058) vdso: DT_SYMENT: 18
(00.024077) vdso: nbucket 3 nchain c bucket 7ffdcd782128 chain 7ffdcd782134
(00.024088) vdso: rt [vdso] 7ffdcd782000-7ffdcd784000 [vvar] 7ffdcd77e000-7ffdcd782000
(00.025877) vdso: Parsing at 7f8367a88000 7f8367a8a000
(00.025918) vdso: PT_LOAD p_vaddr: 0
(00.025924) vdso: DT_HASH: b4
(00.025927) vdso: DT_STRTAB: 1f0
(00.025929) vdso: DT_SYMTAB: 140
(00.025931) vdso: DT_STRSZ: c0
(00.025932) vdso: DT_SYMENT: 10
(00.025940) vdso: nbucket 3 nchain b bucket 7f8367a880bc chain 7f8367a880c8
(00.025950) vdso: compat [vdso] 7ffdcd786000-7ffdcd788000 [vvar] 7ffdcd782000-7ffdcd786000
(00.026863) cpu: x86_family 6 x86_vendor_id GenuineIntel x86_model_id Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
(00.026901) cpu: fpu: xfeatures_mask 0x5 xsave_size 832 xsave_size_max 832 xsaves_size 832
(00.026916) cpu: fpu: x87 floating point registers     xstate_offsets      0 / 0      xstate_sizes    160 / 160   
(00.026923) cpu: fpu: AVX registers                    xstate_offsets    576 / 576    xstate_sizes    256 / 256   
(00.027462) Warn  (criu/kerndat.c:1470): CRIU was built without libnftables support
(00.028751) Found mmap_min_addr 0x10000
(00.028795) files stat: fs/nr_open 1048576
(00.028805) skip kerndat_save_cache
(00.028829) ========================================
(00.028835) Dumping processes (pid: 11)
(00.028837) ========================================
(00.028849) rlimit: RLIMIT_NOFILE unlimited for self
(00.028875) Running pre-dump scripts
(00.028946) irmap: Searching irmap cache in work dir
(00.028981) No irmap-cache image
(00.028987) irmap: Searching irmap cache in parent
(00.029077) No parent images directory provided
(00.029085) irmap: No irmap cache
(00.029090) cpu: fpu:1 fxsr:1 xsave:1 xsaveopt:1 xsavec:1 xgetbv1:1 xsaves:0
(00.029163) cg-prop: Parsing controller "cpu"
(00.029170) cg-prop:    Strategy "replace"
(00.029175) cg-prop:    Property "cpu.shares"
(00.029200) cg-prop:    Property "cpu.cfs_period_us"
(00.029230) cg-prop:    Property "cpu.cfs_quota_us"
(00.029235) cg-prop:    Property "cpu.rt_period_us"
(00.029237) cg-prop:    Property "cpu.rt_runtime_us"
(00.029256) cg-prop: Parsing controller "memory"
(00.029258) cg-prop:    Strategy "replace"
(00.029260) cg-prop:    Property "memory.limit_in_bytes"
(00.029262) cg-prop:    Property "memory.memsw.limit_in_bytes"
(00.029263) cg-prop:    Property "memory.swappiness"
(00.029325) cg-prop:    Property "memory.soft_limit_in_bytes"
(00.029338) cg-prop:    Property "memory.move_charge_at_immigrate"
(00.029348) cg-prop:    Property "memory.oom_control"
(00.029355) cg-prop:    Property "memory.use_hierarchy"
(00.029363) cg-prop:    Property "memory.kmem.limit_in_bytes"
(00.029368) cg-prop:    Property "memory.kmem.tcp.limit_in_bytes"
(00.029370) cg-prop: Parsing controller "cpuset"
(00.029383) cg-prop:    Strategy "replace"
(00.029387) cg-prop:    Property "cpuset.cpus"
(00.029396) cg-prop:    Property "cpuset.mems"
(00.029400) cg-prop:    Property "cpuset.memory_migrate"
(00.029411) cg-prop:    Property "cpuset.cpu_exclusive"
(00.029427) cg-prop:    Property "cpuset.mem_exclusive"
(00.029431) cg-prop:    Property "cpuset.mem_hardwall"
(00.029433) cg-prop:    Property "cpuset.memory_spread_page"
(00.029434) cg-prop:    Property "cpuset.memory_spread_slab"
(00.029464) cg-prop:    Property "cpuset.sched_load_balance"
(00.029468) cg-prop:    Property "cpuset.sched_relax_domain_level"
(00.029525) cg-prop: Parsing controller "blkio"
(00.029534) cg-prop:    Strategy "replace"
(00.029546) cg-prop:    Property "blkio.weight"
(00.029555) cg-prop: Parsing controller "freezer"
(00.029559) cg-prop:    Strategy "replace"
(00.029561) cg-prop: Parsing controller "perf_event"
(00.029563) cg-prop:    Strategy "replace"
(00.029565) cg-prop: Parsing controller "net_cls"
(00.029572) cg-prop:    Strategy "replace"
(00.029577) cg-prop:    Property "net_cls.classid"
(00.029583) cg-prop: Parsing controller "net_prio"
(00.029591) cg-prop:    Strategy "replace"
(00.029595) cg-prop:    Property "net_prio.ifpriomap"
(00.029605) cg-prop: Parsing controller "pids"
(00.029614) cg-prop:    Strategy "replace"
(00.029622) cg-prop:    Property "pids.max"
(00.029625) cg-prop: Parsing controller "devices"
(00.029628) cg-prop:    Strategy "replace"
(00.029630) cg-prop:    Property "devices.list"
(00.029674) Preparing image inventory (version 1)
(00.030496) Add pid ns 1 pid 89
(00.030531) Add net ns 2 pid 89
(00.030554) Add ipc ns 3 pid 89
(00.030570) Add uts ns 4 pid 89
(00.030582) Add time ns 5 pid 89
(00.030611) Add mnt ns 6 pid 89
(00.030632) Add user ns 7 pid 89
(00.030648) Add cgroup ns 8 pid 89
(00.030654) cg: Dumping cgroups for 89
(00.030680) cg:  `- New css ID 1
(00.030686) cg:     `- [] -> [/] [0]
(00.030698) cg: Set 1 is criu one
(00.030718) Detected cgroup V1 freezer
(00.030913) Error (compel/src/lib/ptrace.c:27): suspending seccomp failed: Operation not permitted
(00.030962) Unlock network
(00.030990) Unfreezing tasks into 1
(00.030998)     Unseizing 11 into 1
(00.031005) Error (compel/src/lib/infect.c:356): Unable to detach from 11: No such process
(00.031142) Error (criu/cr-dump.c:2053): Dumping FAILED.

[rudygt]

get the same output with docker running with wsl2 backend

Error (compel/src/lib/ptrace.c:27): suspending seccomp failed: Operation not permitted

[jempitman]

I have also had very similar output with the spring-boot example [https://github.com/CRaC/example-spring-boot/] using docker 4.19 running wsl2 backend (Windows 10 Pro).

My Dockerfile is slightly different:

FROM ubuntu:20.04

ENV JAVA_HOME /opt/jdk
ENV PATH $JAVA_HOME/bin:$PATH

RUN apt-get update -y

ADD "https://github.com/CRaC/openjdk-builds/releases/download/17-crac%2B5/openjdk-17-crac+5_linux-x64.tar.gz" $JAVA_HOME/openjdk.tar.gz
RUN cd /opt/; chmod +x $JAVA_HOME/openjdk.tar.gz; tar --extract --file $JAVA_HOME/openjdk.tar.gz --directory "$JAVA_HOME" --strip-components 1; rm $JAVA_HOME/openjdk.tar.gz;

RUN mkdir -p /opt/crac-files

COPY target/spring-boot-initial-0.0.1-SNAPSHOT.jar /opt/app/MY-APP.jar

The debugging guide recommends checking whether the SUID bit is set and the criu file is owned by the root user (which was mentioned in a comment to a similar issue yesterday), however when I run ls -la $JAVA_HOME/lib/criu in Powershell it seems (to me at least) that the permissions are correctly set according to the debugging guide:

After having set/ confirmed the SUID bit and criu ownership details I ran the application and attempted to create a checkpoint but ran into the same error:

the output of the dump4.log file is

(00.000408) Version: 3.17.1-crac (gitid 8926431+1)
(00.000428) Running on 2bf119adec35 Linux 5.10.102.1-microsoft-standard-WSL2 #1 SMP Wed Mar 2 00:30:59 UTC 2022 x86_64
(00.000436) File /run/criu.kdat does not exist
(00.000446) sockets: Probing sock diag modules
(00.000671) sockets: Done probing
(00.000746) Pagemap is fully functional
(00.000784) Found anon-shmem device at 1
(00.001288) Hugetlb size 2 Mb is supported but cannot get dev's number
(00.001316) Hugetlb size 1024 Mb is supported but cannot get dev's number
(00.001323) Reset 93's dirty tracking
(00.001350)  ... done
(00.001370) Dirty tracking support is OFF
(00.001451) Found task size of 7ffffffff000
(00.009964) Restoring netdev veth idx 10
(00.010937) Dumping netns links
(00.011472) 	LD: Got link 1, type 772
(00.011479) 	LD: Got link 2, type 768
(00.011480) 	LD: Got link 3, type 776
(00.011482) 	LD: Got link 10, type 1
(00.012104) vdso: Parsing at 7ffc7c0a2000 7ffc7c0a3000
(00.012112) vdso: PT_LOAD p_vaddr: 0
(00.012114) vdso: DT_HASH: 120
(00.012115) vdso: DT_STRTAB: 2d8
(00.012116) vdso: DT_SYMTAB: 1b8
(00.012118) vdso: DT_STRSZ: 72
(00.012119) vdso: DT_SYMENT: 18
(00.012120) vdso: nbucket 3 nchain c bucket 7ffc7c0a2128 chain 7ffc7c0a2134
(00.012124) vdso: rt [vdso] 7ffc7c0a2000-7ffc7c0a3000 [vvar] 7ffc7c09e000-7ffc7c0a2000
(00.012442) vdso: Parsing at 7fe099d6a000 7fe099d6c000
(00.012451) vdso: PT_LOAD p_vaddr: 0
(00.012453) vdso: DT_HASH: b4
(00.012454) vdso: DT_STRTAB: 1f0
(00.012455) vdso: DT_SYMTAB: 140
(00.012456) vdso: DT_STRSZ: c0
(00.012458) vdso: DT_SYMENT: 10
(00.012459) vdso: nbucket 3 nchain b bucket 7fe099d6a0bc chain 7fe099d6a0c8
(00.012461) vdso: compat [vdso] 7ffc7c0a6000-7ffc7c0a8000 [vvar] 7ffc7c0a2000-7ffc7c0a6000
(00.012701) cpu: x86_family 6 x86_vendor_id GenuineIntel x86_model_id Intel(R) Core(TM) i7-10750H CPU @ 2.60GHz
(00.012710) cpu: fpu: xfeatures_mask 0x5 xsave_size 832 xsave_size_max 832 xsaves_size 832
(00.012716) cpu: fpu: x87 floating point registers     xstate_offsets      0 / 0      xstate_sizes    160 / 160   
(00.012718) cpu: fpu: AVX registers                    xstate_offsets    576 / 576    xstate_sizes    256 / 256   
(00.013068) Warn  (criu/kerndat.c:1470): CRIU was built without libnftables support
(00.013296) No MOVE_MOUNT_SET_GROUP kernel feature
(00.013698) ptrace(PTRACE_GET_RSEQ_CONFIGURATION) is not supported
(00.013816) Found mmap_min_addr 0x10000
(00.013826) files stat: fs/nr_open 1048576
(00.013829) skip kerndat_save_cache
(00.013835) ========================================
(00.013837) Dumping processes (pid: 13)
(00.013838) ========================================
(00.013842) rlimit: RLIMIT_NOFILE unlimited for self
(00.013853) Running pre-dump scripts
(00.013898) irmap: Searching irmap cache in work dir
(00.013937) No irmap-cache image
(00.013942) irmap: Searching irmap cache in parent
(00.013975) No parent images directory provided
(00.013979) irmap: No irmap cache
(00.013983) cpu: fpu:1 fxsr:1 xsave:1 xsaveopt:1 xsavec:1 xgetbv1:1 xsaves:1
(00.014011) cg-prop: Parsing controller "cpu"
(00.014014) cg-prop: 	Strategy "replace"
(00.014017) cg-prop: 	Property "cpu.shares"
(00.014019) cg-prop: 	Property "cpu.cfs_period_us"
(00.014020) cg-prop: 	Property "cpu.cfs_quota_us"
(00.014021) cg-prop: 	Property "cpu.rt_period_us"
(00.014023) cg-prop: 	Property "cpu.rt_runtime_us"
(00.014024) cg-prop: Parsing controller "memory"
(00.014026) cg-prop: 	Strategy "replace"
(00.014027) cg-prop: 	Property "memory.limit_in_bytes"
(00.014029) cg-prop: 	Property "memory.memsw.limit_in_bytes"
(00.014030) cg-prop: 	Property "memory.swappiness"
(00.014032) cg-prop: 	Property "memory.soft_limit_in_bytes"
(00.014033) cg-prop: 	Property "memory.move_charge_at_immigrate"
(00.014034) cg-prop: 	Property "memory.oom_control"
(00.014036) cg-prop: 	Property "memory.use_hierarchy"
(00.014037) cg-prop: 	Property "memory.kmem.limit_in_bytes"
(00.014038) cg-prop: 	Property "memory.kmem.tcp.limit_in_bytes"
(00.014040) cg-prop: Parsing controller "cpuset"
(00.014041) cg-prop: 	Strategy "replace"
(00.014043) cg-prop: 	Property "cpuset.cpus"
(00.014044) cg-prop: 	Property "cpuset.mems"
(00.014051) cg-prop: 	Property "cpuset.memory_migrate"
(00.014054) cg-prop: 	Property "cpuset.cpu_exclusive"
(00.014055) cg-prop: 	Property "cpuset.mem_exclusive"
(00.014057) cg-prop: 	Property "cpuset.mem_hardwall"
(00.014058) cg-prop: 	Property "cpuset.memory_spread_page"
(00.014060) cg-prop: 	Property "cpuset.memory_spread_slab"
(00.014061) cg-prop: 	Property "cpuset.sched_load_balance"
(00.014062) cg-prop: 	Property "cpuset.sched_relax_domain_level"
(00.014064) cg-prop: Parsing controller "blkio"
(00.014065) cg-prop: 	Strategy "replace"
(00.014067) cg-prop: 	Property "blkio.weight"
(00.014068) cg-prop: Parsing controller "freezer"
(00.014069) cg-prop: 	Strategy "replace"
(00.014071) cg-prop: Parsing controller "perf_event"
(00.014072) cg-prop: 	Strategy "replace"
(00.014074) cg-prop: Parsing controller "net_cls"
(00.014075) cg-prop: 	Strategy "replace"
(00.014077) cg-prop: 	Property "net_cls.classid"
(00.014078) cg-prop: Parsing controller "net_prio"
(00.014079) cg-prop: 	Strategy "replace"
(00.014081) cg-prop: 	Property "net_prio.ifpriomap"
(00.014082) cg-prop: Parsing controller "pids"
(00.014084) cg-prop: 	Strategy "replace"
(00.014085) cg-prop: 	Property "pids.max"
(00.014086) cg-prop: Parsing controller "devices"
(00.014088) cg-prop: 	Strategy "replace"
(00.014089) cg-prop: 	Property "devices.list"
(00.014120) Preparing image inventory (version 1)
(00.014150) Add pid ns 1 pid 93
(00.014158) Add net ns 2 pid 93
(00.014201) Add ipc ns 3 pid 93
(00.014210) Add uts ns 4 pid 93
(00.014238) Add time ns 5 pid 93
(00.014287) Add mnt ns 6 pid 93
(00.014296) Add user ns 7 pid 93
(00.014301) Add cgroup ns 8 pid 93
(00.014303) cg: Dumping cgroups for 93
(00.014322) cg:  `- New css ID 1
(00.014325) cg:     `- [] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014326) cg:     `- [blkio] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014328) cg:     `- [cpu] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014329) cg:     `- [cpuacct] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014330) cg:     `- [cpuset] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014332) cg:     `- [devices] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014333) cg:     `- [freezer] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014334) cg:     `- [hugetlb] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014336) cg:     `- [memory] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014337) cg:     `- [name=systemd] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014338) cg:     `- [net_cls] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014339) cg:     `- [net_prio] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014341) cg:     `- [perf_event] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014342) cg:     `- [pids] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014343) cg:     `- [rdma] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014345) cg: Set 1 is criu one
(00.014382) Detected cgroup V1 freezer
(00.014458) Error (compel/src/lib/ptrace.c:27): suspending seccomp failed: Operation not permitted
(00.014480) Unlock network
(00.014486) Unfreezing tasks into 1
(00.014488) 	Unseizing 13 into 1
(00.014490) Error (compel/src/lib/infect.c:356): Unable to detach from 13: No such process
(00.014501) Error (criu/cr-dump.c:2053): Dumping FAILED.

Could this issue be due to the chmod +x permissions for the jdk set in my Dockerfile?

[rudygt]

I have also had very similar output with the spring-boot example [https://github.com/CRaC/example-spring-boot/] using docker 4.19 running wsl2 backend (Windows 10 Pro).

My Dockerfile is slightly different:

FROM ubuntu:20.04

ENV JAVA_HOME /opt/jdk
ENV PATH $JAVA_HOME/bin:$PATH

RUN apt-get update -y

ADD "https://github.com/CRaC/openjdk-builds/releases/download/17-crac%2B5/openjdk-17-crac+5_linux-x64.tar.gz" $JAVA_HOME/openjdk.tar.gz
RUN cd /opt/; chmod +x $JAVA_HOME/openjdk.tar.gz; tar --extract --file $JAVA_HOME/openjdk.tar.gz --directory "$JAVA_HOME" --strip-components 1; rm $JAVA_HOME/openjdk.tar.gz;

RUN mkdir -p /opt/crac-files

COPY target/spring-boot-initial-0.0.1-SNAPSHOT.jar /opt/app/MY-APP.jar

The debugging guide recommends checking whether the SUID bit is set and the criu file is owned by the root user (which was mentioned in a comment to a similar issue yesterday), however when I run ls -la $JAVA_HOME/lib/criu in Powershell it seems (to me at least) that the permissions are correctly set according to the debugging guide:

After having set/ confirmed the SUID bit and criu ownership details I ran the application and attempted to create a checkpoint but ran into the same error:

the output of the dump4.log file is

(00.000408) Version: 3.17.1-crac (gitid 8926431+1)
(00.000428) Running on 2bf119adec35 Linux 5.10.102.1-microsoft-standard-WSL2 #1 SMP Wed Mar 2 00:30:59 UTC 2022 x86_64
(00.000436) File /run/criu.kdat does not exist
(00.000446) sockets: Probing sock diag modules
(00.000671) sockets: Done probing
(00.000746) Pagemap is fully functional
(00.000784) Found anon-shmem device at 1
(00.001288) Hugetlb size 2 Mb is supported but cannot get dev's number
(00.001316) Hugetlb size 1024 Mb is supported but cannot get dev's number
(00.001323) Reset 93's dirty tracking
(00.001350)  ... done
(00.001370) Dirty tracking support is OFF
(00.001451) Found task size of 7ffffffff000
(00.009964) Restoring netdev veth idx 10
(00.010937) Dumping netns links
(00.011472) 	LD: Got link 1, type 772
(00.011479) 	LD: Got link 2, type 768
(00.011480) 	LD: Got link 3, type 776
(00.011482) 	LD: Got link 10, type 1
(00.012104) vdso: Parsing at 7ffc7c0a2000 7ffc7c0a3000
(00.012112) vdso: PT_LOAD p_vaddr: 0
(00.012114) vdso: DT_HASH: 120
(00.012115) vdso: DT_STRTAB: 2d8
(00.012116) vdso: DT_SYMTAB: 1b8
(00.012118) vdso: DT_STRSZ: 72
(00.012119) vdso: DT_SYMENT: 18
(00.012120) vdso: nbucket 3 nchain c bucket 7ffc7c0a2128 chain 7ffc7c0a2134
(00.012124) vdso: rt [vdso] 7ffc7c0a2000-7ffc7c0a3000 [vvar] 7ffc7c09e000-7ffc7c0a2000
(00.012442) vdso: Parsing at 7fe099d6a000 7fe099d6c000
(00.012451) vdso: PT_LOAD p_vaddr: 0
(00.012453) vdso: DT_HASH: b4
(00.012454) vdso: DT_STRTAB: 1f0
(00.012455) vdso: DT_SYMTAB: 140
(00.012456) vdso: DT_STRSZ: c0
(00.012458) vdso: DT_SYMENT: 10
(00.012459) vdso: nbucket 3 nchain b bucket 7fe099d6a0bc chain 7fe099d6a0c8
(00.012461) vdso: compat [vdso] 7ffc7c0a6000-7ffc7c0a8000 [vvar] 7ffc7c0a2000-7ffc7c0a6000
(00.012701) cpu: x86_family 6 x86_vendor_id GenuineIntel x86_model_id Intel(R) Core(TM) i7-10750H CPU @ 2.60GHz
(00.012710) cpu: fpu: xfeatures_mask 0x5 xsave_size 832 xsave_size_max 832 xsaves_size 832
(00.012716) cpu: fpu: x87 floating point registers     xstate_offsets      0 / 0      xstate_sizes    160 / 160   
(00.012718) cpu: fpu: AVX registers                    xstate_offsets    576 / 576    xstate_sizes    256 / 256   
(00.013068) Warn  (criu/kerndat.c:1470): CRIU was built without libnftables support
(00.013296) No MOVE_MOUNT_SET_GROUP kernel feature
(00.013698) ptrace(PTRACE_GET_RSEQ_CONFIGURATION) is not supported
(00.013816) Found mmap_min_addr 0x10000
(00.013826) files stat: fs/nr_open 1048576
(00.013829) skip kerndat_save_cache
(00.013835) ========================================
(00.013837) Dumping processes (pid: 13)
(00.013838) ========================================
(00.013842) rlimit: RLIMIT_NOFILE unlimited for self
(00.013853) Running pre-dump scripts
(00.013898) irmap: Searching irmap cache in work dir
(00.013937) No irmap-cache image
(00.013942) irmap: Searching irmap cache in parent
(00.013975) No parent images directory provided
(00.013979) irmap: No irmap cache
(00.013983) cpu: fpu:1 fxsr:1 xsave:1 xsaveopt:1 xsavec:1 xgetbv1:1 xsaves:1
(00.014011) cg-prop: Parsing controller "cpu"
(00.014014) cg-prop: 	Strategy "replace"
(00.014017) cg-prop: 	Property "cpu.shares"
(00.014019) cg-prop: 	Property "cpu.cfs_period_us"
(00.014020) cg-prop: 	Property "cpu.cfs_quota_us"
(00.014021) cg-prop: 	Property "cpu.rt_period_us"
(00.014023) cg-prop: 	Property "cpu.rt_runtime_us"
(00.014024) cg-prop: Parsing controller "memory"
(00.014026) cg-prop: 	Strategy "replace"
(00.014027) cg-prop: 	Property "memory.limit_in_bytes"
(00.014029) cg-prop: 	Property "memory.memsw.limit_in_bytes"
(00.014030) cg-prop: 	Property "memory.swappiness"
(00.014032) cg-prop: 	Property "memory.soft_limit_in_bytes"
(00.014033) cg-prop: 	Property "memory.move_charge_at_immigrate"
(00.014034) cg-prop: 	Property "memory.oom_control"
(00.014036) cg-prop: 	Property "memory.use_hierarchy"
(00.014037) cg-prop: 	Property "memory.kmem.limit_in_bytes"
(00.014038) cg-prop: 	Property "memory.kmem.tcp.limit_in_bytes"
(00.014040) cg-prop: Parsing controller "cpuset"
(00.014041) cg-prop: 	Strategy "replace"
(00.014043) cg-prop: 	Property "cpuset.cpus"
(00.014044) cg-prop: 	Property "cpuset.mems"
(00.014051) cg-prop: 	Property "cpuset.memory_migrate"
(00.014054) cg-prop: 	Property "cpuset.cpu_exclusive"
(00.014055) cg-prop: 	Property "cpuset.mem_exclusive"
(00.014057) cg-prop: 	Property "cpuset.mem_hardwall"
(00.014058) cg-prop: 	Property "cpuset.memory_spread_page"
(00.014060) cg-prop: 	Property "cpuset.memory_spread_slab"
(00.014061) cg-prop: 	Property "cpuset.sched_load_balance"
(00.014062) cg-prop: 	Property "cpuset.sched_relax_domain_level"
(00.014064) cg-prop: Parsing controller "blkio"
(00.014065) cg-prop: 	Strategy "replace"
(00.014067) cg-prop: 	Property "blkio.weight"
(00.014068) cg-prop: Parsing controller "freezer"
(00.014069) cg-prop: 	Strategy "replace"
(00.014071) cg-prop: Parsing controller "perf_event"
(00.014072) cg-prop: 	Strategy "replace"
(00.014074) cg-prop: Parsing controller "net_cls"
(00.014075) cg-prop: 	Strategy "replace"
(00.014077) cg-prop: 	Property "net_cls.classid"
(00.014078) cg-prop: Parsing controller "net_prio"
(00.014079) cg-prop: 	Strategy "replace"
(00.014081) cg-prop: 	Property "net_prio.ifpriomap"
(00.014082) cg-prop: Parsing controller "pids"
(00.014084) cg-prop: 	Strategy "replace"
(00.014085) cg-prop: 	Property "pids.max"
(00.014086) cg-prop: Parsing controller "devices"
(00.014088) cg-prop: 	Strategy "replace"
(00.014089) cg-prop: 	Property "devices.list"
(00.014120) Preparing image inventory (version 1)
(00.014150) Add pid ns 1 pid 93
(00.014158) Add net ns 2 pid 93
(00.014201) Add ipc ns 3 pid 93
(00.014210) Add uts ns 4 pid 93
(00.014238) Add time ns 5 pid 93
(00.014287) Add mnt ns 6 pid 93
(00.014296) Add user ns 7 pid 93
(00.014301) Add cgroup ns 8 pid 93
(00.014303) cg: Dumping cgroups for 93
(00.014322) cg:  `- New css ID 1
(00.014325) cg:     `- [] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014326) cg:     `- [blkio] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014328) cg:     `- [cpu] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014329) cg:     `- [cpuacct] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014330) cg:     `- [cpuset] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014332) cg:     `- [devices] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014333) cg:     `- [freezer] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014334) cg:     `- [hugetlb] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014336) cg:     `- [memory] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014337) cg:     `- [name=systemd] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014338) cg:     `- [net_cls] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014339) cg:     `- [net_prio] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014341) cg:     `- [perf_event] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014342) cg:     `- [pids] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014343) cg:     `- [rdma] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014345) cg: Set 1 is criu one
(00.014382) Detected cgroup V1 freezer
(00.014458) Error (compel/src/lib/ptrace.c:27): suspending seccomp failed: Operation not permitted
(00.014480) Unlock network
(00.014486) Unfreezing tasks into 1
(00.014488) 	Unseizing 13 into 1
(00.014490) Error (compel/src/lib/infect.c:356): Unable to detach from 13: No such process
(00.014501) Error (criu/cr-dump.c:2053): Dumping FAILED.

Could this issue be due to the chmod +x permissions for the jdk set in my Dockerfile?

I manage to get it working by running as root in WSL, I tried making the container run in privileged mode, and to enable some specifics permissions and nothing worked, at least not in my combination of docker for windows + wsl2 docker backend

only running from the root in wsl allowed it to work correctly

[AntonKozlov]

Thanks for the all of the information! We'll look at the issue.

[wkia]

Hi,
For now as a workaround for the seccomp issue, you may want to use --security-opt seccomp=unconfined option when running a container.

[sbaldin]

One more thought.
I followed the article "How to Run a Java Application with CRaC in a Docker Container" with my home clean macbook and it works fine.
Looks like the initial issue was related with some kind of corporate policies.

[jempitman]

I have also had very similar output with the spring-boot example [https://github.com/CRaC/example-spring-boot/] using docker 4.19 running wsl2 backend (Windows 10 Pro).

My Dockerfile is slightly different:

FROM ubuntu:20.04

ENV JAVA_HOME /opt/jdk
ENV PATH $JAVA_HOME/bin:$PATH

RUN apt-get update -y

ADD "https://github.com/CRaC/openjdk-builds/releases/download/17-crac%2B5/openjdk-17-crac+5_linux-x64.tar.gz" $JAVA_HOME/openjdk.tar.gz
RUN cd /opt/; chmod +x $JAVA_HOME/openjdk.tar.gz; tar --extract --file $JAVA_HOME/openjdk.tar.gz --directory "$JAVA_HOME" --strip-components 1; rm $JAVA_HOME/openjdk.tar.gz;

RUN mkdir -p /opt/crac-files

COPY target/spring-boot-initial-0.0.1-SNAPSHOT.jar /opt/app/MY-APP.jar

The debugging guide recommends checking whether the SUID bit is set and the criu file is owned by the root user (which was mentioned in a comment to a similar issue yesterday), however when I run ls -la $JAVA_HOME/lib/criu in Powershell it seems (to me at least) that the permissions are correctly set according to the debugging guide:

After having set/ confirmed the SUID bit and criu ownership details I ran the application and attempted to create a checkpoint but ran into the same error:

the output of the dump4.log file is

(00.000408) Version: 3.17.1-crac (gitid 8926431+1)
(00.000428) Running on 2bf119adec35 Linux 5.10.102.1-microsoft-standard-WSL2 #1 SMP Wed Mar 2 00:30:59 UTC 2022 x86_64
(00.000436) File /run/criu.kdat does not exist
(00.000446) sockets: Probing sock diag modules
(00.000671) sockets: Done probing
(00.000746) Pagemap is fully functional
(00.000784) Found anon-shmem device at 1
(00.001288) Hugetlb size 2 Mb is supported but cannot get dev's number
(00.001316) Hugetlb size 1024 Mb is supported but cannot get dev's number
(00.001323) Reset 93's dirty tracking
(00.001350)  ... done
(00.001370) Dirty tracking support is OFF
(00.001451) Found task size of 7ffffffff000
(00.009964) Restoring netdev veth idx 10
(00.010937) Dumping netns links
(00.011472) 	LD: Got link 1, type 772
(00.011479) 	LD: Got link 2, type 768
(00.011480) 	LD: Got link 3, type 776
(00.011482) 	LD: Got link 10, type 1
(00.012104) vdso: Parsing at 7ffc7c0a2000 7ffc7c0a3000
(00.012112) vdso: PT_LOAD p_vaddr: 0
(00.012114) vdso: DT_HASH: 120
(00.012115) vdso: DT_STRTAB: 2d8
(00.012116) vdso: DT_SYMTAB: 1b8
(00.012118) vdso: DT_STRSZ: 72
(00.012119) vdso: DT_SYMENT: 18
(00.012120) vdso: nbucket 3 nchain c bucket 7ffc7c0a2128 chain 7ffc7c0a2134
(00.012124) vdso: rt [vdso] 7ffc7c0a2000-7ffc7c0a3000 [vvar] 7ffc7c09e000-7ffc7c0a2000
(00.012442) vdso: Parsing at 7fe099d6a000 7fe099d6c000
(00.012451) vdso: PT_LOAD p_vaddr: 0
(00.012453) vdso: DT_HASH: b4
(00.012454) vdso: DT_STRTAB: 1f0
(00.012455) vdso: DT_SYMTAB: 140
(00.012456) vdso: DT_STRSZ: c0
(00.012458) vdso: DT_SYMENT: 10
(00.012459) vdso: nbucket 3 nchain b bucket 7fe099d6a0bc chain 7fe099d6a0c8
(00.012461) vdso: compat [vdso] 7ffc7c0a6000-7ffc7c0a8000 [vvar] 7ffc7c0a2000-7ffc7c0a6000
(00.012701) cpu: x86_family 6 x86_vendor_id GenuineIntel x86_model_id Intel(R) Core(TM) i7-10750H CPU @ 2.60GHz
(00.012710) cpu: fpu: xfeatures_mask 0x5 xsave_size 832 xsave_size_max 832 xsaves_size 832
(00.012716) cpu: fpu: x87 floating point registers     xstate_offsets      0 / 0      xstate_sizes    160 / 160   
(00.012718) cpu: fpu: AVX registers                    xstate_offsets    576 / 576    xstate_sizes    256 / 256   
(00.013068) Warn  (criu/kerndat.c:1470): CRIU was built without libnftables support
(00.013296) No MOVE_MOUNT_SET_GROUP kernel feature
(00.013698) ptrace(PTRACE_GET_RSEQ_CONFIGURATION) is not supported
(00.013816) Found mmap_min_addr 0x10000
(00.013826) files stat: fs/nr_open 1048576
(00.013829) skip kerndat_save_cache
(00.013835) ========================================
(00.013837) Dumping processes (pid: 13)
(00.013838) ========================================
(00.013842) rlimit: RLIMIT_NOFILE unlimited for self
(00.013853) Running pre-dump scripts
(00.013898) irmap: Searching irmap cache in work dir
(00.013937) No irmap-cache image
(00.013942) irmap: Searching irmap cache in parent
(00.013975) No parent images directory provided
(00.013979) irmap: No irmap cache
(00.013983) cpu: fpu:1 fxsr:1 xsave:1 xsaveopt:1 xsavec:1 xgetbv1:1 xsaves:1
(00.014011) cg-prop: Parsing controller "cpu"
(00.014014) cg-prop: 	Strategy "replace"
(00.014017) cg-prop: 	Property "cpu.shares"
(00.014019) cg-prop: 	Property "cpu.cfs_period_us"
(00.014020) cg-prop: 	Property "cpu.cfs_quota_us"
(00.014021) cg-prop: 	Property "cpu.rt_period_us"
(00.014023) cg-prop: 	Property "cpu.rt_runtime_us"
(00.014024) cg-prop: Parsing controller "memory"
(00.014026) cg-prop: 	Strategy "replace"
(00.014027) cg-prop: 	Property "memory.limit_in_bytes"
(00.014029) cg-prop: 	Property "memory.memsw.limit_in_bytes"
(00.014030) cg-prop: 	Property "memory.swappiness"
(00.014032) cg-prop: 	Property "memory.soft_limit_in_bytes"
(00.014033) cg-prop: 	Property "memory.move_charge_at_immigrate"
(00.014034) cg-prop: 	Property "memory.oom_control"
(00.014036) cg-prop: 	Property "memory.use_hierarchy"
(00.014037) cg-prop: 	Property "memory.kmem.limit_in_bytes"
(00.014038) cg-prop: 	Property "memory.kmem.tcp.limit_in_bytes"
(00.014040) cg-prop: Parsing controller "cpuset"
(00.014041) cg-prop: 	Strategy "replace"
(00.014043) cg-prop: 	Property "cpuset.cpus"
(00.014044) cg-prop: 	Property "cpuset.mems"
(00.014051) cg-prop: 	Property "cpuset.memory_migrate"
(00.014054) cg-prop: 	Property "cpuset.cpu_exclusive"
(00.014055) cg-prop: 	Property "cpuset.mem_exclusive"
(00.014057) cg-prop: 	Property "cpuset.mem_hardwall"
(00.014058) cg-prop: 	Property "cpuset.memory_spread_page"
(00.014060) cg-prop: 	Property "cpuset.memory_spread_slab"
(00.014061) cg-prop: 	Property "cpuset.sched_load_balance"
(00.014062) cg-prop: 	Property "cpuset.sched_relax_domain_level"
(00.014064) cg-prop: Parsing controller "blkio"
(00.014065) cg-prop: 	Strategy "replace"
(00.014067) cg-prop: 	Property "blkio.weight"
(00.014068) cg-prop: Parsing controller "freezer"
(00.014069) cg-prop: 	Strategy "replace"
(00.014071) cg-prop: Parsing controller "perf_event"
(00.014072) cg-prop: 	Strategy "replace"
(00.014074) cg-prop: Parsing controller "net_cls"
(00.014075) cg-prop: 	Strategy "replace"
(00.014077) cg-prop: 	Property "net_cls.classid"
(00.014078) cg-prop: Parsing controller "net_prio"
(00.014079) cg-prop: 	Strategy "replace"
(00.014081) cg-prop: 	Property "net_prio.ifpriomap"
(00.014082) cg-prop: Parsing controller "pids"
(00.014084) cg-prop: 	Strategy "replace"
(00.014085) cg-prop: 	Property "pids.max"
(00.014086) cg-prop: Parsing controller "devices"
(00.014088) cg-prop: 	Strategy "replace"
(00.014089) cg-prop: 	Property "devices.list"
(00.014120) Preparing image inventory (version 1)
(00.014150) Add pid ns 1 pid 93
(00.014158) Add net ns 2 pid 93
(00.014201) Add ipc ns 3 pid 93
(00.014210) Add uts ns 4 pid 93
(00.014238) Add time ns 5 pid 93
(00.014287) Add mnt ns 6 pid 93
(00.014296) Add user ns 7 pid 93
(00.014301) Add cgroup ns 8 pid 93
(00.014303) cg: Dumping cgroups for 93
(00.014322) cg:  `- New css ID 1
(00.014325) cg:     `- [] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014326) cg:     `- [blkio] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014328) cg:     `- [cpu] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014329) cg:     `- [cpuacct] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014330) cg:     `- [cpuset] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014332) cg:     `- [devices] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014333) cg:     `- [freezer] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014334) cg:     `- [hugetlb] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014336) cg:     `- [memory] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014337) cg:     `- [name=systemd] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014338) cg:     `- [net_cls] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014339) cg:     `- [net_prio] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014341) cg:     `- [perf_event] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014342) cg:     `- [pids] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014343) cg:     `- [rdma] -> [/docker/2bf119adec35dc481f96236eb94291653ab8c38147bcc47a7b6b14a88b6360b2] [0]
(00.014345) cg: Set 1 is criu one
(00.014382) Detected cgroup V1 freezer
(00.014458) Error (compel/src/lib/ptrace.c:27): suspending seccomp failed: Operation not permitted
(00.014480) Unlock network
(00.014486) Unfreezing tasks into 1
(00.014488) 	Unseizing 13 into 1
(00.014490) Error (compel/src/lib/infect.c:356): Unable to detach from 13: No such process
(00.014501) Error (criu/cr-dump.c:2053): Dumping FAILED.

Could this issue be due to the chmod +x permissions for the jdk set in my Dockerfile?

Since commenting, I have managed to successfully create and restore from a checkpoint using CRaC on a hosted VM so, from my side at least, this thread can be considered closed. Bottom line is to work in a linux dev environment where you have full control.