different results on two fedora systems from running podman container checkpoint --leave-running

[eriksjolund]

I tried a command similar to
sudo podman container checkpoint --export /tmp/export.tar.zst mycontainer --leave-running
that gives different result on two different systems (Fedora 42 and Fedora CoreOS 42.20250623.1.0)

system	container is running after checkpoint	export file is created
Fedora 42 (x86_64)	no	yes
Fedora CoreOS 42.20250623.1.0 (macbook pro M1)	yes	yes

(I'm not sure if my Fedora 42 (x86_64) is somehow misconfigured)

What is the expected result on Fedora 42 (x86_64), should the container still be running?

test script test.bash

#!/bin/bash
set -o errexit
set -o nounset

runtime=$1
loglevel=$2
name=$3
sleep=$4

dir=$(mktemp -d)
shift
shift
shift
shift
podman --runtime $runtime \
       run --rm -d --name $name docker.io/library/alpine sleep 3600;
sleep $sleep

echo before podman container ls
podman --runtime $runtime container ls --filter name=$name

echo before checkpoint
podman --log-level=$loglevel --runtime-flag=log-level=debug --runtime-flag=log-format=text \
       --runtime-flag=log=${dir}/crun.log --runtime $runtime \
       container checkpoint --export ${dir}/export.tar.zst $name "$@"

echo before podman container ls
podman --runtime $runtime container ls --filter name=$name
echo ${dir}/crun.log

Fedora 42 (x86_64)

root@asus:~# bash test.bash crun warn mycontainer1 2  --leave-running 
8f89c3b9e3f04103f9905b42e26c55784c36f331e656fa7ee14b0d4f8710718a
before podman container ls
CONTAINER ID  IMAGE                            COMMAND     CREATED        STATUS        PORTS       NAMES
8f89c3b9e3f0  docker.io/library/alpine:latest  sleep 3600  2 seconds ago  Up 2 seconds              mycontainer1
before checkpoint
mycontainer1
before podman container ls
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
/tmp/tmp.MVYbsCLBnv/crun.log
root@asus:~# cat /tmp/tmp.MVYbsCLBnv/crun.log
Using debug verbosity
Loading container from config file: `/run/crun/8f89c3b9e3f04103f9905b42e26c55784c36f331e656fa7ee14b0d4f8710718a/config.json`
root@asus:~# 

podman info

click me for output:

host:
  arch: amd64
  buildahVersion: 1.40.1
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - hugetlb
  - pids
  - rdma
  - misc
  - dmem
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.13-1.fc42.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.13, commit: '
  cpuUtilization:
    idlePercent: 99.96
    systemPercent: 0.03
    userPercent: 0.01
  cpus: 16
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    version: "42"
  eventLogger: journald
  freeLocks: 2048
  hostname: asus
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.15.4-200.fc42.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 6119735296
  memTotal: 7677263872
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.15.0-1.fc42.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.15.0
    package: netavark-1.15.2-1.fc42.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.15.2
  ociRuntime:
    name: crun
    package: crun-1.22-1.fc42.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.22
      commit: 4de19b63a85efd9ea8503452179c371181750130
      rundir: /run/user/0/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20250611.g0293c6f-1.fc42.x86_64
    version: |
      pasta 0^20250611.g0293c6f-1.fc42.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 7676620800
  swapTotal: 7676620800
  uptime: 5h 37m 1.00s (Approximately 0.21 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  configFile: /usr/share/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.additionalImageStores:
    - /usr/lib/containers/storage
    overlay.imagestore: /usr/lib/containers/storage
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 16001064960
  graphRootUsed: 9636749312
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 5.5.2
  BuildOrigin: Fedora Project
  Built: 1750723200
  BuiltTime: Tue Jun 24 02:00:00 2025
  GitCommit: e7d8226745ba07a64b7176a7f128e4ef53225a0e
  GoVersion: go1.24.4
  Os: linux
  OsArch: linux/amd64
  Version: 5.5.2

root@asus:~# rpm -qa | grep criu
criu-4.1-2.fc42.x86_64
criu-libs-4.1-2.fc42.x86_64

Fedora CoreOS 42.20250623.1.0 (macbook pro M1)

root@localhost:~# bash test.bash crun warn mycontainer2 1 --leave-running
7abbd5878ad08270132f9df81af8fb7e96790a36b0fe8198a7e5103362490930
before podman container ls
CONTAINER ID  IMAGE                            COMMAND     CREATED       STATUS        PORTS       NAMES
7abbd5878ad0  docker.io/library/alpine:latest  sleep 3600  1 second ago  Up 2 seconds              mycontainer2
before checkpoint
mycontainer2
before podman container ls
CONTAINER ID  IMAGE                            COMMAND     CREATED        STATUS        PORTS       NAMES
7abbd5878ad0  docker.io/library/alpine:latest  sleep 3600  2 seconds ago  Up 2 seconds              mycontainer2
/tmp/tmp.xrVzAy0gWa/crun.log
root@localhost:~# cat /tmp/tmp.xrVzAy0gWa/crun.log
Using debug verbosity
Loading container from config file: /run/crun/7abbd5878ad08270132f9df81af8fb7e96790a36b0fe8198a7e5103362490930/config.json

About the system:

Fedora CoreOS 42.20250623.1.0

root@localhost:~#  rpm -qa | grep criu
criu-4.1-2.fc42.aarch64
criu-libs-4.1-2.fc42.aarch64
root@localhost:~# 

rpm-ostree status

click me for output:

State: idle
AutomaticUpdatesDriver: Zincati
  DriverState: active; periodically polling for updates (last checked Thu 2025-07-03 18:15:52 UTC)
Deployments:
  ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:next
                   Digest: sha256:0552d19529f0c79e8178e98c348b0689eb71b53e9bcf00f53a39c635f154999e
                  Version: 42.20250623.1.0 (2025-06-23T21:59:13Z)
                     Diff: 6 upgraded, 2 added
          LayeredPackages: docker-buildkit docker-buildx docker-compose emacs-nox golang make

● ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:next
                   Digest: sha256:0552d19529f0c79e8178e98c348b0689eb71b53e9bcf00f53a39c635f154999e
                  Version: 42.20250623.1.0 (2025-06-23T21:59:13Z)
          LayeredPackages: docker-buildkit docker-buildx emacs-nox golang make
                 Unlocked: transient

  ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:next
                   Digest: sha256:7b2fc91f3d31584e5724262af45ce04867394f4e38f7843b3b4703b7a3dbb036
                  Version: 42.20250609.1.0 (2025-06-10T00:47:17Z)
          LayeredPackages: docker-buildkit docker-buildx emacs-nox golang make

podman info

click me for output:

host:
  arch: arm64
  buildahVersion: 1.40.1
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - pids
  - rdma
  - misc
  - dmem
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.13-1.fc42.aarch64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.13, commit: '
  cpuUtilization:
    idlePercent: 99.73
    systemPercent: 0.12
    userPercent: 0.15
  cpus: 2
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: coreos
    version: "42"
  eventLogger: journald
  freeLocks: 2046
  hostname: linux
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.14.11-300.fc42.aarch64
  linkmode: dynamic
  logDriver: journald
  memFree: 2362085376
  memTotal: 6182649856
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.15.0-1.fc42.aarch64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.15.0
    package: netavark-1.15.2-1.fc42.aarch64
    path: /usr/libexec/podman/netavark
    version: netavark 1.15.2
  ociRuntime:
    name: crun
    package: crun-1.21-1.fc42.aarch64
    path: /usr/bin/crun
    version: |-
      crun version 1.21
      commit: 10269840aa07fb7e6b7e1acff6198692d8ff5c88
      rundir: /run/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/sbin/pasta
    package: passt-0^20250611.g0293c6f-1.fc42.aarch64
    version: |
      pasta 0^20250611.g0293c6f-1.fc42.aarch64-pasta
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/sbin/slirp4netns
    package: slirp4netns-1.3.1-2.fc42.aarch64
    version: |-
      slirp4netns version 1.3.1
      commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236
      libslirp: 4.8.0
      SLIRP_CONFIG_VERSION_MAX: 5
      libseccomp: 2.5.5
  swapFree: 0
  swapTotal: 0
  uptime: 73h 39m 24.00s (Approximately 3.04 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  configFile: /usr/share/containers/storage.conf
  containerStore:
    number: 2
    paused: 0
    running: 2
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.additionalImageStores:
    - /usr/lib/containers/storage
    overlay.imagestore: /usr/lib/containers/storage
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 42344624128
  graphRootUsed: 39235317760
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 2
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 5.5.1
  BuildOrigin: Fedora Project
  Built: 1749081600
  BuiltTime: Thu Jun  5 00:00:00 2025
  GitCommit: 850db76dd78a0641eddb9ee19ee6f60d2c59bcfa
  GoVersion: go1.24.3
  Os: linux
  OsArch: linux/arm64
  Version: 5.5.1

[eriksjolund]

What is the expected result on Fedora 42 (x86_64), should the container still be running?

Maybe related

• Fedora rawhide: podman checkpoint e2e and system test failures crun#1770

(For me it does not matter if I change to using runc so I guess it fails because of the newer linux kernel)