scripts: add criu-move-mount and runc-action-add-mounts for restore-time bind mounts

[wangixt]

What

Add support for adding new bind mounts into a container's mount namespace during CRIU restore, using the Linux 5.2+ new mount API (open_tree(OPEN_TREE_CLONE) + move_mount()).

How

Two new files are introduced in scripts/:

criu-move-mount.c

A C program that handles the complete workflow:

• Phase filtering: only acts during the pre-resume CRIU action phase (mount tree is restored, processes not yet resumed)
• Mount rule parsing: reads the CRIU_ADD_MOUNTS environment variable containing semicolon-separated mount rules
• Cross-namespace mounts: for each rule, performs:
  1. open_tree(src, OPEN_TREE_CLONE) in the host mount namespace to clone the source mount
  2. setns(container_mntns) to switch to the container's mount namespace
  3. move_mount(treefd -> dst) to attach the cloned mount inside the container
  4. Optional remount(MS_RDONLY) for read-only mounts
• Multiple mounts: handles multiple rules in a single invocation by saving the host mount namespace fd and switching back before each new mount
• Debug logging: logs every step to /tmp/criu-move-mount.log by default (configurable via CRIU_MOVE_MOUNT_LOG, set to "" to disable)
• Error tolerance: individual mount failures are logged but do not cause a non-zero exit, matching the original shell script's || true behaviour

runc-action-add-mounts.sh

A thin wrapper script designed to be passed to CRIU as --action-script. It locates and execs the criu-move-mount binary. All logic resides in the C program.

Mount rule format

Rules are specified exclusively via the CRIU_ADD_MOUNTS environment variable:

CRIU_ADD_MOUNTS="src=/host/path,dst=/container/path[,options=rbind:ro];..."

Example:

CRIU_ADD_MOUNTS="src=/home/b,dst=/home/b,options=rbind:rw;src=/data,dst=/data,options=rbind:ro"

Debugging

Check /tmp/criu-move-mount.log (or the path set via CRIU_MOVE_MOUNT_LOG) for detailed logs including:

• Which CRIU action phase was invoked
• The parsed PID and mount rules
• Each mount attempt with success/failure and errno details

Usage

# Compile
gcc -O2 -o criu-move-mount criu-move-mount.c

# Restore with additional mounts
CRIU_ADD_MOUNTS="src=/home/b,dst=/home/b,options=rbind:rw" \
  criu restore --action-script /path/to/runc-action-add-mounts.sh

  

[wangixt]

add mount