containerd/containerd · error

checkpoint/restore requires at least CRIU %d, current versio

Error message

checkpoint/restore requires at least CRIU %d, current version is %d

What it means

doCheckCriu found CRIU but its version is lower than the minimum required (utils.PodCriuVersion), so checkpoint/restore is refused. Older CRIU lacks features the pod-level checkpoint implementation depends on.

Source

Thrown at internal/cri/server/container_checkpoint_linux.go:115

	return c.checkCriuErr
}

func (c *criService) doCheckCriu() error {
	if c.config.EnableCRIU != nil && !*c.config.EnableCRIU {
		return errors.New("criu support is disabled by configuration")
	}
	path := resolveCriuPath(c.shimPath)
	if path == "" {
		return errors.New("criu binary not found in shim path or system PATH")
	}
	client := criu.MakeCriu()
	client.SetCriuPath(path)
	version, err := client.GetCriuVersion()
	if err != nil {
		return fmt.Errorf("failed to retrieve criu version: %w", err)
	}
	if version < utils.PodCriuVersion {
		return fmt.Errorf("checkpoint/restore requires at least CRIU %d, current version is %d", utils.PodCriuVersion, version)
	}
	return nil
}

func resolveCriuPath(customPath string) string {
	if customPath != "" {
		// This logic is Linux-specific. If CRIU is ever supported on other
		// operating systems, path lookup will need to respect that OS's
		// conventions.
		for _, dir := range filepath.SplitList(customPath) {
			if !filepath.IsAbs(dir) {
				continue
			}
			criuPath := filepath.Join(dir, "criu")
			if fi, err := os.Stat(criuPath); err == nil && fi.Mode().IsRegular() && fi.Mode()&0111 != 0 {
				return criuPath
			}
		}

View on GitHub (pinned to 4246446a2b)

Solutions

1. Upgrade CRIU to at least the required version (per the error message) via the package manager or upstream release
2. Remove/rename the outdated criu binary in the shim path so resolveCriuPath picks the newer system one
3. If upgrade is impossible, disable checkpoint/restore features on that node
4. Verify with `criu --version` that the resolved binary meets the minimum

Example fix

// before
$ criu --version
Version: 3.12   # below minimum
// after
$ apt-get install -y criu && criu --version
Version: 3.17.1

out, err := exec.Command(criuPath, "--version").Output()
if err != nil { return err }
v, err := parseCriuVersion(string(out))
if err != nil { return err }
if v < utils.PodCriuVersion {
    return fmt.Errorf("need criu >= %d, got %d", utils.PodCriuVersion, v)
}

if err := checkCriu(); err != nil && strings.Contains(err.Error(), "requires at least CRIU") {
    // parse required/current versions from the message and upgrade
}

When it happens

Trigger: CheckpointContainer invoked on a node with CRIU older than the required minimum; distro ships an outdated criu package; manually installed CRIU in the shim path is an old build picked by resolveCriuPath before the system PATH one.

Common situations: Older LTS distro with an ancient criu package; someone dropped a legacy criu binary next to the shim; kernel/CRIU mismatch after node upgrade.

Related errors

• failed to retrieve criu version: %w
• refusing to copy %s: not a regular file
• failed to checkpoint container %q: %w
• container %q is in %s state. only %s containers can be check
• checkpointing container %q failed: %w

AI-assisted analysis of containerd/containerd@4246446a2b (2026-09-02). Data as JSON: /api/errors/1ab0d8c7d457df1e. Report an issue: GitHub.