Unprivileged Mode (non-root)

By default, the checkpointing and restoring of a SLURM job is done as root. Root user has all the capabilities required for performing a complete checkpoint/restore of a process. This is often though an issue for SLURM sysadmins depending on the installation site.

To address this, Cedana supports unprivileged mode, where the checkpointing and restoring are done as the job's user, i.e., the UID of the SLURM job performs the checkpoint and restore. This configuration is useful when the root is demoted for security purposes. For example, NFS with root_squash requires unprivileged mode.

To enable unprivileged mode, set Slurm.Unprivileged to true in the Cedana Daemon configuration on all the compute/worker nodes. Otherwise, just do this on each compute/worker node:

export CEDANA_SLURM_UNPRIVILEGED=true

sudo cedana version --merge-config

In addition, the criu binary must have the right capabilities set. There are two ways to go about this:

• sudo setcap cap_sys_ptrace,cap_checkpoint_restore=eip "$(command -v criu)" , which sets cap_sys_ptrace and cap_checkpoint_restore on the criu binary.

• Setting only cap_checkpoint_restore , which would require setting an additional kernel configuration

The recommended configuration is the former.