restore puts processes in wrong cgroup

[hanwen-flow]

See checkpoint-restore/criu#2577

in this example, we have a container with a dummy entrypoint (a python3 http.server) to keep the container alive while other commands run in it. The command we run in it is a daemonized Java server. Checkpointing and restoring works OK, but the restored container is incorrect, because it cannot be checkpointed again.

@adrianreber clarifies:

Try runc instead of crun. crun has a bug that only the first process of the container is put in the correct cgroup after restore.

If I remember it correctly the difference is that runc move the CRIU binary in the correct cgroup and runs it there, crun creates the container and moves only one PID into the container after restore. So either crun must walk the process tree and move all PIDs into the right cgroup or create a helper process that is moved into the cgroup that calls CRIU. Something like that.