This explains the meaning of external socket is used error message, and the purpose of --ext-unix-sk option.
Error meaning
When dumping a process sub-tree, criu checks that the resulting image is consistent and self-contained, meaning if an object A references another object B, and A goes into dump, then B should be dumped as well. For example, if there is a pipe, and criu dumps its one end (object A) because it belongs to a process it dumps, it must also dump the other end of the pipe (object B), meaning it should take a process owning B into the image as well. Same is true for unix sockets: if there is a socket (A) that is connect()ed to another socket (B), and criu dumps socket A (because it is opened by a process it dumps), it must also dump socket B and the task who owns it. Possibly socket B is dumped some time later in the dumping process, but it must be dumped.
This restriction is in place to make sure that upon restore applications will continue to work, rather than, say, receive SIGPIPE signals due to half-closed pipes or sockets.
With that said, "external socket is used" error means criu detected a unix socket connected to another socket which is not being dumped (because it belongs to a process not going into the image).
Using the option
However, sometimes it is possible to dump and successfully restore only one end of a unix socket pair. One particular example is the logd, a daemon which opens a datagram unix socket and waits on it for messages to be written into a log file. Processes using logd also create datagram unix sockets and connect those to the logd socket. These connections are thus uni-directional, meaning that the logd's socket remains unconnected. In this case it is possible to dump a program using logd as a client. For it to work after restore its socket needs to be reconnected back to logd using the logd's socket name.
This is when --ext-unix-sk option should be used. By providing this option (for both dump and restore commands), user states "I know there may be uni-directional unix connections, and I will make sure the server end will exist on restore".
For criu dump, this option enables dumping datagram unix sockets with additional information about that other ("external") socket it is connected to.
For criu restore, this option asks criu to re-connect such sockets back.