CheckpointEdit
VETH is an interconnected pair of devices in two different network namespace. With CRIU, you can checkpoint a network namespace with an VETH device in it (called "inner" device) doesn't require any special options for CRIU. Upon checkpoint, information about the inner VETH device is saved to images, when this device dies (together with the containing namespace), and the other end (called "outer" device) dies instantly, too, for the lack of peer.
RestoreEdit
When you restore a net namespace with a VETH device end in it, CRIU creates a VETH pair automatically. By default, the outer device name is autogenerated by the kernel, which is not convenient. Option --external (or RPC equivalent field opts.external) can be used to set that name explicitly.
The syntax is --external veth[inner_dev]:outer_dev@bridge, with the @bridge part being optional. Here inner_dev is an "inner" VETH device name, and outer_dev is the "outer" VETH device name. If @bridge is specified, the outer_dev device is added to that bridge.
Obsoleted optionEdit
Option --veth-pair inner_dev=outer_dev[@bridge] (or corresponding RPC field opts.veths) was used in old versions of CRIU for the same effect as --external veth. This option is now obsolete and will be deprecated soon.