By default, CRIU can not checkpoint a mount namespace with some real block devices mounted inside. This is done because the block device is an external resource, it can not be available during restore, or its identification (minor:major or name) can be different.
To checkpointe/restore this setup, using the --external dev option (or an equivalent RPC field opts.external).
Dump
On dump, if an external mount device is found, CRIU rejects the dump with an error message that external mount devices are not allowed.
To resolve this, one need to explicitly tell CRIU to allow it. The syntax is:
criu dump ... --external dev[minor/major]:name
This means to allow checkpoint of mount(s) for device identified by minor and major numbers pair. CRIU saves the device to images under a specified name, which is to be used upon restore.
Restore
To restore an image with block devices mounted inside a mount namespace, one needs to also use --external dev. The syntax is:
criu restore ... --external dev[name]:/dev/path
This means that a block device, saved to an image under name, is to be restored using the real device identified by /dev/path.