[Feat/Kernel]: Implement eBPF-Driven Zero-Copy Process Memory Snipping to Bypass Heavy CRIU Disk Serialization

Problem

Traditional low-level container runtimes utilizing RunC with CRIU (Checkpoint/Restore in Userspace) handle process state capture by frozen memory pools and writing raw execution state trees down to high-latency local disk sub-systems as unaligned image files. At massive infrastructure scale, this thick filesystem interaction serialization layer spikes restoration delays beyond 100ms, triggering packet drops across active multi-tenant ingress nodes.

Proposed Solution

Develop a high-performance Shared-Memory Page Snipping Engine inside cmd/daemon/page_snipper.c leveraging native kernel eBPF memory rings mapping structures.

• Track active process memory offsets and runtime registers dynamically using compiled eBPF context tracepoints hooks.
• Instead of executing full binary state snapshots arrays extraction down to the local disk, snipe only volatile execution delta arrays directly inside RAM memory registers.
• Synchronize snapshot pointers asynchronously down to healthy remote container nodes using contiguous shared memory blocks, executing state restoration operations under < 1 millisecond.

Alternatives

• Storing process dumps inside sharded key-value arrays like external Redis cluster setups, which reduces disk constraints but bounds performance parameters to standard Layer 7 connection speeds.

Use Case

Eliminates storage layer context tracking lags from container migrations, transforming FaultPlane into an unshakeable platform capable of executing zero-downtime hot-swaps on bare-metal systems seamlessly.

Additional Notes

All pointer synchronization offsets must follow the atomic alignment and memory padding dimensions specified under issue #6 definitions layouts.

Start with cmd/daemon/page_snipper.c and the pointer-alignment and padding definitions referenced in issue #6. Review the existing daemon and kernel integration points before determining how process offsets, registers, shared-memory synchronization, and restoration fit together. Done means the proposed eBPF-driven zero-copy snapshot path supports the stated sub-millisecond restoration target without full disk serialization.