feat(chrek): config refactor, /dev/shm support, and mount-policy rewrite (#5946)

deploy/helm/charts/platform/components/operator/templates/deployment.yaml

@@ -151,8 +151,9 @@ spec:
           - --checkpoint-enabled=true
           - --checkpoint-storage-type={{ .Values.checkpoint.storage.type }}
           - --checkpoint-signal-host-path={{ .Values.checkpoint.storage.signalHostPath }}
-          - --checkpoint-criu-timeout={{ .Values.checkpoint.criu.timeout }}
           - --checkpoint-init-container-image={{ .Values.checkpoint.initContainerImage }}
+          - --checkpoint-ready-for-checkpoint-file-path={{ .Values.checkpoint.readyForCheckpointFilePath }}
+          - --checkpoint-restore-marker-file-path={{ .Values.checkpoint.restoreMarkerFilePath }}
           {{- if eq .Values.checkpoint.storage.type "pvc" }}
           - --checkpoint-pvc-name={{ .Values.checkpoint.storage.pvc.pvcName }}
           - --checkpoint-pvc-base-path={{ .Values.checkpoint.storage.pvc.basePath }}

deploy/helm/charts/platform/components/operator/values.yaml

@@ -157,6 +157,14 @@ checkpoint:
   # Defaults to busybox:latest if not specified
   initContainerImage: "busybox:latest"
 
+  # Path written by worker when model is loaded and ready for checkpointing
+  # Must match the path expected by checkpoint-enabled runtime images
+  readyForCheckpointFilePath: "/tmp/ready-for-checkpoint"
+
+  # Path written by restore-entrypoint after successful CRIU restore
+  # Must match the path expected by checkpoint-enabled runtime images
+  restoreMarkerFilePath: "/tmp/dynamo-restored"
+
   # Storage configuration
   # These settings tell the operator where to find checkpoint storage
   # Must match the configuration in the chrek chart
@@ -196,14 +204,6 @@ checkpoint:
       # Reference to a docker config secret for registry authentication
       credentialsSecretRef: ""
 
-  # CRIU timeout configuration (shared across checkpoint and restore)
-  criu:
-    # CRIU operation timeout in seconds
-    # Maximum time to wait for checkpoint/restore to complete
-    # Increase for models with very large memory footprints
-    # 21600s (6 hours) is recommended for large LLMs (70B+)
-    timeout: "21600"
-
 # Webhook configuration
 webhook:
   # Enable admission webhooks for validation
@@ -280,4 +280,3 @@ webhook:
 
         # Time before expiration to renew root CA (e.g., "720h" for 30 days)
         renewBefore: "720h"
-