What were you trying to do that didn't work?

Please provide the package NVR for which bug is seen:

1. rpm -q kernel podman criu
   kernel-5.14.0-436.el9.x86_64
   podman-5.0.0-1.el9.x86_64
   criu-3.19-1.el9.x86_64
2. cat /proc/cmdline
   BOOT_IMAGE=(hd0,msdos1)/vmlinuz-5.14.0-436.el9.x86_64 root=/dev/mapper/rhel_hp-dl380g1001vm02-root ro crashkernel=1G-4G:192M,4G-64G:256M,64G:512M resume=/dev/mapper/rhel_hp-dl380g1001vm-02-swap rd.lvm.lv=rhel_hp-dl380g10-01-vm-02/root rd.lvm.lv=rhel_hp-dl380g10-01-vm-02/swap console=ttyS0,115200 systemd.unified_cgroup_hierarchy=0

How reproducible:

100%

Steps to reproduce

1. cat repo.sh
   #!/bin/bash
   set -x
   podman pull ubi8
   podman ps -a
   podman run -d ubi8 sleep 300
   podman ps -a
   podman container checkpoint -l
   podman ps -a
   podman container restore -l

Expected results

Actual results

1. ./repo.sh
   + podman pull ubi8
   Trying to pull registry.access.redhat.com/ubi8:latest...
   Getting image source signatures
   Checking if image destination supports signatures
   Copying blob 2efec45cd878 skipped: already exists
   Copying config c70d72aaeb done |
   Writing manifest to image destination
   Storing signatures
   c70d72aaebb4563c57b5d3d1e72cdfdac5bdc32ad8255f1cb1365e1850b91d92
   + podman ps -a
   CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
   + podman run -d ubi8 sleep 300
   0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944
   + podman ps -a
   CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
   0390f23f830e registry.access.redhat.com/ubi8:latest sleep 300 Less than a second ago Up Less than a second optimistic_davinci
   + podman container checkpoint -l
   0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944
   + let ret=0
   + podman ps -a
   CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
   0390f23f830e registry.access.redhat.com/ubi8:latest sleep 300 Less than a second ago Exited (0) Less than a second ago optimistic_davinci
   + podman container restore -l
   Error: OCI runtime error: crun: CRIU restoring failed -52. Please check CRIU logfile `/var/lib/containers/storage/overlay-containers/0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944/userdata/restore.log`
   + let ret+=125
   + exit 125
2. grep Error /var/lib/containers/storage/overlay-containers/0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944/userdata/restore.log
   (00.002399) Error (criu/cgroup.c:1485): cg: Failed writing 0 to cpuset/machine.slice/libpod-0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944.scope/container/cpuset.mems: Permission denied
   (00.002406) Error (criu/cgroup.c:1751): cg: Restoring cpuset.mems special property failed
   (00.002408) Error (criu/cgroup.c:1810): cg: Restoring special cpuset props failed!
   [root@hp-dl380g10-01-vm-02 ~]# cat /sys/fs/cgroup/cpuset/machine.slice/libpod-0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944.scope/cpuset.mems

[root@hp-dl380g10-01-vm-02 ~]# echo 0 > /sys/fs/cgroup/cpuset/machine.slice/libpod-0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944.scope/container/cpuset.mems
-bash: echo: write error: Permission denied
[root@hp-dl380g10-01-vm-02 ~]# echo 0 > /sys/fs/cgroup/cpuset/machine.slice/libpod-0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944.scope/cpuset.mems
[root@hp-dl380g10-01-vm-02 ~]# echo 0 > /sys/fs/cgroup/cpuset/machine.slice/libpod-0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944.scope/container/cpuset.mems
[root@hp-dl380g10-01-vm-02 ~]# cat /sys/fs/cgroup/cpuset/machine.slice/libpod-0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944.scope/container/cpuset.mems
0
[root@hp-dl380g10-01-vm-02 ~]# cat /sys/fs/cgroup/cpuset/machine.slice/libpod-0390f23f830e850287d702184ffa3a6db42faa37721bdc60625d0490265e5944.scope/cpuset.mems
0