diff --git a/Dockerfile b/Dockerfile
index 0e58df106531b..22294606cca1f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,9 +32,11 @@ RUN	echo deb http://ppa.launchpad.net/zfs-native/stable/ubuntu trusty main > /et
 # Packaged dependencies
 RUN apt-get update && apt-get install -y \
 	apparmor \
+	asciidoc \
 	aufs-tools \
 	automake \
 	bash-completion \
+	bsdmainutils \
 	btrfs-tools \
 	build-essential \
 	createrepo \
@@ -43,19 +45,28 @@ RUN apt-get update && apt-get install -y \
 	gcc-mingw-w64 \
 	git \
 	iptables \
+	libaio-dev \
 	libapparmor-dev \
 	libcap-dev \
+	libprotobuf-c0-dev \
+	libprotobuf-dev	\
 	libsqlite3-dev \
 	mercurial \
 	parallel \
+	pkg-config \
+	protobuf-compiler \
+	protobuf-c-compiler \
+	python-minimal \
 	python-mock \
 	python-pip \
+	python-protobuf \
 	python-websocket \
 	reprepro \
 	ruby1.9.1 \
 	ruby1.9.1-dev \
 	s3cmd=1.1.0* \
 	ubuntu-zfs \
+	xmlto \
 	libzfs-dev \
 	--no-install-recommends
 
@@ -80,6 +91,13 @@ RUN cd /usr/src/lxc \
 	&& make install \
 	&& ldconfig
 
+# Install Criu
+RUN mkdir -p /usr/src/criu \
+	&& curl -sSL https://github.com/xemul/criu/archive/v1.6.tar.gz | tar -v -C /usr/src/criu/ -xz --strip-components=1
+RUN cd /usr/src/criu \
+	&& make \
+	&& make install
+
 # Install Go
 ENV GO_VERSION 1.4.2
 RUN curl -sSL https://golang.org/dl/go${GO_VERSION}.src.tar.gz | tar -v -C /usr/local -xz \
diff --git a/api/client/checkpoint.go b/api/client/checkpoint.go
new file mode 100644
index 0000000000000..5edaf7facffb0
--- /dev/null
+++ b/api/client/checkpoint.go
@@ -0,0 +1,54 @@
+// +build experimental
+
+package client
+
+import (
+	"fmt"
+
+	Cli "github.com/docker/docker/cli"
+	flag "github.com/docker/docker/pkg/mflag"
+	"github.com/docker/docker/runconfig"
+)
+
+func (cli *DockerCli) CmdCheckpoint(args ...string) error {
+	cmd := Cli.Subcmd("checkpoint", []string{"CONTAINER [CONTAINER...]"}, "Checkpoint one or more running containers", true)
+	cmd.Require(flag.Min, 1)
+
+	var (
+		flImgDir       = cmd.String([]string{"-image-dir"}, "", "directory for storing checkpoint image files")
+		flWorkDir      = cmd.String([]string{"-work-dir"}, "", "directory for storing log file")
+		flLeaveRunning = cmd.Bool([]string{"-leave-running"}, false, "leave the container running after checkpoint")
+		flShell        = cmd.Bool([]string{"-allow-shell"}, false, "allow checkpointing shell jobs")
+	)
+
+	if err := cmd.ParseFlags(args, true); err != nil {
+		return err
+	}
+
+	if cmd.NArg() < 1 {
+		cmd.Usage()
+		return nil
+	}
+
+	criuOpts := &runconfig.CriuConfig{
+		ImagesDirectory:         *flImgDir,
+		WorkDirectory:           *flWorkDir,
+		LeaveRunning:            *flLeaveRunning,
+		ShellJob:                *flShell,
+		TcpEstablished:          true,
+		ExternalUnixConnections: true,
+		FileLocks:               true,
+	}
+
+	var encounteredError error
+	for _, name := range cmd.Args() {
+		_, _, err := readBody(cli.call("POST", "/containers/"+name+"/checkpoint", criuOpts, nil))
+		if err != nil {
+			fmt.Fprintf(cli.err, "%s\n", err)
+			encounteredError = fmt.Errorf("Error: failed to checkpoint one or more containers")
+		} else {
+			fmt.Fprintf(cli.out, "%s\n", name)
+		}
+	}
+	return encounteredError
+}
diff --git a/api/client/restore.go b/api/client/restore.go
new file mode 100644
index 0000000000000..32b010060f1f1
--- /dev/null
+++ b/api/client/restore.go
@@ -0,0 +1,56 @@
+// +build experimental
+
+package client
+
+import (
+	"fmt"
+
+	Cli "github.com/docker/docker/cli"
+	flag "github.com/docker/docker/pkg/mflag"
+	"github.com/docker/docker/runconfig"
+)
+
+func (cli *DockerCli) CmdRestore(args ...string) error {
+	cmd := Cli.Subcmd("restore", []string{"CONTAINER [CONTAINER...]"}, "Restore one or more checkpointed containers", true)
+	cmd.Require(flag.Min, 1)
+
+	var (
+		flImgDir  = cmd.String([]string{"-image-dir"}, "", "directory to restore image files from")
+		flWorkDir = cmd.String([]string{"-work-dir"}, "", "directory for restore log")
+		flForce   = cmd.Bool([]string{"-force"}, false, "bypass checks for current container state")
+		flShell   = cmd.Bool([]string{"-allow-shell"}, false, "allow restoring shell jobs")
+	)
+
+	if err := cmd.ParseFlags(args, true); err != nil {
+		return err
+	}
+
+	if cmd.NArg() < 1 {
+		cmd.Usage()
+		return nil
+	}
+
+	restoreOpts := &runconfig.RestoreConfig{
+		CriuOpts: runconfig.CriuConfig{
+			ImagesDirectory:         *flImgDir,
+			WorkDirectory:           *flWorkDir,
+			ShellJob:                *flShell,
+			TcpEstablished:          true,
+			ExternalUnixConnections: true,
+			FileLocks:               true,
+		},
+		ForceRestore: *flForce,
+	}
+
+	var encounteredError error
+	for _, name := range cmd.Args() {
+		_, _, err := readBody(cli.call("POST", "/containers/"+name+"/restore", restoreOpts, nil))
+		if err != nil {
+			fmt.Fprintf(cli.err, "%s\n", err)
+			encounteredError = fmt.Errorf("Error: failed to restore one or more containers")
+		} else {
+			fmt.Fprintf(cli.out, "%s\n", name)
+		}
+	}
+	return encounteredError
+}
diff --git a/api/server/server.go b/api/server/server.go
index ec2f00cbf268f..dfac3d00558a3 100644
--- a/api/server/server.go
+++ b/api/server/server.go
@@ -215,6 +215,7 @@ func httpError(w http.ResponseWriter, err error) {
 // json encoding.
 func writeJSON(w http.ResponseWriter, code int, v interface{}) error {
 	w.Header().Set("Content-Type", "application/json")
+
 	w.WriteHeader(code)
 	return json.NewEncoder(w).Encode(v)
 }
@@ -369,6 +370,8 @@ func createRouter(s *Server) *mux.Router {
 		},
 	}
 
+	addExperimentalRoutes(s, m)
+
 	// If "api-cors-header" is not given, but "api-enable-cors" is true, we set cors to "*"
 	// otherwise, all head values will be passed to HTTP handler
 	corsHeaders := s.cfg.CorsHeaders
diff --git a/api/server/server_experimental_unix.go b/api/server/server_experimental_unix.go
index 20b3292cc6881..d41f6b0413235 100644
--- a/api/server/server_experimental_unix.go
+++ b/api/server/server_experimental_unix.go
@@ -2,6 +2,19 @@
 
 package server
 
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/docker/docker/pkg/version"
+	"github.com/docker/docker/runconfig"
+	"net/http"
+)
+
+func addExperimentalRoutes(s *Server, m map[string]map[string]HTTPAPIFunc) {
+	m["POST"]["/containers/{name:.*}/checkpoint"] = s.postContainersCheckpoint
+	m["POST"]["/containers/{name:.*}/restore"] = s.postContainersRestore
+}
+
 func (s *Server) registerSubRouter() {
 	httpHandler := s.daemon.NetworkAPIRouter()
 
@@ -15,3 +28,45 @@ func (s *Server) registerSubRouter() {
 	subrouter = s.router.PathPrefix("/services").Subrouter()
 	subrouter.Methods("GET", "POST", "PUT", "DELETE").HandlerFunc(httpHandler)
 }
+
+func (s *Server) postContainersCheckpoint(version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	if vars == nil {
+		return fmt.Errorf("Missing parameter")
+	}
+	if err := parseForm(r); err != nil {
+		return err
+	}
+
+	criuOpts := &runconfig.CriuConfig{}
+	if err := json.NewDecoder(r.Body).Decode(criuOpts); err != nil {
+		return err
+	}
+
+	if err := s.daemon.ContainerCheckpoint(vars["name"], criuOpts); err != nil {
+		return err
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+	return nil
+}
+
+func (s *Server) postContainersRestore(version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	if vars == nil {
+		return fmt.Errorf("Missing parameter")
+	}
+	if err := parseForm(r); err != nil {
+		return err
+	}
+
+	restoreOpts := runconfig.RestoreConfig{}
+	if err := json.NewDecoder(r.Body).Decode(&restoreOpts); err != nil {
+		return err
+	}
+
+	if err := s.daemon.ContainerRestore(vars["name"], &restoreOpts.CriuOpts, restoreOpts.ForceRestore); err != nil {
+		return err
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+	return nil
+}
diff --git a/api/server/server_stub.go b/api/server/server_stub.go
index cae28493836f4..6d93d21626dd1 100644
--- a/api/server/server_stub.go
+++ b/api/server/server_stub.go
@@ -2,5 +2,9 @@
 
 package server
 
+func addExperimentalRoutes(s *Server, m map[string]map[string]HTTPAPIFunc) {
+
+}
+
 func (s *Server) registerSubRouter() {
 }
diff --git a/api/types/types.go b/api/types/types.go
index 66c3f820780ca..fcdaf776491dc 100644
--- a/api/types/types.go
+++ b/api/types/types.go
@@ -227,17 +227,19 @@ type ExecStartCheck struct {
 // ContainerState stores container's running state
 // it's part of ContainerJSONBase and will return by "inspect" command
 type ContainerState struct {
-	Status     string
-	Running    bool
-	Paused     bool
-	Restarting bool
-	OOMKilled  bool
-	Dead       bool
-	Pid        int
-	ExitCode   int
-	Error      string
-	StartedAt  string
-	FinishedAt string
+	Status         string
+	Running        bool
+	Paused         bool
+	Checkpointed   bool
+	Restarting     bool
+	OOMKilled      bool
+	Dead           bool
+	Pid            int
+	ExitCode       int
+	Error          string
+	StartedAt      string
+	FinishedAt     string
+	CheckpointedAt string `json:"-"`
 }
 
 // ContainerJSONBase contains response of Remote API:
diff --git a/daemon/checkpoint.go b/daemon/checkpoint.go
new file mode 100644
index 0000000000000..6842b2ae58a9e
--- /dev/null
+++ b/daemon/checkpoint.go
@@ -0,0 +1,56 @@
+package daemon
+
+import (
+	"fmt"
+
+	"github.com/docker/docker/runconfig"
+)
+
+// Checkpoint a running container.
+func (daemon *Daemon) ContainerCheckpoint(name string, opts *runconfig.CriuConfig) error {
+	container, err := daemon.Get(name)
+	if err != nil {
+		return err
+	}
+	if !container.IsRunning() {
+		return fmt.Errorf("Container %s not running", name)
+	}
+	if err := container.Checkpoint(opts); err != nil {
+		return fmt.Errorf("Cannot checkpoint container %s: %s", name, err)
+	}
+
+	container.logEvent("checkpoint")
+	return nil
+}
+
+// Restore a checkpointed container.
+func (daemon *Daemon) ContainerRestore(name string, opts *runconfig.CriuConfig, forceRestore bool) error {
+	container, err := daemon.Get(name)
+	if err != nil {
+		return err
+	}
+
+	if !forceRestore {
+		// TODO: It's possible we only want to bypass the checkpointed check,
+		// I'm not sure how this will work if the container is already running
+		if container.IsRunning() {
+			return fmt.Errorf("Container %s already running", name)
+		}
+
+		if !container.IsCheckpointed() {
+			return fmt.Errorf("Container %s is not checkpointed", name)
+		}
+	} else {
+		if !container.HasBeenCheckpointed() && opts.ImagesDirectory == "" {
+			return fmt.Errorf("You must specify an image directory to restore from %s", name)
+		}
+	}
+
+	if err = container.Restore(opts, forceRestore); err != nil {
+		container.logEvent("die")
+		return fmt.Errorf("Cannot restore container %s: %s", name, err)
+	}
+
+	container.logEvent("restore")
+	return nil
+}
diff --git a/daemon/container.go b/daemon/container.go
index 0f4b81021d092..6c31379a5b65f 100644
--- a/daemon/container.go
+++ b/daemon/container.go
@@ -282,7 +282,7 @@ func (container *Container) Start() (err error) {
 	// backwards API compatibility.
 	container.hostConfig = runconfig.SetDefaultNetModeIfBlank(container.hostConfig)
 
-	if err := container.initializeNetworking(); err != nil {
+	if err := container.initializeNetworking(false); err != nil {
 		return err
 	}
 	linkedEnv, err := container.setupLinkedContainers()
@@ -357,7 +357,11 @@ func (container *Container) isNetworkAllocated() bool {
 // cleanup releases any network resources allocated to the container along with any rules
 // around how containers are linked together.  It also unmounts the container's root filesystem.
 func (container *Container) cleanup() {
-	container.releaseNetwork()
+	if container.IsCheckpointed() {
+		logrus.Debugf("not calling ReleaseNetwork() for checkpointed container %s", container.ID)
+	} else {
+		container.releaseNetwork(false)
+	}
 
 	if err := container.Unmount(); err != nil {
 		logrus.Errorf("%v: Failed to umount filesystem: %v", container.ID, err)
diff --git a/daemon/container_checkpoint.go b/daemon/container_checkpoint.go
new file mode 100644
index 0000000000000..9a75022da7f16
--- /dev/null
+++ b/daemon/container_checkpoint.go
@@ -0,0 +1,115 @@
+package daemon
+
+import (
+	"fmt"
+
+	"github.com/docker/docker/pkg/promise"
+	"github.com/docker/docker/runconfig"
+
+	"github.com/docker/libnetwork/netutils"
+)
+
+func (container *Container) Checkpoint(opts *runconfig.CriuConfig) error {
+	if err := container.daemon.Checkpoint(container, opts); err != nil {
+		return err
+	}
+
+	if opts.LeaveRunning == false {
+		container.releaseNetwork(true)
+	}
+
+	if err := container.toDisk(); err != nil {
+		return fmt.Errorf("Cannot update config for container: %s", err)
+	}
+
+	return nil
+}
+
+func (container *Container) Restore(opts *runconfig.CriuConfig, forceRestore bool) error {
+	var err error
+	container.Lock()
+	defer container.Unlock()
+
+	defer func() {
+		if err != nil {
+			container.setError(err)
+			// if no one else has set it, make sure we don't leave it at zero
+			if container.ExitCode == 0 {
+				container.ExitCode = 128
+			}
+			container.toDisk()
+			container.cleanup()
+		}
+	}()
+
+	if err := container.Mount(); err != nil {
+		return err
+	}
+	if err = container.initializeNetworking(true); err != nil {
+		return err
+	}
+
+	nctl := container.daemon.netController
+	network, err := nctl.NetworkByID(container.NetworkSettings.NetworkID)
+	if err != nil {
+		return err
+	}
+
+	ep_t, err := network.EndpointByID(container.NetworkSettings.EndpointID)
+	if err != nil {
+		return err
+	}
+
+	for _, i := range ep_t.SandboxInterfaces() {
+		outname, err := netutils.GenerateIfaceName("veth", 7)
+		if err != nil {
+			return err
+		}
+		vethpair := runconfig.VethPairName{
+			InName:  i.DstName(),
+			OutName: outname,
+		}
+		opts.VethPairs = append(opts.VethPairs, vethpair)
+	}
+
+	linkedEnv, err := container.setupLinkedContainers()
+	if err != nil {
+		return err
+	}
+	if err = container.setupWorkingDirectory(); err != nil {
+		return err
+	}
+
+	env := container.createDaemonEnvironment(linkedEnv)
+	if err = populateCommand(container, env); err != nil {
+		return err
+	}
+
+	mounts, err := container.setupMounts()
+	if err != nil {
+		return err
+	}
+
+	container.command.Mounts = mounts
+	return container.waitForRestore(opts, forceRestore)
+}
+
+func (container *Container) waitForRestore(opts *runconfig.CriuConfig, forceRestore bool) error {
+	container.monitor = newContainerMonitor(container, container.hostConfig.RestartPolicy)
+
+	// After calling promise.Go() we'll have two goroutines:
+	// - The current goroutine that will block in the select
+	//   below until restore is done.
+	// - A new goroutine that will restore the container and
+	//   wait for it to exit.
+	select {
+	case <-container.monitor.restoreSignal:
+		if container.ExitCode != 0 {
+			return fmt.Errorf("restore process failed")
+		}
+	case err := <-promise.Go(func() error { return container.monitor.Restore(opts, forceRestore) }):
+		return err
+	}
+
+	return nil
+}
diff --git a/daemon/container_unix.go b/daemon/container_unix.go
index a98acd4f3cf25..b937d87073ad4 100644
--- a/daemon/container_unix.go
+++ b/daemon/container_unix.go
@@ -328,7 +328,7 @@ func mergeDevices(defaultDevices, userDevices []*configs.Device) []*configs.Devi
 	return append(devs, userDevices...)
 }
 
-// GetSize returns the real size & virtual size of the container.
+// GetSize, return real size, virtual size
 func (container *Container) getSize() (int64, int64) {
 	var (
 		sizeRw, sizeRootfs int64
@@ -690,7 +690,7 @@ func (container *Container) updateNetwork() error {
 	return nil
 }
 
-func (container *Container) buildCreateEndpointOptions() ([]libnetwork.EndpointOption, error) {
+func (container *Container) buildCreateEndpointOptions(restoring bool) ([]libnetwork.EndpointOption, error) {
 	var (
 		portSpecs     = make(nat.PortSet)
 		bindings      = make(nat.PortMap)
@@ -770,6 +770,14 @@ func (container *Container) buildCreateEndpointOptions() ([]libnetwork.EndpointO
 		createOptions = append(createOptions, libnetwork.EndpointOptionGeneric(genericOption))
 	}
 
+	/*if restoring && container.NetworkSettings.IPAddress != "" {
+		genericOption := options.Generic{
+			netlabel.IPAddress: net.ParseIP(container.NetworkSettings.IPAddress),
+		}
+
+		createOptions = append(createOptions, libnetwork.EndpointOptionGeneric(genericOption))
+	}*/
+
 	return createOptions, nil
 }
 
@@ -823,7 +831,7 @@ func (container *Container) secondaryNetworkRequired(primaryNetworkType string)
 	return false
 }
 
-func (container *Container) allocateNetwork() error {
+func (container *Container) allocateNetwork(isRestoring bool) error {
 	mode := container.hostConfig.NetworkMode
 	controller := container.daemon.netController
 	if container.Config.NetworkDisabled || mode.IsContainer() {
@@ -859,19 +867,19 @@ func (container *Container) allocateNetwork() error {
 
 	if container.secondaryNetworkRequired(networkDriver) {
 		// Configure Bridge as secondary network for port binding purposes
-		if err := container.configureNetwork("bridge", service, "bridge", false); err != nil {
+		if err := container.configureNetwork("bridge", service, "bridge", false, isRestoring); err != nil {
 			return err
 		}
 	}
 
-	if err := container.configureNetwork(networkName, service, networkDriver, mode.IsDefault()); err != nil {
+	if err := container.configureNetwork(networkName, service, networkDriver, mode.IsDefault(), isRestoring); err != nil {
 		return err
 	}
 
 	return container.writeHostConfig()
 }
 
-func (container *Container) configureNetwork(networkName, service, networkDriver string, canCreateNetwork bool) error {
+func (container *Container) configureNetwork(networkName, service, networkDriver string, canCreateNetwork bool, isRestoring bool) error {
 	controller := container.daemon.netController
 	n, err := controller.NetworkByName(networkName)
 	if err != nil {
@@ -884,20 +892,52 @@ func (container *Container) configureNetwork(networkName, service, networkDriver
 		}
 	}
 
-	ep, err := n.EndpointByName(service)
-	if err != nil {
-		if _, ok := err.(libnetwork.ErrNoSuchEndpoint); !ok {
-			return err
-		}
+	var ep libnetwork.Endpoint
 
-		createOptions, err := container.buildCreateEndpointOptions()
-		if err != nil {
-			return err
+	if isRestoring == true {
+		// Use existing Endpoint for a checkpointed container
+		for _, endpoint := range n.Endpoints() {
+			if endpoint.ID() == container.NetworkSettings.EndpointID {
+				ep = endpoint
+			}
 		}
 
-		ep, err = n.CreateEndpoint(service, createOptions...)
+		if ep == nil {
+			//return fmt.Errorf("Fail to find the Endpoint for the checkpointed container")
+			fmt.Println("Fail to find the Endpoint for the checkpointed container")
+			ep, err = n.EndpointByName(service)
+			if err != nil {
+				if _, ok := err.(libnetwork.ErrNoSuchEndpoint); !ok {
+					return err
+				}
+
+				createOptions, err := container.buildCreateEndpointOptions(isRestoring)
+				if err != nil {
+					return err
+				}
+
+				ep, err = n.CreateEndpoint(service, createOptions...)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	} else {
+		ep, err = n.EndpointByName(service)
 		if err != nil {
-			return err
+			if _, ok := err.(libnetwork.ErrNoSuchEndpoint); !ok {
+				return err
+			}
+
+			createOptions, err := container.buildCreateEndpointOptions(isRestoring)
+			if err != nil {
+				return err
+			}
+
+			ep, err = n.CreateEndpoint(service, createOptions...)
+			if err != nil {
+				return err
+			}
 		}
 	}
 
@@ -921,7 +961,7 @@ func (container *Container) configureNetwork(networkName, service, networkDriver
 	return nil
 }
 
-func (container *Container) initializeNetworking() error {
+func (container *Container) initializeNetworking(restoring bool) error {
 	var err error
 
 	if container.hostConfig.NetworkMode.IsContainer() {
@@ -952,7 +992,7 @@ func (container *Container) initializeNetworking() error {
 
 	}
 
-	if err := container.allocateNetwork(); err != nil {
+	if err := container.allocateNetwork(restoring); err != nil {
 		return err
 	}
 
@@ -1035,7 +1075,7 @@ func (container *Container) getNetworkedContainer() (*Container, error) {
 	}
 }
 
-func (container *Container) releaseNetwork() {
+func (container *Container) releaseNetwork(is_checkpoint bool) {
 	if container.hostConfig.NetworkMode.IsContainer() || container.Config.NetworkDisabled {
 		return
 	}
@@ -1074,6 +1114,11 @@ func (container *Container) releaseNetwork() {
 		}
 	}
 
+	// for checkpointed container, the endpoint will not be deleted
+	if is_checkpoint == true {
+		return
+	}
+
 	// In addition to leaving all endpoints, delete implicitly created endpoint
 	if container.Config.PublishService == "" {
 		if err := ep.Delete(); err != nil {
diff --git a/daemon/container_windows.go b/daemon/container_windows.go
index 03665186c0e32..a7ccd9d1ecbf3 100644
--- a/daemon/container_windows.go
+++ b/daemon/container_windows.go
@@ -35,7 +35,7 @@ func (container *Container) createDaemonEnvironment(linkedEnv []string) []string
 	return container.Config.Env
 }
 
-func (container *Container) initializeNetworking() error {
+func (container *Container) initializeNetworking(restoring bool) error {
 	return nil
 }
 
diff --git a/daemon/daemon.go b/daemon/daemon.go
index a05262dbff0d0..02a995e78d80f 100644
--- a/daemon/daemon.go
+++ b/daemon/daemon.go
@@ -284,6 +284,18 @@ func (daemon *Daemon) restore() error {
 			logrus.Debugf("Loaded container %v", container.ID)
 
 			containers[container.ID] = &cr{container: container}
+
+			// If the container was checkpointed, we need to reserve
+			// the IP address that it was using.
+			//
+			// XXX We should also reserve host ports (if any).
+			/*if container.IsCheckpointed() {
+				err = bridge.ReserveIP(container.ID, container.NetworkSettings.IPAddress)
+				if err != nil {
+					log.Errorf("Failed to reserve IP %s for container %s",
+						container.ID, container.NetworkSettings.IPAddress)
+				}
+			}*/
 		} else {
 			logrus.Debugf("Cannot load container %s because it was created with another graph driver.", container.ID)
 		}
@@ -877,6 +889,25 @@ func (daemon *Daemon) run(c *Container, pipes *execdriver.Pipes, startCallback e
 	return daemon.execDriver.Run(c.command, pipes, startCallback)
 }
 
+func (daemon *Daemon) Checkpoint(c *Container, opts *runconfig.CriuConfig) error {
+	if err := daemon.execDriver.Checkpoint(c.command, opts); err != nil {
+		return err
+	}
+	c.SetCheckpointed(opts.LeaveRunning)
+	return nil
+}
+
+func (daemon *Daemon) Restore(c *Container, pipes *execdriver.Pipes, restoreCallback execdriver.RestoreCallback, opts *runconfig.CriuConfig, forceRestore bool) (execdriver.ExitStatus, error) {
+	// Mount the container's filesystem (daemon/graphdriver/aufs/aufs.go).
+	_, err := daemon.driver.Get(c.ID, c.getMountLabel())
+	if err != nil {
+		return execdriver.ExitStatus{ExitCode: 0}, err
+	}
+
+	exitCode, err := daemon.execDriver.Restore(c.command, pipes, restoreCallback, opts, forceRestore)
+	return exitCode, err
+}
+
 func (daemon *Daemon) kill(c *Container, sig int) error {
 	return daemon.execDriver.Kill(c.command, sig)
 }
diff --git a/daemon/execdriver/driver.go b/daemon/execdriver/driver.go
index b865c76cf2e3f..4cdea701d1c50 100644
--- a/daemon/execdriver/driver.go
+++ b/daemon/execdriver/driver.go
@@ -8,6 +8,7 @@ import (
 
 	// TODO Windows: Factor out ulimit
 	"github.com/docker/docker/pkg/ulimit"
+	"github.com/docker/docker/runconfig"
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
@@ -28,6 +29,7 @@ var (
 // It's used by 'Run' and 'Exec', does some work in parent process
 // after child process is started.
 type StartCallback func(*ProcessConfig, int)
+type RestoreCallback func(*ProcessConfig, int)
 
 // Info is driver specific information based on
 // processes registered with the driver
@@ -71,6 +73,12 @@ type Driver interface {
 	// Unpause unpauses a container.
 	Unpause(c *Command) error
 
+	// Checkpoints a container (with criu).
+	Checkpoint(c *Command, opts *runconfig.CriuConfig) error
+
+	// Restores a checkpoint image into a container (with criu).
+	Restore(c *Command, pipes *Pipes, restoreCallback RestoreCallback, opts *runconfig.CriuConfig, forceRestore bool) (ExitStatus, error)
+
 	// Name returns the name of the driver.
 	Name() string
 
diff --git a/daemon/execdriver/lxc/driver.go b/daemon/execdriver/lxc/driver.go
index 27da7c8c24db8..dce464b7937db 100644
--- a/daemon/execdriver/lxc/driver.go
+++ b/daemon/execdriver/lxc/driver.go
@@ -25,6 +25,7 @@ import (
 	sysinfo "github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/pkg/term"
 	"github.com/docker/docker/pkg/version"
+	"github.com/docker/docker/runconfig"
 	"github.com/kr/pty"
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
@@ -560,7 +561,14 @@ func (d *Driver) Unpause(c *execdriver.Command) error {
 	return err
 }
 
-// Terminate implements the exec driver Driver interface.
+func (d *Driver) Checkpoint(c *execdriver.Command, opts *runconfig.CriuConfig) error {
+	return fmt.Errorf("Checkpointing lxc containers not supported yet\n")
+}
+
+func (d *Driver) Restore(c *execdriver.Command, pipes *execdriver.Pipes, restoreCallback execdriver.RestoreCallback, opts *runconfig.CriuConfig, forceRestore bool) (execdriver.ExitStatus, error) {
+	return execdriver.ExitStatus{ExitCode: 0}, fmt.Errorf("Restoring lxc containers not supported yet\n")
+}
+
 func (d *Driver) Terminate(c *execdriver.Command) error {
 	return killLxc(c.ID, 9)
 }
diff --git a/daemon/execdriver/native/driver.go b/daemon/execdriver/native/driver.go
index b241bdbc504c8..91d1dfe594420 100644
--- a/daemon/execdriver/native/driver.go
+++ b/daemon/execdriver/native/driver.go
@@ -20,6 +20,7 @@ import (
 	"github.com/docker/docker/pkg/reexec"
 	sysinfo "github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/pkg/term"
+	"github.com/docker/docker/runconfig"
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/apparmor"
 	"github.com/opencontainers/runc/libcontainer/cgroups/systemd"
@@ -157,8 +158,11 @@ func (d *Driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 	d.activeContainers[c.ID] = cont
 	d.Unlock()
 	defer func() {
-		cont.Destroy()
-		d.cleanContainer(c.ID)
+		status, err := cont.Status()
+		if err != nil || status != libcontainer.Checkpointed {
+			cont.Destroy()
+			d.cleanContainer(c.ID)
+		}
 	}()
 
 	if err := cont.Start(p); err != nil {
@@ -298,6 +302,122 @@ func (d *Driver) Unpause(c *execdriver.Command) error {
 	return active.Resume()
 }
 
+func libcontainerCriuOpts(runconfigOpts *runconfig.CriuConfig) *libcontainer.CriuOpts {
+	criuopts := &libcontainer.CriuOpts{
+		ImagesDirectory:         runconfigOpts.ImagesDirectory,
+		WorkDirectory:           runconfigOpts.WorkDirectory,
+		LeaveRunning:            runconfigOpts.LeaveRunning,
+		TcpEstablished:          runconfigOpts.TcpEstablished,
+		ExternalUnixConnections: runconfigOpts.ExternalUnixConnections,
+		ShellJob:                runconfigOpts.ShellJob,
+		FileLocks:               runconfigOpts.FileLocks,
+	}
+
+	for _, i := range runconfigOpts.VethPairs {
+		criuopts.VethPairs = append(criuopts.VethPairs,
+			libcontainer.VethPairName{
+				InName:  i.InName,
+				OutName: i.OutName,
+			})
+	}
+	return criuopts
+}
+
+func (d *Driver) Checkpoint(c *execdriver.Command, opts *runconfig.CriuConfig) error {
+	active := d.activeContainers[c.ID]
+	if active == nil {
+		return fmt.Errorf("active container for %s does not exist", c.ID)
+	}
+
+	d.Lock()
+	defer d.Unlock()
+	err := active.Checkpoint(libcontainerCriuOpts(opts))
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d *Driver) Restore(c *execdriver.Command, pipes *execdriver.Pipes, restoreCallback execdriver.RestoreCallback, opts *runconfig.CriuConfig, forceRestore bool) (execdriver.ExitStatus, error) {
+	var (
+		cont libcontainer.Container
+		err  error
+	)
+
+	cont, err = d.factory.Load(c.ID)
+	if err != nil {
+		if forceRestore {
+			var config *configs.Config
+			config, err = d.createContainer(c)
+			if err != nil {
+				return execdriver.ExitStatus{ExitCode: -1}, err
+			}
+			cont, err = d.factory.Create(c.ID, config)
+			if err != nil {
+				return execdriver.ExitStatus{ExitCode: -1}, err
+			}
+		} else {
+			return execdriver.ExitStatus{ExitCode: -1}, err
+		}
+	}
+
+	p := &libcontainer.Process{
+		Args: append([]string{c.ProcessConfig.Entrypoint}, c.ProcessConfig.Arguments...),
+		Env:  c.ProcessConfig.Env,
+		Cwd:  c.WorkingDir,
+		User: c.ProcessConfig.User,
+	}
+
+	config := cont.Config()
+	if err := setupPipes(&config, &c.ProcessConfig, p, pipes); err != nil {
+		return execdriver.ExitStatus{ExitCode: -1}, err
+	}
+
+	d.Lock()
+	d.activeContainers[c.ID] = cont
+	d.Unlock()
+	defer func() {
+		cont.Destroy()
+		d.cleanContainer(c.ID)
+	}()
+
+	if err := cont.Restore(p, libcontainerCriuOpts(opts)); err != nil {
+		return execdriver.ExitStatus{ExitCode: -1}, err
+	}
+
+	// FIXME: no idea if any of this is needed...
+	if restoreCallback != nil {
+		pid, err := p.Pid()
+		if err != nil {
+			p.Signal(os.Kill)
+			p.Wait()
+			return execdriver.ExitStatus{ExitCode: -1}, err
+		}
+		restoreCallback(&c.ProcessConfig, pid)
+	}
+
+	oom := notifyOnOOM(cont)
+	waitF := p.Wait
+	if nss := cont.Config().Namespaces; !nss.Contains(configs.NEWPID) {
+		// we need such hack for tracking processes with inherited fds,
+		// because cmd.Wait() waiting for all streams to be copied
+		waitF = waitInPIDHost(p, cont)
+	}
+	ps, err := waitF()
+	if err != nil {
+		execErr, ok := err.(*exec.ExitError)
+		if !ok {
+			return execdriver.ExitStatus{ExitCode: -1}, err
+		}
+		ps = execErr.ProcessState
+	}
+
+	cont.Destroy()
+	_, oomKill := <-oom
+	return execdriver.ExitStatus{ExitCode: utils.ExitStatus(ps.Sys().(syscall.WaitStatus)), OOMKilled: oomKill}, nil
+}
+
 // Terminate implements the exec driver Driver interface.
 func (d *Driver) Terminate(c *execdriver.Command) error {
 	defer d.cleanContainer(c.ID)
diff --git a/daemon/execdriver/windows/windows.go b/daemon/execdriver/windows/windows.go
index 198ddc8dd7184..c87c50e230524 100644
--- a/daemon/execdriver/windows/windows.go
+++ b/daemon/execdriver/windows/windows.go
@@ -11,6 +11,7 @@ import (
 	"github.com/docker/docker/autogen/dockerversion"
 	"github.com/docker/docker/daemon/execdriver"
 	"github.com/docker/docker/pkg/parsers"
+	"github.com/docker/docker/runconfig"
 )
 
 // This is a daemon development variable only and should not be
@@ -93,3 +94,11 @@ func setupEnvironmentVariables(a []string) map[string]string {
 	}
 	return r
 }
+
+func (d *driver) Checkpoint(c *execdriver.Command, opts *runconfig.CriuConfig) error {
+	return fmt.Errorf("Windows: Containers cannot be checkpointed")
+}
+
+func (d *driver) Restore(c *execdriver.Command, pipes *execdriver.Pipes, restoreCallback execdriver.RestoreCallback, opts *runconfig.CriuConfig, forceRestore bool) (execdriver.ExitStatus, error) {
+	return execdriver.ExitStatus{ExitCode: 0}, fmt.Errorf("Windows: Containers cannot be restored")
+}
diff --git a/daemon/inspect.go b/daemon/inspect.go
index 1c4a65fca7dd1..00518e9105bc9 100644
--- a/daemon/inspect.go
+++ b/daemon/inspect.go
@@ -49,17 +49,19 @@ func (daemon *Daemon) getInspectData(container *Container) (*types.ContainerJSON
 	}
 
 	containerState := &types.ContainerState{
-		Status:     container.State.StateString(),
-		Running:    container.State.Running,
-		Paused:     container.State.Paused,
-		Restarting: container.State.Restarting,
-		OOMKilled:  container.State.OOMKilled,
-		Dead:       container.State.Dead,
-		Pid:        container.State.Pid,
-		ExitCode:   container.State.ExitCode,
-		Error:      container.State.Error,
-		StartedAt:  container.State.StartedAt.Format(time.RFC3339Nano),
-		FinishedAt: container.State.FinishedAt.Format(time.RFC3339Nano),
+		Status:         container.State.StateString(),
+		Running:        container.State.Running,
+		Paused:         container.State.Paused,
+		Checkpointed:   container.State.Checkpointed,
+		Restarting:     container.State.Restarting,
+		OOMKilled:      container.State.OOMKilled,
+		Dead:           container.State.Dead,
+		Pid:            container.State.Pid,
+		ExitCode:       container.State.ExitCode,
+		Error:          container.State.Error,
+		StartedAt:      container.State.StartedAt.Format(time.RFC3339Nano),
+		FinishedAt:     container.State.FinishedAt.Format(time.RFC3339Nano),
+		CheckpointedAt: container.State.CheckpointedAt.Format(time.RFC3339Nano),
 	}
 
 	contJSONBase := &types.ContainerJSONBase{
diff --git a/daemon/monitor.go b/daemon/monitor.go
index dd5d8c6b255bb..ee250d33d96ec 100644
--- a/daemon/monitor.go
+++ b/daemon/monitor.go
@@ -47,6 +47,9 @@ type containerMonitor struct {
 	// left waiting for nothing to happen during this time
 	stopChan chan struct{}
 
+	// like startSignal but for restoring a container
+	restoreSignal chan struct{}
+
 	// timeIncrement is the amount of time to wait between restarts
 	// this is in milliseconds
 	timeIncrement int
@@ -64,6 +67,7 @@ func newContainerMonitor(container *Container, policy runconfig.RestartPolicy) *
 		timeIncrement: defaultTimeIncrement,
 		stopChan:      make(chan struct{}),
 		startSignal:   make(chan struct{}),
+		restoreSignal: make(chan struct{}),
 	}
 }
 
@@ -188,6 +192,51 @@ func (m *containerMonitor) Start() error {
 	}
 }
 
+// Like Start() but for restoring a container.
+func (m *containerMonitor) Restore(opts *runconfig.CriuConfig, forceRestore bool) error {
+	var (
+		err error
+		// XXX The following line should be changed to
+		//     exitStatus execdriver.ExitStatus to match Start()
+		exitCode     execdriver.ExitStatus
+		afterRestore bool
+	)
+	defer func() {
+		if afterRestore {
+			m.container.Lock()
+			m.container.setStopped(&execdriver.ExitStatus{exitCode.ExitCode, false})
+			defer m.container.Unlock()
+		}
+		m.Close()
+	}()
+
+	// FIXME: right now if we startLogging again we get double logs after a restore
+	if m.container.logCopier == nil {
+		if err := m.container.startLogging(); err != nil {
+			m.resetContainer(false)
+			return err
+		}
+	}
+
+	pipes := execdriver.NewPipes(m.container.stdin, m.container.stdout, m.container.stderr, m.container.Config.OpenStdin)
+
+	m.container.logEvent("restore")
+	m.lastStartTime = time.Now()
+	if exitCode, err = m.container.daemon.Restore(m.container, pipes, m.restoreCallback, opts, forceRestore); err != nil {
+		logrus.Errorf("Error restoring container: %s, exitCode=%d", err, exitCode)
+		m.container.ExitCode = -1
+		m.resetContainer(false)
+		return err
+	}
+	afterRestore = true
+
+	m.container.ExitCode = exitCode.ExitCode
+	m.resetMonitor(err == nil && exitCode.ExitCode == 0)
+	m.container.logEvent("die")
+	m.resetContainer(true)
+	return err
+}
+
 // resetMonitor resets the stateful fields on the containerMonitor based on the
 // previous runs success or failure.  Regardless of success, if the container had
 // an execution time of more than 10s then reset the timer back to the default
@@ -275,6 +324,29 @@ func (m *containerMonitor) callback(processConfig *execdriver.ProcessConfig, pid
 	}
 }
 
+// Like callback() but for restoring a container.
+func (m *containerMonitor) restoreCallback(processConfig *execdriver.ProcessConfig, restorePid int) {
+	// If restorePid is 0, it means that restore failed.
+	if restorePid != 0 {
+		m.container.setRunning(restorePid)
+	}
+
+	// Unblock the goroutine waiting in waitForRestore().
+	select {
+	case <-m.restoreSignal:
+	default:
+		close(m.restoreSignal)
+	}
+
+	if restorePid != 0 {
+		// Write config.json and hostconfig.json files
+		// to /var/lib/docker/containers/<ID>.
+		if err := m.container.toDisk(); err != nil {
+			logrus.Debugf("%s", err)
+		}
+	}
+}
+
 // resetContainer resets the container's IO and ensures that the command is able to be executed again
 // by copying the data into a new struct
 // if lock is true, then container locked during reset
diff --git a/daemon/state.go b/daemon/state.go
index 9e2590791f4cf..1bddf24dd9e8b 100644
--- a/daemon/state.go
+++ b/daemon/state.go
@@ -19,6 +19,7 @@ type State struct {
 	Running           bool
 	Paused            bool
 	Restarting        bool
+	Checkpointed      bool
 	OOMKilled         bool
 	removalInProgress bool // Not need for this to be persistent on disk.
 	Dead              bool
@@ -27,6 +28,7 @@ type State struct {
 	Error             string // contains last known error when starting the container
 	StartedAt         time.Time
 	FinishedAt        time.Time
+	CheckpointedAt    time.Time
 	waitChan          chan struct{}
 }
 
@@ -54,6 +56,10 @@ func (s *State) String() string {
 		return "Removal In Progress"
 	}
 
+	if s.Checkpointed {
+		return fmt.Sprintf("Checkpointed %s ago", units.HumanDuration(time.Now().UTC().Sub(s.CheckpointedAt)))
+	}
+
 	if s.Dead {
 		return "Dead"
 	}
@@ -81,6 +87,10 @@ func (s *State) StateString() string {
 		return "running"
 	}
 
+	if s.Checkpointed {
+		return "checkpointed'"
+	}
+
 	if s.Dead {
 		return "dead"
 	}
@@ -187,6 +197,7 @@ func (s *State) setRunning(pid int) {
 	s.Error = ""
 	s.Running = true
 	s.Paused = false
+	s.Checkpointed = false
 	s.Restarting = false
 	s.ExitCode = 0
 	s.Pid = pid
@@ -268,3 +279,24 @@ func (s *State) setDead() {
 	s.Dead = true
 	s.Unlock()
 }
+
+func (s *State) SetCheckpointed(leaveRunning bool) {
+	s.Lock()
+	s.CheckpointedAt = time.Now().UTC()
+	s.Checkpointed = !leaveRunning
+	s.Running = leaveRunning
+	s.Paused = false
+	s.Restarting = false
+	// XXX Not sure if we need to close and recreate waitChan.
+	// close(s.waitChan)
+	// s.waitChan = make(chan struct{})
+	s.Unlock()
+}
+
+func (s *State) HasBeenCheckpointed() bool {
+	return s.CheckpointedAt != time.Time{}
+}
+
+func (s *State) IsCheckpointed() bool {
+	return s.Checkpointed
+}
diff --git a/docker/docker.go b/docker/docker.go
index 8ad0d13c05c1a..fb0a5240e6936 100644
--- a/docker/docker.go
+++ b/docker/docker.go
@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"os"
+	"sort"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/api/client"
@@ -35,7 +36,10 @@ func main() {
 
 		help := "\nCommands:\n"
 
-		for _, cmd := range dockerCommands {
+		allCommands := append(dockerCommands, experimentalCommands...)
+		sort.Sort(byName(allCommands))
+
+		for _, cmd := range allCommands {
 			help += fmt.Sprintf("    %-10.10s%s\n", cmd.name, cmd.description)
 		}
 
diff --git a/docker/flags_experimental.go b/docker/flags_experimental.go
new file mode 100644
index 0000000000000..08893a7cf0b49
--- /dev/null
+++ b/docker/flags_experimental.go
@@ -0,0 +1,10 @@
+// +build experimental
+
+package main
+
+var (
+	experimentalCommands = []command{
+		{"checkpoint", "Checkpoint one or more running containers"},
+		{"restore", "Restore one or more checkpointed containers"},
+	}
+)
diff --git a/docker/flags_stub.go b/docker/flags_stub.go
new file mode 100644
index 0000000000000..d627b86a3a8f7
--- /dev/null
+++ b/docker/flags_stub.go
@@ -0,0 +1,7 @@
+// +build !experimental
+
+package main
+
+var (
+	experimentalCommands = []command{}
+)
diff --git a/experimental/README.md b/experimental/README.md
index 8da601d6f202d..dbd83bcb570c0 100644
--- a/experimental/README.md
+++ b/experimental/README.md
@@ -1,8 +1,8 @@
-# Docker Experimental Features 
+# Docker Experimental Features
 
 This page contains a list of features in the Docker engine which are
 experimental. Experimental features are **not** ready for production. They are
-provided for test and evaluation in your sandbox environments.  
+provided for test and evaluation in your sandbox environments.
 
 The information below describes each feature and the GitHub pull requests and
 issues associated with it. If necessary, links are provided to additional
@@ -75,9 +75,10 @@ to build a dynamically-linked Docker binary with the experimental features enabl
 * [Networking and Services UI](networking.md)
 * [Native multi-host networking](network_overlay.md)
 * [Compose, Swarm and networking integration](compose_swarm_networking.md)
+* [Checkpoint & Restore](checkpoint_restore.md)
 
 ## How to comment on an experimental feature
 
-Each feature's documentation includes a list of proposal pull requests or PRs associated with the feature. If you want to comment on or suggest a change to a feature, please add it to the existing feature PR.  
+Each feature's documentation includes a list of proposal pull requests or PRs associated with the feature. If you want to comment on or suggest a change to a feature, please add it to the existing feature PR.
 
-Issues or problems with a feature? Inquire for help on the `#docker` IRC channel or in on the [Docker Google group](https://groups.google.com/forum/#!forum/docker-user).  
+Issues or problems with a feature? Inquire for help on the `#docker` IRC channel or in on the [Docker Google group](https://groups.google.com/forum/#!forum/docker-user).
diff --git a/experimental/checkpoint_restore.md b/experimental/checkpoint_restore.md
new file mode 100644
index 0000000000000..f3ed0b5898e85
--- /dev/null
+++ b/experimental/checkpoint_restore.md
@@ -0,0 +1,154 @@
+# Docker Checkpoint & Restore
+
+Checkpoint & Restore is a new feature that allows you to freeze a running
+container by checkpointing it, which turns its state into a collection of files
+on disk. Later, the container can be restored from the point it was frozen.
+
+This is accomplished using a tool called [CRIU](http://criu.org), which is an
+external dependency of this feature. A good overview of the history of
+checkpoint and restore in Docker is available in this
+[Kubernetes blog post](http://blog.kubernetes.io/2015/07/how-did-quake-demo-from-dockercon-work.html).
+
+## Installing CRIU
+
+If you use a Debian system, you can add the CRIU PPA and install with apt-get
+https://launchpad.net/~criu/+archive/ubuntu/ppa.
+
+Alternatively, you can [build CRIU from source](http://criu.org/Installation).
+
+## Use cases for checkpoint & restore
+
+This feature is currently focused on single-host use cases for checkpoint and
+restore. Here are a few:
+
+- Restarting / upgrading the docker daemon without stopping containers
+- Restarting the host machine without stopping/starting containers
+- Speeding up the start time of slow start applications
+- "Rewinding" processes to an earlier point in time
+- "Forensic debugging" of running processes
+
+Another primary use case of checkpoint & restore outside of Docker is the live
+migration of a server from one machine to another. This is possible with the
+current implementation, but not currently a priority (and so the workflow is
+not optimized for the task).
+
+## Using Checkpoint & Restore
+
+Two new top level commands are introduced in the CLI: `checkpoint` & `restore`.
+The options for checkpoint:
+
+    Usage:  docker checkpoint [OPTIONS] CONTAINER [CONTAINER...]
+
+    Checkpoint one or more running containers
+
+      --allow-shell=false      allow checkpointing shell jobs
+      --image-dir=             directory for storing checkpoint image files
+      --leave-running=false    leave the container running after checkpoint
+      --work-dir=              directory for storing log file
+
+And for restore:
+
+    Usage:  docker restore [OPTIONS] CONTAINER [CONTAINER...]
+
+    Restore one or more checkpointed containers
+
+      --allow-shell=false    allow restoring shell jobs
+      --force=false          bypass checks for current container state
+      --image-dir=           directory to restore image files from
+      --work-dir=            directory for restore log
+
+A simple example of using checkpoint & restore on a container:
+
+    $ docker run --name cr -d busybox /bin/sh -c 'i=0; while true; do echo $i; i=$(expr $i + 1); sleep 1; done'
+    > abc0123
+
+    $ docker checkpoint cr
+    > abc0123
+
+    $ docker restore cr
+    > abc0123
+
+This process just logs an incrementing counter to stdout. If you `docker logs`
+in between running/checkpoint/restoring you should see that the counter
+increases while the process is running, stops while it's checkpointed, and
+resumes from the point it left off once you restore.
+
+### Same container checkpoint/restore
+
+The above example falls into the category of "same container" use cases for c/r.
+Restarting the daemon is an example of this kind of use case. There is only one
+container here at any point in time. That container's status, once it is
+checkpointed, will be "Checkpointed" and docker inspect will contain that status
+as well as the time of the last checkpoint. The IP address and other container
+state do not change (see known issues at the bottom of this document).
+
+### New container checkpoint/restore
+
+Here's an example of a "new container" use case for c/r:
+
+    $ docker run some_image
+    > abc789
+
+    ## the container runs for a while
+
+    $ docker checkpoint --image-dir=/some/path abc789
+    > abc789
+
+At this point, we've created a checkpoint image at `/some/path` that encodes a
+process at the exact state we want it to be. Now, at some later point in time,
+we can put a copy of that exact state into a new container (perhaps many times):
+
+    $ docker create some_image
+    > def123
+
+    $ docker restore --force=true --image-dir=/some/path def123
+    > def123
+
+We created a new container (but didn't start it), and then we restored our
+checkpointed process into that container.
+
+This is obviously more involved than the simple use case shown earlier. It
+requires starting subsequent containers with the same configuration (e.g.
+the same mounted volumes, the same base image, etc.).
+
+### Options
+
+Checkpoint & Restore:
+
+      --image-dir=             directory for storing checkpoint image files
+
+Allows you to specify the path for writing a checkpoint image, or the path for
+the image you want to restore.
+
+      --work-dir=              directory for storing log file
+
+Allows you to specify the path for writing the CRIU log.
+
+      --leave-running=false    leave the container running after checkpoint
+
+Normally, when checkpointing a process, the process is stopped aftewrards.
+When this flag is enabled, the process keeps running after a checkpoint. This is
+useful if you want to capture a process at multiple points in time, for later
+use in debugging or rewinding a process for some reason. It's also used for
+minimizing downtime when checkpointing processes with a large memory footprint.
+
+Restore Only:
+
+      --force=false            force restoring into a container
+
+As shown in the "new container" example, this flag allows you to restore a
+checkpoint image into a container that was not previously checkpointed.
+Normally, docker would return an error when restoring into a container that
+has not been previously checkpointed.
+
+## Known Issues
+
+- Currently, networking is broken in this PR. Although it's implemented at the
+libcontainer level, the method used no longer works since the introduction of
+libnetwork. See:
+    - https://github.com/docker/libnetwork/pull/465
+    - https://github.com/boucher/docker/pull/15
+- There are likely several networking related issues to work out, like:
+    - ensuring IPs are reserved across daemon restarts
+    - ensuring port maps are reserved
+    - deciding how to deal with network resources in the "new container" model
diff --git a/integration-cli/docker_cli_checkpoint_test.go b/integration-cli/docker_cli_checkpoint_test.go
new file mode 100644
index 0000000000000..09ec47a9a0d54
--- /dev/null
+++ b/integration-cli/docker_cli_checkpoint_test.go
@@ -0,0 +1,39 @@
+// +build experimental
+
+package main
+
+import (
+	"os/exec"
+	"strings"
+
+	"github.com/go-check/check"
+)
+
+func (s *DockerSuite) TestCheckpointAndRestore(c *check.C) {
+	defer unpauseAllContainers()
+
+	runCmd := exec.Command(dockerBinary, "run", "-d", "busybox", "top")
+	out, _, err := runCommandWithOutput(runCmd)
+	if err != nil {
+		c.Fatalf("failed to run container: %v, output: %q", err, out)
+	}
+
+	containerID := strings.TrimSpace(out)
+	checkpointCmd := exec.Command(dockerBinary, "checkpoint", containerID)
+	out, _, err = runCommandWithOutput(checkpointCmd)
+	if err != nil {
+		c.Fatalf("failed to checkpoint container: %v, output: %q", err, out)
+	}
+
+	out, err = inspectField(containerID, "State.Checkpointed")
+	c.Assert(out, check.Equals, "true")
+
+	restoreCmd := exec.Command(dockerBinary, "restore", containerID)
+	out, _, _, err = runCommandWithStdoutStderr(restoreCmd)
+	if err != nil {
+		c.Fatalf("failed to restore container: %v, output: %q", err, out)
+	}
+
+	out, err = inspectField(containerID, "State.Checkpointed")
+	c.Assert(out, check.Equals, "false")
+}
diff --git a/integration-cli/docker_cli_help_experimental_test.go b/integration-cli/docker_cli_help_experimental_test.go
new file mode 100644
index 0000000000000..f6f7ed5bf070d
--- /dev/null
+++ b/integration-cli/docker_cli_help_experimental_test.go
@@ -0,0 +1,5 @@
+// +build experimental
+
+package main
+
+var totalDockerCLICommands = 42
diff --git a/integration-cli/docker_cli_help_standard_test.go b/integration-cli/docker_cli_help_standard_test.go
new file mode 100644
index 0000000000000..f960f3450a9d6
--- /dev/null
+++ b/integration-cli/docker_cli_help_standard_test.go
@@ -0,0 +1,5 @@
+// +build !experimental
+
+package main
+
+var totalDockerCLICommands = 40
diff --git a/integration-cli/docker_cli_help_test.go b/integration-cli/docker_cli_help_test.go
index f6a6f96db60ee..fa2d51cac2b19 100644
--- a/integration-cli/docker_cli_help_test.go
+++ b/integration-cli/docker_cli_help_test.go
@@ -238,13 +238,17 @@ func (s *DockerSuite) TestHelpTextVerify(c *check.C) {
 
 		}
 
+<<<<<<< HEAD
 		expected := 40
+=======
+		expected := totalDockerCLICommands
+>>>>>>> Move checkpoint/restore interface into docker experimental build.
 		if isLocalDaemon {
 			expected++ // for the daemon command
 		}
 		if len(cmds) != expected {
 			c.Fatalf("Wrong # of cmds(%d), it should be: %d\nThe list:\n%q",
-				len(cmds), expected, cmds)
+				len(cmds), totalDockerCLICommands, cmds)
 		}
 	}
 
diff --git a/project/PACKAGERS.md b/project/PACKAGERS.md
index 22f24b4789b77..5ba406cedf009 100644
--- a/project/PACKAGERS.md
+++ b/project/PACKAGERS.md
@@ -303,6 +303,9 @@ by having support for them in the kernel or userspace. A few examples include:
   least the "auplink" utility from aufs-tools)
 * BTRFS graph driver (requires BTRFS support enabled in the kernel)
 * ZFS graph driver (requires userspace zfs-utils and a corresponding kernel module)
+* Checkpoint/Restore containers:
+  - requires criu version 1.5.2 or later (criu.org)
+  - requires kernel version 3.19 or later if using overlay-fs
 
 ## Daemon Init Script
 
diff --git a/runconfig/restore.go b/runconfig/restore.go
new file mode 100644
index 0000000000000..dd81d909fcd1a
--- /dev/null
+++ b/runconfig/restore.go
@@ -0,0 +1,22 @@
+package runconfig
+
+type VethPairName struct {
+	InName  string
+	OutName string
+}
+
+type CriuConfig struct {
+	ImagesDirectory         string
+	WorkDirectory           string
+	LeaveRunning            bool
+	TcpEstablished          bool
+	ExternalUnixConnections bool
+	ShellJob                bool
+	FileLocks               bool
+	VethPairs               []VethPairName
+}
+
+type RestoreConfig struct {
+	CriuOpts     CriuConfig
+	ForceRestore bool
+}
diff --git a/vendor/src/github.com/docker/libnetwork/endpoint.go b/vendor/src/github.com/docker/libnetwork/endpoint.go
index 3475e9eafda04..b0354a03bc6e1 100644
--- a/vendor/src/github.com/docker/libnetwork/endpoint.go
+++ b/vendor/src/github.com/docker/libnetwork/endpoint.go
@@ -54,6 +54,9 @@ type Endpoint interface {
 
 	// Retrieve the interfaces' statistics from the sandbox
 	Statistics() (map[string]*sandbox.InterfaceStatistics, error)
+
+	// Retrieve the interfaces from sandbox, for restoring checkpointed container
+	SandboxInterfaces() []sandbox.Interface
 }
 
 // EndpointOption is a option setter function type used to pass varios options to Network
@@ -583,6 +586,17 @@ func (ep *endpoint) Statistics() (map[string]*sandbox.InterfaceStatistics, error
 	return m, nil
 }
 
+func (ep *endpoint) SandboxInterfaces() []sandbox.Interface {
+	n := ep.network
+
+	n.Lock()
+	c := n.ctrlr
+	n.Unlock()
+
+	sbox := c.sandboxGet(ep.container.data.SandboxKey)
+	return sbox.Info().Interfaces()
+}
+
 func (ep *endpoint) deleteEndpoint() error {
 	ep.Lock()
 	n := ep.network
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/container_linux.go b/vendor/src/github.com/opencontainers/runc/libcontainer/container_linux.go
index 9a27eb432faad..935af32cc42b4 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/container_linux.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/container_linux.go
@@ -520,6 +520,8 @@ func (c *linuxContainer) Restore(process *Process, criuOpts *CriuOpts) error {
 			break
 		}
 	}
+
+	/* XXX, we can not get interface from config */
 	for _, iface := range c.config.Networks {
 		switch iface.Type {
 		case "veth":
@@ -533,6 +535,14 @@ func (c *linuxContainer) Restore(process *Process, criuOpts *CriuOpts) error {
 		}
 	}
 
+	for _, i := range criuOpts.VethPairs {
+		outname := i.OutName + "@docker0"
+		veth := new(criurpc.CriuVethPair)
+		veth.IfOut = proto.String(outname)
+		veth.IfIn = proto.String(i.InName)
+		req.Opts.Veths = append(req.Opts.Veths, veth)
+	}
+
 	var (
 		fds    []string
 		fdJSON []byte
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/criu_opts.go b/vendor/src/github.com/opencontainers/runc/libcontainer/criu_opts.go
index bca81672eac8b..1e3c79e6ce9db 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/criu_opts.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/criu_opts.go
@@ -5,6 +5,11 @@ type CriuPageServerInfo struct {
 	Port    int32  // port number of CRIU page server
 }
 
+type VethPairName struct {
+	InName  string
+	OutName string
+}
+
 type CriuOpts struct {
 	ImagesDirectory         string             // directory for storing image files
 	WorkDirectory           string             // directory to cd and write logs/pidfiles/stats to
@@ -14,4 +19,5 @@ type CriuOpts struct {
 	ShellJob                bool               // allow to dump and restore shell jobs
 	FileLocks               bool               // handle file locks, for safety
 	PageServer              CriuPageServerInfo // allow to dump to criu page server
+	VethPairs               []VethPairName     // pass the veth to criu when restore
 }