dockershim: ignore GetCheckpoint error when running in userns

pkg/kubelet/dockershim/BUILD

@@ -70,6 +70,7 @@ go_library(
         "//vendor/github.com/docker/docker/pkg/jsonmessage:go_default_library",
         "//vendor/github.com/docker/go-connections/nat:go_default_library",
         "//vendor/k8s.io/klog:go_default_library",
+        "//vendor/github.com/opencontainers/runc/libcontainer/system:go_default_library",
         "//vendor/k8s.io/utils/exec:go_default_library",
     ] + select({
         "@io_bazel_rules_go//go/platform:windows": [

pkg/kubelet/dockershim/docker_sandbox.go

@@ -27,6 +27,8 @@ import (
 	dockertypes "github.com/docker/docker/api/types"
 	dockercontainer "github.com/docker/docker/api/types/container"
 	dockerfilters "github.com/docker/docker/api/types/filters"
+	rsystem "github.com/opencontainers/runc/libcontainer/system"
+
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/klog"
 	runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
@@ -535,11 +537,13 @@ func (ds *dockerService) ListPodSandbox(_ context.Context, r *runtimeapi.ListPod
 		checkpoint := NewPodSandboxCheckpoint("", "", &CheckpointData{})
 		err := ds.checkpointManager.GetCheckpoint(id, checkpoint)
 		if err != nil {
-			klog.Errorf("Failed to retrieve checkpoint for sandbox %q: %v", id, err)
-			if err == errors.ErrCorruptCheckpoint {
-				err = ds.checkpointManager.RemoveCheckpoint(id)
-				if err != nil {
-					klog.Errorf("Failed to delete corrupt checkpoint for sandbox %q: %v", id, err)
+			if !rsystem.RunningInUserNS() {
+				klog.Errorf("Failed to retrieve checkpoint for sandbox %q: %v", id, err)
+				if err == errors.ErrCorruptCheckpoint {
+					err = ds.checkpointManager.RemoveCheckpoint(id)
+					if err != nil {
+						klog.Errorf("Failed to delete corrupt checkpoint for sandbox %q: %v", id, err)
+					}
 				}
 			}
 			continue