This patch fixes the error:

(00.074175) Error (criu/net.c:2638): Locking network failed:
iptables-restore returned -1. This may be connected to disabled
CONFIG_NETFILTER_XT_MARK kernel build config option.
Signed-off-by: Andrei Vagin <avagin@gmail.com>