Spec validation: use container name instead of container ID in the map.

- container IDs can change across checkpoint restore, use container name
instead of container ID.
- For validation of specs in restore, check if all the new specs during
restore are present in the specs saved at checkpoint. We cannot compare the
number of specs as for init containers the restore method is not called. It
is handled at the shim level for init containers.

PiperOrigin-RevId: 674411517

runsc/boot/loader.go

@@ -237,7 +237,7 @@ type Loader struct {
 
 	// containerSpecs stores container specs for each container in sandbox.
 	//
-	// Mapping: cid -> spec.
+	// Mapping: name -> spec.
 	// +checklocks:mu
 	containerSpecs map[string]*specs.Spec
 
@@ -1920,14 +1920,14 @@ func (l *Loader) registerContainerLocked(spec *specs.Spec, cid string) string {
 	}
 
 	l.containerIDs[containerName] = cid
-	l.containerSpecs[cid] = spec
+	l.containerSpecs[containerName] = spec
 	return containerName
 }
 
-func (l *Loader) getContainerSpec(cid string) *specs.Spec {
+func (l *Loader) getContainerSpec(containerName string) *specs.Spec {
 	l.mu.Lock()
 	defer l.mu.Unlock()
-	return l.containerSpecs[cid]
+	return l.containerSpecs[containerName]
 }
 
 func (l *Loader) containerRuntimeState(cid string) ContainerRuntimeState {

runsc/boot/restore.go

@@ -139,8 +139,10 @@ func createNetworkStackForRestore(l *Loader) (*stack.Stack, inet.Stack) {
 
 // Validate OCI specs before restoring the containers.
 func validateSpecs(oldSpecs, newSpecs map[string]*specs.Spec) error {
-	if len(oldSpecs) != len(newSpecs) {
-		return fmt.Errorf("incorrect number of specs during checkpoint and restore")
+	for name := range newSpecs {
+		if _, ok := oldSpecs[name]; !ok {
+			return fmt.Errorf("checkpoint image does not contain spec for container: %q", name)
+		}
 	}
 	return nil
 }