From 485a52058884000e7eafa7fb1a6a9e06471b1aa7 Mon Sep 17 00:00:00 2001
From: Nayana Bidari <nybidari@google.com>
Date: Fri, 13 Sep 2024 13:20:27 -0700
Subject: [PATCH] Spec validation: use container name instead of container ID
 in the map.

- container IDs can change across checkpoint restore, use container name
instead of container ID.
- For validation of specs in restore, check if all the new specs during
restore are present in the specs saved at checkpoint. We cannot compare the
number of specs as for init containers the restore method is not called. It
is handled at the shim level for init containers.

PiperOrigin-RevId: 674411517
---
 runsc/boot/loader.go  | 8 ++++----
 runsc/boot/restore.go | 6 ++++--
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index 76ee3c5b0..89757e592 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -237,7 +237,7 @@ type Loader struct {
 
 	// containerSpecs stores container specs for each container in sandbox.
 	//
-	// Mapping: cid -> spec.
+	// Mapping: name -> spec.
 	// +checklocks:mu
 	containerSpecs map[string]*specs.Spec
 
@@ -1920,14 +1920,14 @@ func (l *Loader) registerContainerLocked(spec *specs.Spec, cid string) string {
 	}
 
 	l.containerIDs[containerName] = cid
-	l.containerSpecs[cid] = spec
+	l.containerSpecs[containerName] = spec
 	return containerName
 }
 
-func (l *Loader) getContainerSpec(cid string) *specs.Spec {
+func (l *Loader) getContainerSpec(containerName string) *specs.Spec {
 	l.mu.Lock()
 	defer l.mu.Unlock()
-	return l.containerSpecs[cid]
+	return l.containerSpecs[containerName]
 }
 
 func (l *Loader) containerRuntimeState(cid string) ContainerRuntimeState {
diff --git a/runsc/boot/restore.go b/runsc/boot/restore.go
index e8af1d2d4..9389a1d59 100644
--- a/runsc/boot/restore.go
+++ b/runsc/boot/restore.go
@@ -139,8 +139,10 @@ func createNetworkStackForRestore(l *Loader) (*stack.Stack, inet.Stack) {
 
 // Validate OCI specs before restoring the containers.
 func validateSpecs(oldSpecs, newSpecs map[string]*specs.Spec) error {
-	if len(oldSpecs) != len(newSpecs) {
-		return fmt.Errorf("incorrect number of specs during checkpoint and restore")
+	for name := range newSpecs {
+		if _, ok := oldSpecs[name]; !ok {
+			return fmt.Errorf("checkpoint image does not contain spec for container: %q", name)
+		}
 	}
 	return nil
 }