Fix up container ID after restore

Restore of a pod can be done using the same container ID (e.g.
save to continue the same execution) or using a different
container ID (e.g. cloning the pod into a new execution). If
a different container ID is used, we need to make sure the new
container ID is used in all places.

PiperOrigin-RevId: 582829466

pkg/sentry/kernel/task.go

@@ -809,6 +809,12 @@ func (t *Task) ContainerID() string {
 	return t.containerID
 }
 
+// RestoreContainerID sets t's container ID in case the restored container ID
+// is different from when it was saved.
+func (t *Task) RestoreContainerID(cid string) {
+	t.containerID = cid
+}
+
 // OOMScoreAdj gets the task's thread group's OOM score adjustment.
 func (t *Task) OOMScoreAdj() int32 {
 	return t.tg.oomScoreAdj.Load()

runsc/boot/controller.go

@@ -553,6 +553,15 @@ func (cm *containerManager) Restore(o *RestoreOpts, _ *struct{}) error {
 	// restore the state of multiple containers, nor exec processes.
 	cm.l.sandboxID = o.SandboxID
 	cm.l.mu.Lock()
+
+	// Set new container ID if it has changed.
+	tasks := cm.l.k.TaskSet().Root.Tasks()
+	if tasks[0].ContainerID() != o.SandboxID { // There must be at least 1 task.
+		for _, task := range tasks {
+			task.RestoreContainerID(o.SandboxID)
+		}
+	}
+
 	eid := execID{cid: o.SandboxID}
 	cm.l.processes = map[execID]*execProcess{
 		eid: {