From 8d87a534c0250b80e3583cd7d69032fddc6273b8 Mon Sep 17 00:00:00 2001
From: Fabricio Voznika <fvoznika@google.com>
Date: Wed, 15 Nov 2023 15:41:30 -0800
Subject: [PATCH] Fix up container ID after restore

Restore of a pod can be done using the same container ID (e.g.
save to continue the same execution) or using a different
container ID (e.g. cloning the pod into a new execution). If
a different container ID is used, we need to make sure the new
container ID is used in all places.

PiperOrigin-RevId: 582829466
---
 pkg/sentry/kernel/task.go | 6 ++++++
 runsc/boot/controller.go  | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go
index 6d53f4f7e..c0c9c0298 100644
--- a/pkg/sentry/kernel/task.go
+++ b/pkg/sentry/kernel/task.go
@@ -809,6 +809,12 @@ func (t *Task) ContainerID() string {
 	return t.containerID
 }
 
+// RestoreContainerID sets t's container ID in case the restored container ID
+// is different from when it was saved.
+func (t *Task) RestoreContainerID(cid string) {
+	t.containerID = cid
+}
+
 // OOMScoreAdj gets the task's thread group's OOM score adjustment.
 func (t *Task) OOMScoreAdj() int32 {
 	return t.tg.oomScoreAdj.Load()
diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go
index e8d9297b2..cd80b4bb8 100644
--- a/runsc/boot/controller.go
+++ b/runsc/boot/controller.go
@@ -553,6 +553,15 @@ func (cm *containerManager) Restore(o *RestoreOpts, _ *struct{}) error {
 	// restore the state of multiple containers, nor exec processes.
 	cm.l.sandboxID = o.SandboxID
 	cm.l.mu.Lock()
+
+	// Set new container ID if it has changed.
+	tasks := cm.l.k.TaskSet().Root.Tasks()
+	if tasks[0].ContainerID() != o.SandboxID { // There must be at least 1 task.
+		for _, task := range tasks {
+			task.RestoreContainerID(o.SandboxID)
+		}
+	}
+
 	eid := execID{cid: o.SandboxID}
 	cm.l.processes = map[execID]*execProcess{
 		eid: {