Fix mount source validation.

PiperOrigin-RevId: 694560314

runsc/boot/restore.go

@@ -256,15 +256,15 @@ func extractAnnotationsToValidate(o map[string]string) map[string]string {
 	const (
 		gvisorPrefix   = "dev.gvisor."
 		internalPrefix = "dev.gvisor.internal."
-
-		mntSrcAnnotation = "dev.gvisor.spec.mount.source"
+		mntPrefix      = "dev.gvisor.spec.mount."
 	)
 
 	n := make(map[string]string)
 	for key, val := range o {
-		if strings.HasPrefix(key, internalPrefix) || key == mntSrcAnnotation {
+		if strings.HasPrefix(key, internalPrefix) || (strings.HasPrefix(key, mntPrefix) && strings.HasSuffix(key, ".source")) {
 			continue
 		}
+
 		if strings.HasPrefix(key, gvisorPrefix) {
 			n[key] = val
 		}

runsc/container/container_test.go

@@ -3793,6 +3793,17 @@ func TestSpecValidation(t *testing.T) {
 			},
 			wantErr: "Mounts does not match across checkpoint restore",
 		},
+		{
+			name: "AnnotationsMountsSuccess",
+			mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {
+				spec.Annotations = make(map[string]string)
+				spec.Annotations["dev.gvisor.spec.mount.mnt1.source"] = "path1"
+
+				restoreSpec.Annotations = make(map[string]string)
+				restoreSpec.Annotations["dev.gvisor.spec.mount.mnt2.source"] = "path2"
+			},
+			wantErr: "",
+		},
 		{
 			name: "AnnotationsFail",
 			mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {