Fix: Add nil checks for all Linux spec dereferences

[Yashika0724]

Summary

This PR fixes a nil pointer dereference that can occur during container creation when the OCI spec
does not include the linux section, which is valid per the OCI runtime specification.

Several code paths assume Spec.Linux is always present, including FormatNsenterInfo() which is
executed during CREATE. When the field is missing, urunc panics before reaching Exec().

This change adds defensive checks to safely handle optional OCI fields while preserving existing
behavior for valid specs.

---

Root Cause

The OCI spec defines linux as optional, but the runtime dereferenced Spec.Linux without nil
checks in namespace setup and execution paths, leading to a panic when the field is absent.

---

Fix Applied

Defensive nil checks were added before dereferencing Spec.Linux in:

• FormatNsenterInfo()
• relevant paths in Exec()
• joinSandboxNetNs()

Valid OCI specs continue to follow the same execution flow.

---

Impact

• Prevents runtime panics during CREATE
• Improves stability for malformed or incomplete OCI specs
• No change to intended runtime behavior

[netlify]

✅ Deploy Preview for urunc canceled.

Name	Link
🔨 Latest commit	0b0ce09
🔍 Latest deploy log	https://app.netlify.com/projects/urunc/deploys/6975226ef655c30008ee1239

[netlify]

✅ Deploy Preview for urunc ready!

Name	Link
🔨 Latest commit	f260fc5
🔍 Latest deploy log	https://app.netlify.com/projects/urunc/deploys/697e5a32da748400088bad68
😎 Deploy Preview	https://deploy-preview-398--urunc.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Yashika0724]

Hi @cmainas , this PR adds minimal nil checks to prevent a panic when the OCI spec omits the linux field.
The change does not affect behavior for valid specs and only adds defensive guards.
Please let me know if you’d prefer handling this earlier in the lifecycle
thanks!

[cmainas]

Hello @Yashika0724 ,

these changes are in the same context as #396. Therefore, please merge them under one PR. For more information take a look in the contribution guide.

[Yashika0724]

This PR addresses #409.

Summary

The OCI runtime-spec defines linux as an optional, platform-specific field. urunc was
dereferencing Spec.Linux in multiple locations without nil guards, which could cause a panic
if a spec-compliant bundle omits this field.

---

Changes

• RootfsPropagation: default to empty string when Linux spec is nil
• Namespace lookups: skip mount namespace logic when Linux spec is absent
• joinSandboxNetNs: return ErrNotExistingNS early when Linux spec is nil
• FormatNsenterInfo: return explicit error when Linux spec is missing

These are defensive checks that improve robustness without changing behavior for existing
workloads.

[cmainas]

Hello @Yashika0724 ,

I think you forgot the checks from #396

[Yashika0724]

Thanks for the catch!
I’ve added the missing Exec() nil checks from #396 (memory and seccomp paths) and pushed an update.
Please let me know if anything else should be adjusted.

[cmainas]

Hello @Yashika0724 ,

thank you for this fix.

Looking it a bit closer, we can make it much simpler. Urunc does not support any other platforms than Linux and hence instead of repeatedly checking if the field is not nil, we can check it once when we read the container's configuration and if it is not present fail the execution, reporting the respective error message.

[obsidiannnn]

Hi @Yashika0724, just checking in — are you still working on this update following the suggestion to validate the Linux spec early?
If you’re busy or would like help, I’d be happy to assist or draft a patch.

[Yashika0724]

Thanks for the feedback, that makes sense.
I’ll update the PR to validate the Linux spec once early during container configuration handling and return a clear error if it’s missing, instead of having scattered nil checks. I’ll follow up with an updated patch shortly.

[Yashika0724]

Thanks for the suggestion!
I’ve updated the PR to validate the Linux spec once early during container creation and removed the redundant nil checks from later execution and namespace paths, as discussed.

Please let me know if this aligns with what you had in mind.

[cmainas]

Hello @Yashika0724 ,

thank you for the changes, I have left one comment and we also need to add the check in the Get function https://github.com/urunc-dev/urunc/blob/main/pkg/unikontainers/unikontainers.go#L125

[cmainas]

Please do not change the line for the function call, The comment was deliberately under the function.