Error out if spec is invalid

Closes #66

PiperOrigin-RevId: 202496258
Change-Id: Ib9287c5bf1279ffba1db21ebd9e6b59305cddf34

2 files changed, 4 insertions, 27 deletions

diff --git a/runsc/container/container.go b/runsc/container/container.go
index 428aa5c62..c7dc6ec10 100644
--- a/runsc/container/container.go
+++ b/runsc/container/container.go
@@ -193,9 +193,6 @@ func Create(id string, spec *specs.Spec, conf *boot.Config, bundleDir, consoleSo
 	if err := validateID(id); err != nil {
 		return nil, err
 	}
-	if err := specutils.ValidateSpec(spec); err != nil {
-		return nil, err
-	}
 
 	containerRoot := filepath.Join(conf.RootDir, id)
 	if _, err := os.Stat(containerRoot); err == nil {
@@ -434,8 +431,10 @@ func (c *Container) Destroy() error {
 	log.Debugf("Destroy container %q", c.ID)
 
 	// First stop the container.
-	if err := c.Sandbox.Stop(c.ID); err != nil {
-		return err
+	if c.Sandbox != nil {
+		if err := c.Sandbox.Stop(c.ID); err != nil {
+			return err
+		}
 	}
 
 	// "If any poststop hook fails, the runtime MUST log a warning, but the
diff --git a/runsc/container/container_test.go b/runsc/container/container_test.go
index de487ea97..11285a123 100644
--- a/runsc/container/container_test.go
+++ b/runsc/container/container_test.go
@@ -812,28 +812,6 @@ func TestConsoleSocket(t *testing.T) {
 	}
 }
 
-func TestSpecUnsupported(t *testing.T) {
-	spec := testutil.NewSpecWithArgs("/bin/true")
-	spec.Process.SelinuxLabel = "somelabel"
-
-	// These are normally set by docker and will just cause warnings to be logged.
-	spec.Process.ApparmorProfile = "someprofile"
-	spec.Linux = &specs.Linux{Seccomp: &specs.LinuxSeccomp{}}
-
-	rootDir, bundleDir, conf, err := testutil.SetupContainer(spec)
-	if err != nil {
-		t.Fatalf("error setting up container: %v", err)
-	}
-	defer os.RemoveAll(rootDir)
-	defer os.RemoveAll(bundleDir)
-
-	id := testutil.UniqueContainerID()
-	_, err = container.Create(id, spec, conf, bundleDir, "", "", "")
-	if err == nil || !strings.Contains(err.Error(), "is not supported") {
-		t.Errorf("container.Create() wrong error, got: %v, want: *is not supported, spec.Process: %+v", err, spec.Process)
-	}
-}
-
 // TestRunNonRoot checks that sandbox can be configured when running as
 // non-privileged user.
 func TestRunNonRoot(t *testing.T) {