shim: skip SandboxPlatform validation when platform is not explicitly set (#2620)

When runtime options are non-empty (e.g., SandboxIsolation is set) but
SandboxPlatform is empty, skip the platform validation rather than
failing. The validation only needs to check that the spec and shim
options match when SandboxPlatform is explicitly configured.

containerd's default config (config_windows.go) sets SandboxIsolation=1
for the runhcs-wcow-hypervisor runtime handler but omits SandboxPlatform,
making options non-empty with an empty platform string. This causes
platforms.Parse("") to fail with 'invalid runtime sandbox platform'.

Signed-off-by: Dawei Wei <wei.dawei.cn@gmail.com>
(cherry picked from commit 88c818f)

Author: rzlink

cmd/containerd-shim-runhcs-v1/service_internal.go

@@ -129,7 +129,7 @@ func (s *service) createInternal(ctx context.Context, req *task.CreateTaskReques
 		return nil, fmt.Errorf("invalid runtime sandbox isolation (%s) for hypervisor isolated OCI spec", isolation.String())
 	}
 
-	if !emptyShimOpts {
+	if !emptyShimOpts && shimOpts.GetSandboxPlatform() != "" {
 		// validate runtime platform
 		plat, err := platforms.Parse(shimOpts.GetSandboxPlatform())
 		if err != nil {