fix: validate Linux spec early to prevent nil dereference panics

Signed-off-by: Rishi Jat <rishijat098@gmail.com>

Author: rishi-jat

pkg/unikontainers/unikontainers.go

@@ -51,6 +51,7 @@ var uniklog = logrus.WithField("subsystem", "unikontainers")
 var ErrQueueProxy = errors.New("this a queue proxy container")
 var ErrNotUnikernel = errors.New("this is not a unikernel container")
 var ErrNotExistingNS = errors.New("the namespace does not exist")
+var ErrMissingLinuxSpec = errors.New("invalid OCI spec: linux section is required")
 
 // Unikontainer holds the data necessary to create, manage and delete unikernel containers
 type Unikontainer struct {
@@ -70,6 +71,10 @@ func New(bundlePath string, containerID string, rootDir string, cfg *UruncConfig
 		return nil, err
 	}
 
+	if spec == nil || spec.Linux == nil {
+		return nil, ErrMissingLinuxSpec
+	}
+
 	containerName := spec.Annotations["io.kubernetes.cri.container-name"]
 	if containerName == "queue-proxy" {
 		uniklog.Warn("This is a queue-proxy container. Adding IP env.")
@@ -125,6 +130,9 @@ func Get(containerID string, rootDir string) (*Unikontainer, error) {
 	if err != nil {
 		return nil, err
 	}
+	if spec == nil || spec.Linux == nil {
+		return nil, ErrMissingLinuxSpec
+	}
 	u.BaseDir = containerDir
 	u.RootDir = rootDir
 	u.Spec = spec
@@ -357,7 +365,7 @@ func (u *Unikontainer) Exec(metrics m.Writer) error {
 
 	// ExecArgs
 	// If memory limit is set in spec, use it instead of the config default value
-	if u.Spec.Linux.Resources.Memory != nil {
+	if u.Spec.Linux.Resources != nil && u.Spec.Linux.Resources.Memory != nil {
 		if u.Spec.Linux.Resources.Memory.Limit != nil {
 			if *u.Spec.Linux.Resources.Memory.Limit > 0 {
 				vmmArgs.MemSizeB = uint64(*u.Spec.Linux.Resources.Memory.Limit) // nolint:gosec