fix(unikontainers): validate containerID before path construction

[Syedowais312]

Description

Constructing a containerDir path from an unvalidated containerID before calling filepath.Join + os.RemoveAll is a path traversal risk. A malicious ID like ../../etc/cron.d passes through filepath.Join unchanged and escapes rootDir.

This PR adds ValidateID to pkg/unikontainers, mirroring runc's validateID in libcontainer/factory_linux.go. Allowed characters: a-z A-Z 0-9 _ + - .

Changes:

• Add ValidateID and ErrInvalidContainerID to pkg/unikontainers/unikontainers.go
• Call ValidateID at the top of New() and Get() where filepath.Join(rootDir, containerID) actually executes
• Call ValidateID in the ErrNotExist fallback in delete.go the original bug site. This branch re-reads containerID from args and calls os.RemoveAll directly without going through New or Get
• Add early-exit calls in getUnikontainer() and createUnikontainer() at the cmd layer for fast failure

session.go in the containerd-shim is intentionally not touched containerID there comes from the containerd API, not raw CLI input.

Related issues

• Fixes we should probably validate containerID before constructing the containerDir path #714

How was this tested?

Built two binaries from the same codebase one before and one after the patch and ran both against a malicious container ID:

LLM usage

N/A

Checklist

• I have read the contribution guide.
• The linter passes locally (make lint).
• The e2e tests of at least one tool pass locally (make test_ctr, make test_nerdctl, make test_docker, make test_crictl).
  My changes only add input validation before path construction and do not affect container execution logic, so e2e behavior is unchanged.
• If LLMs were used: I have read the llm policy.

[netlify]

✅ Deploy Preview for urunc canceled.

Name	Link
🔨 Latest commit	175fee5
🔍 Latest deploy log	https://app.netlify.com/projects/urunc/deploys/6a3a4d3ad9d9a9000837267c

[Syedowais312]

Hey @cmainas,
Please take a look when you have time.

Also for the securejoin improvement we discussed in the issue, would you prefer that as a separate PR after this one, since it would involve changes across multiple path construction sites?

[cmainas]

Duplicate with #726