runsc: every CRI-O pod fails since release-20261026.0: "joining UTS namespace ... is not supported"

Description

Since release-20261026.0, no pod starts under CRI-O. RunPodSandbox fails with:

CreateContainer failed: OCI runtime create failed: FetchSpec failed: reading spec: joining UTS namespace "/var/run/utsns/829dab8c-468f-4c5d-a68f-ed7e6f1b8424" is not supported: unknown

The check comes from #12984 (merged as 5eac485b1e), which rejects a root container whose spec gives a UTS namespace path, to fail --uts=host early (#7995):

https://github.com/google/gvisor/blob/0fa6803f2a5991dc066a29fc50414b4a3b519590/runsc/specutils/specutils.go#L189-L193

CRI-O always pins a pod's namespaces (UTS included) with pinns and puts their paths in the spec of the pod's sandbox container. That UTS namespace is a new one created for the pod, not the host's, so the check rejects every CRI-O pod, not only --uts=host.

The same setup works with release-20261019.0, which does not have the check. containerd is not affected.

Expected: a pod's pinned UTS namespace is accepted, as before, and only a path that names the host's UTS namespace is rejected (for example by comparing it with /proc/1/ns/uts), or the path is ignored as it was before #12984.

Steps to reproduce

The setup is the one in g3doc/user_guide/containerd/crio.md: CRI-O 1.37.2, containerd-shim-runsc-v1 as a runtime_type = "vm" runtime, grouping = true in its runsc.toml.

sudo crictl runp --runtime gvisor pod.json

with any pod config, e.g.

{"metadata": {"name": "gvisor-test", "namespace": "default", "uid": "gvisor-test"},
 "log_directory": "/tmp/gvisor-test", "linux": {"cgroup_parent": "gvisor_test.slice"}}

This fails with release-20261026.0 and succeeds with release-20261019.0, on the same host and configuration.

runsc version

release-20261026.0 (fails), release-20261019.0 (works); amd64 tarball from storage.googleapis.com/gvisor/releases

uname

GitHub Actions ubuntu-24.04 runner

kubectl (if using Kubernetes)

Reproduced with crictl against CRI-O 1.37.2 (packages from download.opensuse.org/repositories/isv:/cri-o:/stable:/v1.37); Kubernetes not needed.