Fix nil pointer dereference in container spec memory metrics

ymichaelson · k8s-infra-cherrypick-robot · commit 4be4e5156c1b · 2025-12-27T05:21:56.000Z
Add nil checks for Memory.Limit, Memory.Reservation, and Memory.Swap
before dereferencing them in extractContainerSpecMetrics. These fields
are optional pointers in OCI runtime spec and can be nil when not set.

- Memory.Limit: Set from Pod resources.limits.memory
- Memory.Reservation: Only set via NRI plugins (rarely used)
- Memory.Swap: Set from memory_swap_limit_in_bytes (optional)

This prevents potential panic when collecting metrics from containers
that don't have all memory limits configured, and makes the code
consistent with CPU resource handling and helpers.go.

Signed-off-by: You Binhao &lt;ymichaelson.0713@gmail.com&gt;
diff --git a/internal/cri/server/list_pod_sandbox_metrics_linux.go b/internal/cri/server/list_pod_sandbox_metrics_linux.go
@@ -991,48 +991,54 @@ func (c *criService) extractContainerSpecMetrics(ctx context.Context, containerI
 	}
 
 	if cpuResource := resource.CPU; cpuResource != nil {
-		metrics = append(metrics, []*runtime.Metric{
-			{
+		if cpuResource.Period != nil {
+			metrics = append(metrics, &runtime.Metric{
 				Name:        "container_spec_cpu_period",
 				Timestamp:   timestamp,
 				MetricType:  runtime.MetricType_GAUGE,
 				LabelValues: labels,
 				Value:       &runtime.UInt64Value{Value: *cpuResource.Period},
-			},
-			{
+			})
+		}
+		if cpuResource.Shares != nil {
+			metrics = append(metrics, &runtime.Metric{
 				Name:        "container_spec_cpu_shares",
 				Timestamp:   timestamp,
 				MetricType:  runtime.MetricType_GAUGE,
 				LabelValues: labels,
 				Value:       &runtime.UInt64Value{Value: *cpuResource.Shares},
-			},
-		}...)
+			})
+		}
 	}
 
 	if memoryResource := resource.Memory; memoryResource != nil {
-		metrics = append(metrics, []*runtime.Metric{
-			{
+		if memoryResource.Limit != nil {
+			metrics = append(metrics, &runtime.Metric{
 				Name:        "container_spec_memory_limit_bytes",
 				Timestamp:   timestamp,
 				MetricType:  runtime.MetricType_GAUGE,
 				LabelValues: labels,
 				Value:       &runtime.UInt64Value{Value: uint64(*memoryResource.Limit)},
-			},
-			{
+			})
+		}
+		if memoryResource.Reservation != nil {
+			metrics = append(metrics, &runtime.Metric{
 				Name:        "container_spec_memory_reservation_limit_bytes",
 				Timestamp:   timestamp,
 				MetricType:  runtime.MetricType_GAUGE,
 				LabelValues: labels,
 				Value:       &runtime.UInt64Value{Value: uint64(*memoryResource.Reservation)},
-			},
-			{
+			})
+		}
+		if memoryResource.Swap != nil {
+			metrics = append(metrics, &runtime.Metric{
 				Name:        "container_spec_memory_swap_limit_bytes",
 				Timestamp:   timestamp,
 				MetricType:  runtime.MetricType_GAUGE,
 				LabelValues: labels,
 				Value:       &runtime.UInt64Value{Value: uint64(*memoryResource.Swap)},
-			},
-		}...)
+			})
+		}
 	}
 	return metrics, nil
 }
