ateapi: reject "pause" as an application container name.

cmd/ateapi/internal/controlapi/actor_template.go

@@ -196,6 +196,17 @@ func ValidateCustom_HTTPGetAction_Path(_ context.Context, _ operation.Operation,
 	return nil
 }
 
+// pauseContainerName is the container the ateom creates for each actor,
+// an application container using the same will would collide with it.
+const pauseContainerName = "pause"
+
+func ValidateCustom_Container_Name(_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *string) field.ErrorList {
+	if *value == pauseContainerName {
+		return field.ErrorList{field.Invalid(fldPath, *value, "is reserved for the sandbox's pause container")}
+	}
+	return nil
+}
+
 // mountPathBadSegmentRE matches '.' or '..' path segments.
 var mountPathBadSegmentRE = regexp.MustCompile(`(^|/)[.][.]?(/|$)`)
 

cmd/ateapi/internal/controlapi/actor_template_test.go

@@ -118,6 +118,12 @@ func TestValidateCreateActorTemplateRequest(t *testing.T) {
 			tmpl.Containers[0].Name = "Main_1"
 		})},
 		field.ErrorList{field.Invalid(field.NewPath("actor_template", "containers").Index(0).Child("name"), "Main_1", "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"container named pause",
+		&ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) {
+			tmpl.Containers[0].Name = "pause"
+		})},
+		field.ErrorList{field.Invalid(field.NewPath("actor_template", "containers").Index(0).Child("name"), "pause", "")},
 	}, {
 		"container missing image",
 		&ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) {

pkg/proto/ateapipb/ateapi.proto

@@ -888,6 +888,7 @@ message OnResumeConfig {
 message Container {
   // +k8s:required
   // +k8s:format=k8s-short-name
+  // +k8s:customValidation # name must not be "pause" as we have it for every actor
   string name = 1;
 
   // +k8s:required