fix(plugins/container): guard against nil RuntimeSpec in CNI fallback

containerd v2.3.0 (CRI API v0.36) does not populate the runtimeSpec
field in sandbox info JSON. This field is cri-o specific. When
CNIResult is also absent, the fallback branch dereferences a nil
pointer in cniSandboxInfo.RuntimeSpec.Annotations and the plugin
panics. All Falco DaemonSet pods on a containerd v2.3.0 node go into
CrashLoopBackOff.

Wrap the annotation lookup in a nil check, matching the existing
pattern used for info.RuntimeSpec at cri.go:92 and :126.

Closes #1353

Signed-off-by: Raajhesh Kannaa Chidambaram <495042+raajheshkannaa@users.noreply.github.com>

Author: raajheshkannaa

plugins/container/go-worker/pkg/container/cri.go

@@ -240,8 +240,10 @@ func (c *criEngine) ctrToInfo(ctx context.Context, ctr *v1.ContainerStatus, podS
 				if err != nil {
 					cniJson = string(bytes)
 				}
-			} else if val, ok := cniInfo.RuntimeSpec.Annotations["io.kubernetes.cri-o.CNIResult"]; ok {
-				cniJson = val
+			} else if cniInfo.RuntimeSpec != nil {
+				if val, ok := cniInfo.RuntimeSpec.Annotations["io.kubernetes.cri-o.CNIResult"]; ok {
+					cniJson = val
+				}
 			}
 
 			if len(cniJson) > maxCNILen {