From 51e3a8f4ab30363239cce0de9f4aaf3927b82887 Mon Sep 17 00:00:00 2001
From: Albin Kerouanton <albin.kerouanton@docker.com>
Date: Wed, 24 Jun 2026 10:08:13 +0200
Subject: [PATCH] oci: use path.Join to fill CgroupsPath

`populateDefaultUnixSpec` uses `filepath.Join` to generate the default
`CgroupsPath`. On Windows, this produces invalid paths as path elems are
joined with backslash. Switch to `path.Join` instead.

Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
---
 pkg/oci/spec.go      | 4 ++--
 pkg/oci/spec_test.go | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkg/oci/spec.go b/pkg/oci/spec.go
index 06a97580ad..b629aa52bc 100644
--- a/pkg/oci/spec.go
+++ b/pkg/oci/spec.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"encoding/json"
 	"os"
-	"path/filepath"
+	"path"
 	"runtime"
 
 	"github.com/opencontainers/go-digest"
@@ -206,7 +206,7 @@ func populateDefaultUnixSpec(ctx context.Context, s *Spec, id string) error {
 				"/proc/sys",
 				"/proc/sysrq-trigger",
 			},
-			CgroupsPath: filepath.Join("/", ns, id),
+			CgroupsPath: path.Join("/", ns, id),
 			Resources: &specs.LinuxResources{
 				Devices: []specs.LinuxDeviceCgroup{
 					{
diff --git a/pkg/oci/spec_test.go b/pkg/oci/spec_test.go
index 0bb0f5cbe6..72c7cd62bb 100644
--- a/pkg/oci/spec_test.go
+++ b/pkg/oci/spec_test.go
@@ -23,6 +23,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 
 	"github.com/containerd/containerd/v2/core/containers"
@@ -253,6 +254,12 @@ func TestPopulateDefaultUnixSpec(t *testing.T) {
 	if expected.Linux == nil {
 		t.Error("Cannot populate Unix Spec")
 	}
+
+	// CgroupsPath should never contain backslashes when the spec is generated
+	// on Windows.
+	if strings.Contains(expected.Linux.CgroupsPath, "\\") {
+		t.Errorf("CgroupsPath contains backslashes: %s", expected.Linux.CgroupsPath)
+	}
 }
 
 func TestWithPrivileged(t *testing.T) {