From a124c7e354da7252a363f3a3eaafb5a81a6d508e Mon Sep 17 00:00:00 2001 From: Samuel Karp Date: Wed, 11 Feb 2026 16:20:09 -0800 Subject: [PATCH 1/2] cri/config: use ScrubLogs by default on Windows The io.containerd.runhcs.v1 shim can scrub sensitive information from logs it emits. Since v0.15.0-rc.2 this is done by default, but older branches still require the option to be explicitly enabled. Explicitly enable the scrubbing by default for the CRI configuration. See also: https://github.com/microsoft/hcsshim/pull/2725 Google-Bug-Id: 481375460 Signed-off-by: Samuel Karp (cherry picked from commit f4e79446256734cddf3f8178edb10a8323264307) --- internal/cri/config/config_windows.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/internal/cri/config/config_windows.go b/internal/cri/config/config_windows.go index ba09f1925b..cce4f93ca5 100644 --- a/internal/cri/config/config_windows.go +++ b/internal/cri/config/config_windows.go @@ -59,6 +59,13 @@ func DefaultRuntimeConfig() RuntimeConfig { "runhcs-wcow-process": { Type: "io.containerd.runhcs.v1", ContainerAnnotations: []string{"io.microsoft.container.*"}, + // Full set of Windows shim options: + // https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options + Options: map[string]interface{}{ + // ScrubLogs enables removing environment variables and other potentially sensitive information + // from logs + "ScrubLogs": true, + }, }, "runhcs-wcow-hypervisor": { Type: "io.containerd.runhcs.v1", @@ -67,6 +74,9 @@ func DefaultRuntimeConfig() RuntimeConfig { // Full set of Windows shim options: // https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options Options: map[string]interface{}{ + // ScrubLogs enables removing environment variables and other potentially sensitive information + // from logs + "ScrubLogs": true, // SandboxIsolation specifies the isolation level of the sandbox. // PROCESS (0) and HYPERVISOR (1) are the valid options. "SandboxIsolation": 1, From 4c93ae6d5e7eaa5957887d469aa610763c2f8b42 Mon Sep 17 00:00:00 2001 From: Samuel Karp Date: Wed, 11 Feb 2026 16:39:39 -0800 Subject: [PATCH 2/2] ctr: add --scrub-logs flag for Windows Adds a new --scrub-logs flag to ctr run on Windows. This flag enables the ScrubLogs option for the io.containerd.runhcs.v1 shim. Assisted-by: gemini-cli Signed-off-by: Samuel Karp (cherry picked from commit 18a01c0020c5d9bdb6d6d4850ffb37b74e6959ee) --- cmd/ctr/commands/run/run_windows.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/cmd/ctr/commands/run/run_windows.go b/cmd/ctr/commands/run/run_windows.go index 60c1f6b3a1..51ee361a06 100644 --- a/cmd/ctr/commands/run/run_windows.go +++ b/cmd/ctr/commands/run/run_windows.go @@ -39,6 +39,10 @@ var platformRunFlags = []cli.Flag{ Name: "isolated", Usage: "Run the container with vm isolation", }, + &cli.BoolFlag{ + Name: "scrub-logs", + Usage: "Scrub sensitive information from the shim logs (Windows only)", + }, } // NewContainer creates a new container @@ -176,9 +180,13 @@ func NewContainer(ctx context.Context, client *containerd.Client, cliContext *cl runtime := cliContext.String("runtime") var runtimeOpts interface{} if runtime == "io.containerd.runhcs.v1" { - runtimeOpts = &options.Options{ + opts := &options.Options{ Debug: cliContext.Bool("debug"), } + if cliContext.IsSet("scrub-logs") { + opts.ScrubLogs = cliContext.Bool("scrub-logs") + } + runtimeOpts = opts } cOpts = append(cOpts, containerd.WithRuntime(runtime, runtimeOpts))