dilim/containerd
1
0
Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-08-09 01:21:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

cri/config: use ScrubLogs by default on Windows

Browse Source 
The io.containerd.runhcs.v1 shim can scrub sensitive information from
logs it emits. Since v0.15.0-rc.2 this is done by default, but older
branches still require the option to be explicitly enabled. Explicitly
enable the scrubbing by default for the CRI configuration.

See also: https://github.com/microsoft/hcsshim/pull/2725

Google-Bug-Id: 481375460
Signed-off-by: Samuel Karp <samuelkarp@google.com>
This commit is contained in:
Samuel Karp
2026-02-11 16:20:09 -08:00
parent ffcf715dfa
commit f4e7944625
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
internal/cri/config/config_windows.go
View File

@@ -59,6 +59,13 @@ func DefaultRuntimeConfig() RuntimeConfig {
"runhcs-wcow-process": {
Type: "io.containerd.runhcs.v1",
ContainerAnnotations: []string{"io.microsoft.container.*"},
// Full set of Windows shim options:
// https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options
Options: map[string]any{
// ScrubLogs enables removing environment variables and other potentially sensitive information
// from logs
"ScrubLogs": true,
},
},
"runhcs-wcow-hypervisor": {
Type: "io.containerd.runhcs.v1",
@@ -67,6 +74,9 @@ func DefaultRuntimeConfig() RuntimeConfig {
// Full set of Windows shim options:
// https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options
Options: map[string]any{
// ScrubLogs enables removing environment variables and other potentially sensitive information
// from logs
"ScrubLogs": true,
// SandboxIsolation specifies the isolation level of the sandbox.
// PROCESS (0) and HYPERVISOR (1) are the valid options.
"SandboxIsolation": 1,