From f4e79446256734cddf3f8178edb10a8323264307 Mon Sep 17 00:00:00 2001 From: Samuel Karp Date: Wed, 11 Feb 2026 16:20:09 -0800 Subject: [PATCH] cri/config: use ScrubLogs by default on Windows The io.containerd.runhcs.v1 shim can scrub sensitive information from logs it emits. Since v0.15.0-rc.2 this is done by default, but older branches still require the option to be explicitly enabled. Explicitly enable the scrubbing by default for the CRI configuration. See also: https://github.com/microsoft/hcsshim/pull/2725 Google-Bug-Id: 481375460 Signed-off-by: Samuel Karp --- internal/cri/config/config_windows.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/internal/cri/config/config_windows.go b/internal/cri/config/config_windows.go index aa5df44742..6db1aa3d72 100644 --- a/internal/cri/config/config_windows.go +++ b/internal/cri/config/config_windows.go @@ -59,6 +59,13 @@ func DefaultRuntimeConfig() RuntimeConfig { "runhcs-wcow-process": { Type: "io.containerd.runhcs.v1", ContainerAnnotations: []string{"io.microsoft.container.*"}, + // Full set of Windows shim options: + // https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options + Options: map[string]any{ + // ScrubLogs enables removing environment variables and other potentially sensitive information + // from logs + "ScrubLogs": true, + }, }, "runhcs-wcow-hypervisor": { Type: "io.containerd.runhcs.v1", @@ -67,6 +74,9 @@ func DefaultRuntimeConfig() RuntimeConfig { // Full set of Windows shim options: // https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options Options: map[string]any{ + // ScrubLogs enables removing environment variables and other potentially sensitive information + // from logs + "ScrubLogs": true, // SandboxIsolation specifies the isolation level of the sandbox. // PROCESS (0) and HYPERVISOR (1) are the valid options. "SandboxIsolation": 1,