From 544e4657dd07284323760fbed2b641b76a6374b7 Mon Sep 17 00:00:00 2001 From: Samuel Karp Date: Wed, 11 Feb 2026 16:20:09 -0800 Subject: [PATCH 1/2] cri/config: use ScrubLogs by default on Windows The io.containerd.runhcs.v1 shim can scrub sensitive information from logs it emits. Since v0.15.0-rc.2 this is done by default, but older branches still require the option to be explicitly enabled. Explicitly enable the scrubbing by default for the CRI configuration. See also: https://github.com/microsoft/hcsshim/pull/2725 Google-Bug-Id: 481375460 Signed-off-by: Samuel Karp (cherry picked from commit f4e79446256734cddf3f8178edb10a8323264307) --- pkg/cri/config/config_windows.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkg/cri/config/config_windows.go b/pkg/cri/config/config_windows.go index d3ba9a3983..2a7700eaff 100644 --- a/pkg/cri/config/config_windows.go +++ b/pkg/cri/config/config_windows.go @@ -42,6 +42,13 @@ func DefaultConfig() PluginConfig { "runhcs-wcow-process": { Type: "io.containerd.runhcs.v1", ContainerAnnotations: []string{"io.microsoft.container.*"}, + // Full set of Windows shim options: + // https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options + Options: map[string]interface{}{ + // ScrubLogs enables removing environment variables and other potentially sensitive information + // from logs + "ScrubLogs": true, + }, }, "runhcs-wcow-hypervisor": { Type: "io.containerd.runhcs.v1", @@ -50,6 +57,9 @@ func DefaultConfig() PluginConfig { // Full set of Windows shim options: // https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options Options: map[string]interface{}{ + // ScrubLogs enables removing environment variables and other potentially sensitive information + // from logs + "ScrubLogs": true, // SandboxIsolation specifies the isolation level of the sandbox. // PROCESS (0) and HYPERVISOR (1) are the valid options. "SandboxIsolation": 1, From cff94ea40f3959d5f77451b9d72365db44e8d153 Mon Sep 17 00:00:00 2001 From: Samuel Karp Date: Wed, 11 Feb 2026 16:39:39 -0800 Subject: [PATCH 2/2] ctr: add --scrub-logs flag for Windows Adds a new --scrub-logs flag to ctr run on Windows. This flag enables the ScrubLogs option for the io.containerd.runhcs.v1 shim. Assisted-by: gemini-cli Signed-off-by: Samuel Karp (cherry picked from commit 18a01c0020c5d9bdb6d6d4850ffb37b74e6959ee) --- cmd/ctr/commands/run/run_windows.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/cmd/ctr/commands/run/run_windows.go b/cmd/ctr/commands/run/run_windows.go index fa0d5e7ccc..c0d504a86c 100644 --- a/cmd/ctr/commands/run/run_windows.go +++ b/cmd/ctr/commands/run/run_windows.go @@ -38,6 +38,10 @@ var platformRunFlags = []cli.Flag{ Name: "isolated", Usage: "Run the container with vm isolation", }, + &cli.BoolFlag{ + Name: "scrub-logs", + Usage: "Scrub sensitive information from the shim logs (Windows only)", + }, } // NewContainer creates a new container @@ -172,9 +176,13 @@ func NewContainer(ctx gocontext.Context, client *containerd.Client, context *cli runtime := context.String("runtime") var runtimeOpts interface{} if runtime == "io.containerd.runhcs.v1" { - runtimeOpts = &options.Options{ + opts := &options.Options{ Debug: context.GlobalBool("debug"), } + if context.IsSet("scrub-logs") { + opts.ScrubLogs = context.Bool("scrub-logs") + } + runtimeOpts = opts } cOpts = append(cOpts, containerd.WithRuntime(runtime, runtimeOpts))