Repository navigation
Conversation
bumarcell
requested review from
BraveY,
CooooolFrog,
CormickKneey,
EvanCley,
imeoer and
xujihui1985
October 13, 2026 07:26
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2093 +/- ##
==========================================
+ Coverage 65.29% 65.61% +0.31%
==========================================
Files 103 102 -1
Lines 30789 31141 +352
==========================================
+ Hits 20105 20434 +329
- Misses 10684 10707 +23
🚀 New features to boost your workflow:
|
…redentials out of logs
The proxy logged the full `http::Request` with `{:?}` at INFO level whenever a
request was proxied directly to the remote registry, and at DEBUG level on the
non-GET bypass and the P2P paths. The `Debug` output of `http::Request` includes
every header, so the `Authorization` header that containerd sends (ECR tokens,
Harbor/Docker Hub basic auth, bearer tokens) ended up in dfdaemon's logs and in
whatever central log store collects them.
Log only the method and URI in these 13 statements; nothing else about the
messages changes.
Signed-off-by: Jamal Allogie <jamal.allogie@gmail.com>
bumarcell
force-pushed
the
fix/proxy-log-no-request-headers
branch
from
October 22, 2026 08:53
7afcf14 to
46dd92d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The proxy logged the whole
http::Requestwith{:?}(INFO on the direct-to-remote path, DEBUG on the non-GET bypass and P2P paths). TheDebugoutput ofhttp::Requestincludes all headers, so theAuthorizationheader containerd sends (ECR tokens, Harbor/Docker Hub basic auth, bearer tokens) ended up in dfdaemon's logs and in the central log store collecting them.This change logs only the method and URI in those 13 statements. Nothing else about the messages changes.
Related Issue
Fixes #2091
Motivation and Context
Registry credentials must not land in logs that have long retention and broad read access. Observed with client v1.5.5 in Kubernetes with containerd routed through the proxy.
cargo fmt --checkclean.🤖 Generated with Claude Code