Log final LCOW OCI spec; always call go in Makefile

Makefile

@@ -106,10 +106,17 @@ out/delta.tar.gz: bin/init bin/vsockexec bin/cmd/gcs bin/cmd/gcstools bin/cmd/ho
 	tar -zcf $@ -C rootfs .
 	rm -rf rootfs
 
-bin/cmd/gcs bin/cmd/gcstools bin/cmd/hooks/wait-paths bin/cmd/tar2ext4 bin/internal/tools/snp-report:
+# Use force target to always call `go build` per make invocation and rely on Go's build cache
+# to decide if binaries should be (re)built.
+# Note: don't use `.PHONY` since the targets are actual files.
+#
+# www.gnu.org/software/make/manual/html_node/Force-Targets.html
+bin/cmd/gcs bin/cmd/gcstools bin/cmd/hooks/wait-paths bin/cmd/tar2ext4 bin/internal/tools/snp-report: FORCE
 	@mkdir -p $(dir $@)
 	GOOS=linux $(GO_BUILD) -o $@ $(SRCROOT)/$(@:bin/%=%)
 
+FORCE:
+
 bin/vsockexec: vsockexec/vsockexec.o vsockexec/vsock.o
 	@mkdir -p bin
 	$(CC) $(LDFLAGS) -o $@ $^

internal/guest/runtime/hcsv2/uvm.go

@@ -5,6 +5,7 @@ package hcsv2
 
 import (
 	"bufio"
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -643,18 +644,9 @@ func (h *Host) CreateContainer(ctx context.Context, id string, settings *prot.VM
 	if err := os.MkdirAll(settings.OCIBundlePath, 0700); err != nil {
 		return nil, errors.Wrapf(err, "failed to create OCIBundlePath: '%s'", settings.OCIBundlePath)
 	}
-	configFile := path.Join(settings.OCIBundlePath, "config.json")
-	f, err := os.Create(configFile)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to create config.json at: '%s'", configFile)
-	}
-	defer f.Close()
-	writer := bufio.NewWriter(f)
-	if err := json.NewEncoder(writer).Encode(settings.OCISpecification); err != nil {
-		return nil, errors.Wrapf(err, "failed to write OCISpecification to config.json at: '%s'", configFile)
-	}
-	if err := writer.Flush(); err != nil {
-		return nil, errors.Wrapf(err, "failed to flush writer for config.json at: '%s'", configFile)
+
+	if err := writeSpecToFile(ctx, path.Join(settings.OCIBundlePath, "config.json"), settings.OCISpecification); err != nil {
+		return nil, err
 	}
 
 	con, err := h.rtime.CreateContainer(id, settings.OCIBundlePath, nil)
@@ -691,6 +683,45 @@ func (h *Host) CreateContainer(ctx context.Context, id string, settings *prot.VM
 	return c, nil
 }
 
+func writeSpecToFile(ctx context.Context, configFile string, spec *specs.Spec) error {
+	f, err := os.Create(configFile)
+	if err != nil {
+		return errors.Wrapf(err, "failed to create config.json at: '%s'", configFile)
+	}
+	defer f.Close()
+
+	writer := bufio.NewWriter(f)
+	// capture what we write to the config file in a byte buffer so we can log it later
+	var w io.Writer = writer
+	buf := &bytes.Buffer{}
+	if logrus.IsLevelEnabled(logrus.TraceLevel) {
+		w = io.MultiWriter(writer, buf)
+	}
+
+	enc := json.NewEncoder(w)
+	enc.SetEscapeHTML(false) // not embedding JSON into HTML, so no need to escape
+	if err := enc.Encode(spec); err != nil {
+		return errors.Wrapf(err, "failed to write OCISpecification to config.json at: '%s'", configFile)
+	}
+	if err := writer.Flush(); err != nil {
+		return errors.Wrapf(err, "failed to flush writer for config.json at: '%s'", configFile)
+	}
+
+	if logrus.IsLevelEnabled(logrus.TraceLevel) {
+		entry := log.G(ctx).WithField(logfields.Path, configFile)
+
+		if b, err := log.ScrubOCISpec(buf.Bytes()); err != nil {
+			entry.WithError(err).Warning("could not scrub OCI spec written to config.json")
+		} else {
+			log.G(ctx).WithField(
+				"config", string(bytes.TrimSpace(b)),
+			).Trace("wrote OCI spec to config.json")
+		}
+	}
+
+	return nil
+}
+
 func (h *Host) modifyHostSettings(ctx context.Context, containerID string, req *guestrequest.ModificationRequest) (retErr error) {
 	switch req.ResourceType {
 	case guestresource.ResourceTypeSCSIDevice:

internal/log/scrub.go

@@ -11,7 +11,7 @@ import (
 
 // This package scrubs objects of potentially sensitive information to pass to logging
 
-type genMap = map[string]interface{}
+type genMap = map[string]any
 type scrubberFunc func(genMap) error
 
 const _scrubbedReplacement = "<scrubbed>"
@@ -20,7 +20,11 @@ var (
 	ErrUnknownType = errors.New("encoded object is of unknown type")
 
 	// case sensitive keywords, so "env" is not a substring on "Environment"
-	_scrubKeywords = [][]byte{[]byte("env"), []byte("Environment")}
+	_scrubKeywords = [][]byte{
+		[]byte("env"),
+		[]byte("Environment"),
+		[]byte("annotations"),
+	}
 
 	_scrub atomic.Bool
 )
@@ -32,7 +36,7 @@ func SetScrubbing(enable bool) { _scrub.Store(enable) }
 func IsScrubbingEnabled() bool { return _scrub.Load() }
 
 // ScrubProcessParameters scrubs HCS Create Process requests with config parameters of
-// type internal/hcs/schema2.ScrubProcessParameters (aka hcsshema.ScrubProcessParameters)
+// type [hcsschema.ProcessParameters].
 func ScrubProcessParameters(s string) (string, error) {
 	// todo: deal with v1 ProcessConfig
 	b := []byte(s)
@@ -81,19 +85,34 @@ func scrubBridgeCreate(m genMap) error {
 
 func scrubLinuxHostedSystem(m genMap) error {
 	if m, ok := index(m, "OciSpecification"); ok { //nolint:govet // shadow
-		if _, ok := m["annotations"]; ok {
-			m["annotations"] = map[string]string{_scrubbedReplacement: _scrubbedReplacement}
-		}
-		if m, ok := index(m, "process"); ok { //nolint:govet // shadow
-			if _, ok := m["env"]; ok {
-				m["env"] = []string{_scrubbedReplacement}
-				return nil
-			}
-		}
+		return scrubOCISpec(m)
 	}
 	return ErrUnknownType
 }
 
+// ScrubOCISpec scrubs a JSON encoded [github.com/opencontainers/runtime-spec/specs-go.Spec].
+//
+// Ideally the spec struct would be scrubbed directly, but that would need a deep clone to
+// prevent modifying the original, and, absent one implemented on the Spec
+// (e.g., [google.golang.org/protobuf/proto.CloneOf]), unmarshalling a marshalled struct
+// functions as a deep clone.
+func ScrubOCISpec(b []byte) ([]byte, error) {
+	return scrubBytes(b, scrubOCISpec)
+}
+
+func scrubOCISpec(m genMap) error {
+	if _, ok := m["annotations"]; ok {
+		m["annotations"] = map[string]string{_scrubbedReplacement: _scrubbedReplacement}
+	}
+	if m, ok := index(m, "process"); ok { //nolint:govet // shadow
+		if _, ok := m["env"]; ok {
+			m["env"] = []string{_scrubbedReplacement}
+		}
+	}
+
+	return nil
+}
+
 // ScrubBridgeExecProcess scrubs requests sent over the bridge of type
 // internal/gcs/protocol.containerExecuteProcess
 func ScrubBridgeExecProcess(b []byte) ([]byte, error) {