From 5febb347e5add555003db5466b24c43d102bbbc5 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Tue, 7 Jul 2026 10:34:33 +0200
Subject: [PATCH] policy: close memoized policy filesystems

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 build/policy_loader.go      | 20 ++++++++++++++++++--
 build/policy_loader_test.go | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 2 deletions(-)

diff --git a/build/policy_loader.go b/build/policy_loader.go
index 61c68018160a..a97bc6ba8f45 100644
--- a/build/policy_loader.go
+++ b/build/policy_loader.go
@@ -179,10 +179,10 @@ func (p *policyPathFS) Stat(name string) (fs.FileInfo, error) {
 }
 
 func (p *policyPathFS) Close() error {
-	if err := p.cwdFS.close(); err != nil {
+	if err := p.cwdFS.closeAll(); err != nil {
 		return err
 	}
-	return p.contextFS.close()
+	return p.contextFS.closeAll()
 }
 
 func (p *policyPathFS) resolve(name string) (fs.StatFS, string, error) {
@@ -274,6 +274,22 @@ func (m *memoizedPolicyFS) close() error {
 	return nil
 }
 
+func (m *memoizedPolicyFS) closeAll() error {
+	m.mu.Lock()
+	closeFn := m.closeFn
+	m.fs = nil
+	m.closeFn = nil
+	m.err = nil
+	m.loaded = false
+	m.refs = 0
+	m.mu.Unlock()
+
+	if closeFn != nil {
+		return closeFn()
+	}
+	return nil
+}
+
 func normalizeRemotePolicyPath(raw string) (string, error) {
 	clean := strings.TrimPrefix(path.Join("/", filepath.ToSlash(raw)), "/")
 	if clean == "." || clean == "" {
diff --git a/build/policy_loader_test.go b/build/policy_loader_test.go
index 584f3150435b..df7ff20b0eae 100644
--- a/build/policy_loader_test.go
+++ b/build/policy_loader_test.go
@@ -83,3 +83,40 @@ func TestMemoizedPolicyFSReinitializesAfterAllRefsClosed(t *testing.T) {
 	require.NoError(t, m.close())
 	require.Equal(t, 2, closeCalls)
 }
+
+func TestMemoizedPolicyFSCloseAll(t *testing.T) {
+	var initCalls int
+	var closeCalls int
+
+	m := &memoizedPolicyFS{
+		init: func() (fs.StatFS, func() error, error) {
+			initCalls++
+			root := fstest.MapFS{
+				"policy.rego": &fstest.MapFile{Data: []byte("package docker\n")},
+			}
+			return root, func() error {
+				closeCalls++
+				return nil
+			}, nil
+		},
+	}
+
+	first, err := m.get()
+	require.NoError(t, err)
+	require.NotNil(t, first)
+	second, err := m.get()
+	require.NoError(t, err)
+	require.NotNil(t, second)
+	require.Equal(t, 1, initCalls)
+
+	require.NoError(t, m.closeAll())
+	require.Equal(t, 1, closeCalls)
+
+	third, err := m.get()
+	require.NoError(t, err)
+	require.NotNil(t, third)
+	require.Equal(t, 2, initCalls)
+
+	require.NoError(t, m.closeAll())
+	require.Equal(t, 2, closeCalls)
+}