Help needed in running clair

[Premfer]

Hi,

I am trying to understand and run Clair using Image quay.io/projectquay/clair:4.1.5 using docker as
docker run --net=host --name=clair -d -v $PWD/clairconf:/config -e CLAIR_MODE=combo -e CLAIR_CONF=/config/config.yml quay.io/projectquay/clair:4.1.5 and the container is running. I tried with klar as well as clairctl to analyse image it is not working. I am getting connection refused at port 6060. With clairctl also connection is reset by peer error is thrown.
Kindly let me know if my understanding and step done is correct and help me with this

[hdonnay]

I tried with klar as well as clairctl to analyse image it is not working. I am getting connection refused at port 6060.

You cannot use klar to talk the to current version of Clair. The connection refused means there's nothing listening on that port; make sure clairctl is talking to the same port that clair is listening on.

[Premfer]

@hdonnay https://github.com/quay/clair/blob/main/config.yaml.sample this is the config I am using, I changed only the db config to point to my db. anything else need to be changed in the config. Any help is appreciated . Thanks.

[Premfer]

@hdonnay if I use clairctl and do i am getting 404 Pls see the below debug log

./clairctl-linux-amd64 -D report --host=http://localhost:8080/ hello-world

2021-09-14T18:58:08+05:30 DBG using text output
2021-09-14T18:58:08+05:30 DBG fetching ref=hello-world
2021-09-14T18:58:13+05:30 DBG found manifest digest=sha256:1b26826f602946860c279fce658f31050cff2c596583af237d971f4629b57792 ref=hello-world
2021-09-14T18:58:13+05:30 DBG method=GET path=/indexer/api/v1/index_report/sha256:1b26826f602946860c279fce658f31050cff2c596583af237d971f4629b57792 status="404 Not Found"
2021-09-14T18:58:13+05:30 DBG need to post manifest manifest=sha256:1b26826f602946860c279fce658f31050cff2c596583af237d971f4629b57792
2021-09-14T18:58:13+05:30 DBG don't have needed manifest manifest=sha256:1b26826f602946860c279fce658f31050cff2c596583af237d971f4629b57792
2021-09-14T18:58:14+05:30 DBG found manifest digest=sha256:1b26826f602946860c279fce658f31050cff2c596583af237d971f4629b57792 ref=hello-world
2021-09-14T18:58:14+05:30 DBG found layers count=1 ref=hello-world
2021-09-14T18:58:16+05:30 DBG method=GET path=/indexer/api/v1/index_report/sha256:1b26826f602946860c279fce658f31050cff2c596583af237d971f4629b57792 status="404 Not Found"
2021-09-14T18:58:16+05:30 DBG need to post manifest manifest=sha256:1b26826f602946860c279fce658f31050cff2c596583af237d971f4629b57792
2021-09-14T18:58:16+05:30 DBG method=POST path=/indexer/api/v1/index_report status="404 Not Found"
2021-09-14T18:58:16+05:30 DBG index error error="unexpected return status: 404" ref=hello-world
2021-09-14T18:58:16+05:30 ERR error="unexpected return status: 404"

[hdonnay]

Is the server listening on that port? The server logs should print where it's listening.

If the server is running in a container, is the network set up correctly?

The POST to /indexer/api/v1/index_report returning a 404 makes me think there's a misconfiguration, as that handler never returns NotFound: indexhandler.go

[Premfer]

@hdonnay Thanks for the help , the server port was in loopback address so connection was refused. But when i run I am getting below certificate error can you please let know what can be done , I have configured docker to pull images fro hub as well as insecure private registry, how can i tell clairctl the same.

./clairctl-linux-amd64\ (4) -D report --host=http://**:8080 postgres:12

2021-09-15T11:29:06+05:30 DBG using text output
2021-09-15T11:29:06+05:30 DBG fetching ref=postgres:12
2021-09-15T11:29:12+05:30 DBG found manifest digest=sha256:26402c048be52bdd109b55b2df66bd73ae59487ebfc209959464c4e40698375b ref=postgres:12
2021-09-15T11:29:12+05:30 DBG method=GET path=/indexer/api/v1/index_report/sha256:26402c048be52bdd109b55b2df66bd73ae59487ebfc209959464c4e40698375b status="404 Not Found"
2021-09-15T11:29:12+05:30 DBG need to post manifest manifest=sha256:26402c048be52bdd109b55b2df66bd73ae59487ebfc209959464c4e40698375b
2021-09-15T11:29:12+05:30 DBG don't have needed manifest manifest=sha256:26402c048be52bdd109b55b2df66bd73ae59487ebfc209959464c4e40698375b
2021-09-15T11:29:14+05:30 DBG found manifest digest=sha256:26402c048be52bdd109b55b2df66bd73ae59487ebfc209959464c4e40698375b ref=postgres:12
2021-09-15T11:29:14+05:30 DBG found layers count=13 ref=postgres:12
2021-09-15T11:29:18+05:30 DBG method=GET path=/indexer/api/v1/index_report/sha256:26402c048be52bdd109b55b2df66bd73ae59487ebfc209959464c4e40698375b status="404 Not Found"
2021-09-15T11:29:18+05:30 DBG need to post manifest manifest=sha256:26402c048be52bdd109b55b2df66bd73ae59487ebfc209959464c4e40698375b
2021-09-15T11:29:18+05:30 DBG method=POST path=/indexer/api/v1/index_report status="201 Created"
2021-09-15T11:29:18+05:30 DBG index error error="indexer error: failed to fetch layers: encountered error while fetching a layer: fetcher: request failed: Get "https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/7e/7e183c298f9056378fd02e5436e62d70eb13e7d9cf196502fc9410ae61554074/data?verify=1631688557-1z9UQTlP2tmzJqeimDMcJrVNIrw%3D\": x509: certificate signed by unknown authority" ref=postgres:12
2021-09-15T11:29:18+05:30 ERR error="indexer error: failed to fetch layers: encountered error while fetching a layer: fetcher: request failed: Get "https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/7e/7e183c298f9056378fd02e5436e62d70eb13e7d9cf196502fc9410ae61554074/data?verify=1631688557-1z9UQTlP2tmzJqeimDMcJrVNIrw%3D\": x509: certificate signed by unknown authority"

[hdonnay]

You can set the SSL_CERT_FILE and SSL_CERT_DIR environment variables as needed to configure the trust roots, if you don't want to add the certificate system-wide.