Is Clair actually working? #2098
Comments
Yes.
What do the logs say? Clair only returns 503 on the ready check, so if you saw that on the API port, it would be in the traefik logs. git grep
I don't know what would be happening there, I suspect looking at the logs would shed light on it. In any case, if it's just skopeo talking to quay, that'd be a quay issue.
I don't know what you mean "wrong/missing configurations in the
This would be a quay or a Red Hat problem.
Yeah, I don't know what this is; it seems old and unmaintained. |
|
Thank you for the quick reply and thanks even more for the given command ( The game changer was the For example, in the Submitting A Manifest section, Anyways, as this works now, still would you like to check the logs from our previous tries (items 1 to 4)? If so, I'll provide them. Otherwise, this issue can be closed. That's it and thank you so much again for the support! |
|
Great to hear.
Ah, this old chestnut. It's just a limitation of the package used that there are two groups of flags, and they're position-dependent. I'll make a note to go re-read through the documentation with an eye for this. |
|
Hello again! I'm reopening this issue to report/ask about a new little problem. Basically, sometimes Clair gives the expected vulnerability report, but most of the time just prints an Considering we're using, in both good and bad attempts, the same correct clairctl command (given by you - thanks again) and the same Docker image, what may cause this behavior and how to fix? Here is the debug logs from a bad report of an old and vulnerable image ( clairctl logclair-traefik logclair-indexer logclair-matcher logclair-database log
|
|
I think the buster data has been removed, but I'm not sure. It's hard to say if there's anything wrong without the index and vulnerability reports and looking at the state of the vulnerability database. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description of Problem / Feature Request
Hello! I'm collaborating with an academic research about Docker security and we would like to add Clair in our analysis, but we're having so many troubles to make this work... I mean, we tried to use the upstream and 4.7.4 Clair versions, followed the Clair documentation and the Red Hat documentation, downgraded Docker to the 19.3.13 version, used clairctl and Skopeo, and so many other things, but without any success 🥲
So, going straight forward, is Clair actually working? If yes, where can we find a proper guide to make this work? I know this sounds like we've some skill issue, but I swear that we tried everything possible (the summarized list of tries is below)
Thanks in advance!
Expected Outcome
Just work
Actual Outcome
Doesn't work
And here's the list of our tries (with a quick diagnostic due to the amount of items, so logs will be provided as you need):
config.yaml(even trying to fix the typos and removing what cause crashes, it still doesn't initiate)quay-server.example.com). In this case, the use of--network=hostmakes it reach this hostname, so it stops dying, however the container and its ports turns fully unreachableRemembering that ALL the items above were tested with both upstream and 4.7.4 Clair versions, and both Docker 27.0.3 and 19.3.13 (in some "compatible" cases).
Environment
uname -a): Linux debian 6.1.0-23-amd64 # 1 SMP PREEMPT_DYNAMIC Debian 6.1.99-1 (2024-07-15) x86_64 GNU/Linuxkubectl version): N/AThe text was updated successfully, but these errors were encountered: