Skip to content
This repository has been archived by the owner on Nov 29, 2023. It is now read-only.

Linux docker scan not working for locally built/cache image #151

Closed
ericsmalling opened this issue Apr 22, 2021 · 1 comment · Fixed by #152
Closed

Linux docker scan not working for locally built/cache image #151

ericsmalling opened this issue Apr 22, 2021 · 1 comment · Fixed by #152

Comments

@ericsmalling
Copy link

Description
On Ubuntu VM (tested on both 20.04.1 and 18.04.5) docker scan is erroring trying to scan an image I built locally with the following:

vagrant@ubuntu-focal:~/goof$ docker image ls
REPOSITORY   TAG       IMAGE ID       CREATED         SIZE
goof         latest    5e25129436a9   4 minutes ago   1.09GB
snyk/snyk    <none>    6fda31b366a0   7 weeks ago     113MB
node         14.1.0    a511eb5c14ec   11 months ago   941MB
vagrant@ubuntu-focal:~/goof$ docker scan goof
Failed to scan image "goof". Please make sure the image and/or repository exist, and that you are using the correct credentials.
vagrant@ubuntu-focal:~/goof$ docker scan goof:latest
Failed to scan image "goof:latest". Please make sure the image and/or repository exist, and that you are using the correct credentials.

Steps to reproduce the issue:

  1. Build an image
  2. docker scan [image]

Describe the results you received:
Getting the error shown above

Describe the results you expected:
Snyk scan results

Additional information you deem important (e.g. issue happens only occasionally):
Have done a docker scan --login successfully previously.
Also have tried with or without having done a docker login

Output of docker version:

Client: Docker Engine - Community
 Version:           20.10.6
 API version:       1.41
 Go version:        go1.13.15
 Git commit:        370c289
 Built:             Fri Apr  9 22:47:17 2021
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.6
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.13.15
  Git commit:       8728dd2
  Built:            Fri Apr  9 22:45:28 2021
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.4.4
  GitCommit:        05f951a3781f4f2c1911b05e61c160e9c30eaa8e
 runc:
  Version:          1.0.0-rc93
  GitCommit:        12644e614e25b05da6fd08a38ffa0cfe1903fdec
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Output of docker scan --version:

Version:    v0.7.0
Git commit: 0b3c564
Provider:   Snyk (1.461.0 (standalone))

Output of docker info:

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.5.1-docker)
  scan: Docker Scan (Docker Inc., v0.7.0)

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 15
 Server Version: 20.10.6
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 05f951a3781f4f2c1911b05e61c160e9c30eaa8e
 runc version: 12644e614e25b05da6fd08a38ffa0cfe1903fdec
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: default
 Kernel Version: 5.4.0-56-generic
 Operating System: Ubuntu 20.04.1 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 5.807GiB
 Name: ubuntu-focal
 ID: UY3G:XY2P:Y4MF:WF52:BD7B:MFKG:WF6W:DQKK:SVVQ:XHK3:JKO7:H2EW
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Username: ericsmalling
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.):
VirtualBox as defined in https://github.com/ericsmalling/vagrantfiles/blob/main/docker-ce/Vagrantfile
Also seeing the same behavior on an AWS Cloud9 instance running on Ubuntu 18.04.5 instance.
@ericsmalling
Copy link
Author

ericsmalling commented Apr 22, 2021 •
edited
Loading

Grabbed a container inspect of the snyk container:

$ docker inspect b93b53fcaf4238c3a25ec35dfbb989abef20ab06510f972eeea39b8869a90987 | jq
[
  {
    "Id": "b93b53fcaf4238c3a25ec35dfbb989abef20ab06510f972eeea39b8869a90987",
    "Created": "2021-04-21T23:47:43.527759711Z",
    "Path": "snyk",
    "Args": [
      "container",
      "test",
      "goof:latest"
    ],
    "State": {
      "Status": "exited",
      "Running": false,
      "Paused": false,
      "Restarting": false,
      "OOMKilled": false,
      "Dead": false,
      "Pid": 0,
      "ExitCode": 2,
      "Error": "",
      "StartedAt": "2021-04-21T23:47:43.86746751Z",
      "FinishedAt": "2021-04-21T23:47:44.956907304Z"
    },
    "Image": "sha256:6fda31b366a0decd43c786fa715c939f35eae139d6c2f2b1a4a5c1a50dfeb797",
    "ResolvConfPath": "/var/lib/docker/containers/b93b53fcaf4238c3a25ec35dfbb989abef20ab06510f972eeea39b8869a90987/resolv.conf",
    "HostnamePath": "/var/lib/docker/containers/b93b53fcaf4238c3a25ec35dfbb989abef20ab06510f972eeea39b8869a90987/hostname",
    "HostsPath": "/var/lib/docker/containers/b93b53fcaf4238c3a25ec35dfbb989abef20ab06510f972eeea39b8869a90987/hosts",
    "LogPath": "/var/lib/docker/containers/b93b53fcaf4238c3a25ec35dfbb989abef20ab06510f972eeea39b8869a90987/b93b53fcaf4238c3a25ec35dfbb989abef20ab06510f972eeea39b8869a90987-json.log",
    "Name": "/awesome_bardeen",
    "RestartCount": 0,
    "Driver": "overlay2",
    "Platform": "linux",
    "MountLabel": "",
    "ProcessLabel": "",
    "AppArmorProfile": "docker-default",
    "ExecIDs": null,
    "HostConfig": {
      "Binds": [
        "/var/run/docker.sock:/var/run/docker.sock"
      ],
      "ContainerIDFile": "",
      "LogConfig": {
        "Type": "json-file",
        "Config": {}
      },
      "NetworkMode": "default",
      "PortBindings": null,
      "RestartPolicy": {
        "Name": "",
        "MaximumRetryCount": 0
      },
      "AutoRemove": false,
      "VolumeDriver": "",
      "VolumesFrom": null,
      "CapAdd": null,
      "CapDrop": null,
      "CgroupnsMode": "host",
      "Dns": null,
      "DnsOptions": null,
      "DnsSearch": null,
      "ExtraHosts": null,
      "GroupAdd": null,
      "IpcMode": "private",
      "Cgroup": "",
      "Links": null,
      "OomScoreAdj": 0,
      "PidMode": "",
      "Privileged": false,
      "PublishAllPorts": false,
      "ReadonlyRootfs": false,
      "SecurityOpt": null,
      "UTSMode": "",
      "UsernsMode": "",
      "ShmSize": 67108864,
      "Runtime": "runc",
      "ConsoleSize": [
        0,
        0
      ],
      "Isolation": "",
      "CpuShares": 0,
      "Memory": 0,
      "NanoCpus": 0,
      "CgroupParent": "",
      "BlkioWeight": 0,
      "BlkioWeightDevice": null,
      "BlkioDeviceReadBps": null,
      "BlkioDeviceWriteBps": null,
      "BlkioDeviceReadIOps": null,
      "BlkioDeviceWriteIOps": null,
      "CpuPeriod": 0,
      "CpuQuota": 0,
      "CpuRealtimePeriod": 0,
      "CpuRealtimeRuntime": 0,
      "CpusetCpus": "",
      "CpusetMems": "",
      "Devices": null,
      "DeviceCgroupRules": null,
      "DeviceRequests": null,
      "KernelMemory": 0,
      "KernelMemoryTCP": 0,
      "MemoryReservation": 0,
      "MemorySwap": 0,
      "MemorySwappiness": null,
      "OomKillDisable": false,
      "PidsLimit": null,
      "Ulimits": null,
      "CpuCount": 0,
      "CpuPercent": 0,
      "IOMaximumIOps": 0,
      "IOMaximumBandwidth": 0,
      "MaskedPaths": [
        "/proc/asound",
        "/proc/acpi",
        "/proc/kcore",
        "/proc/keys",
        "/proc/latency_stats",
        "/proc/timer_list",
        "/proc/timer_stats",
        "/proc/sched_debug",
        "/proc/scsi",
        "/sys/firmware"
      ],
      "ReadonlyPaths": [
        "/proc/bus",
        "/proc/fs",
        "/proc/irq",
        "/proc/sys",
        "/proc/sysrq-trigger"
      ]
    },
    "GraphDriver": {
      "Data": {
        "LowerDir": "/var/lib/docker/overlay2/6a643db5d91619e2dc9bde4a40721162afea60b89cef3b5da28bccba79c456fb-init/diff:/var/lib/docker/overlay2/7d629936427c01d602322e9ae458828a4680dca5a678327f08e1f46d599bc2b7/diff:/var/lib/docker/overlay2/3b10e859a9fbdfc55b465878931660baf008914bd3b186aa7fc1a4e293c7142e/diff:/var/lib/docker/overlay2/25b10af29a3210a718732a409a3bd36a1b14fd5d30591e06610584573fc61984/diff:/var/lib/docker/overlay2/fb4b643c04a28890a70218a38c9440b3a2d37e05610320d74570ee0391d8cd43/diff:/var/lib/docker/overlay2/f60fa95c0c5716fb7576a22e5ecd163744c7bc33a9f57686ec0b3dbc69ed1b7b/diff",
        "MergedDir": "/var/lib/docker/overlay2/6a643db5d91619e2dc9bde4a40721162afea60b89cef3b5da28bccba79c456fb/merged",
        "UpperDir": "/var/lib/docker/overlay2/6a643db5d91619e2dc9bde4a40721162afea60b89cef3b5da28bccba79c456fb/diff",
        "WorkDir": "/var/lib/docker/overlay2/6a643db5d91619e2dc9bde4a40721162afea60b89cef3b5da28bccba79c456fb/work"
      },
      "Name": "overlay2"
    },
    "Mounts": [
      {
        "Type": "bind",
        "Source": "/var/run/docker.sock",
        "Destination": "/var/run/docker.sock",
        "Mode": "",
        "RW": true,
        "Propagation": "rprivate"
      }
    ],
    "Config": {
      "Hostname": "b93b53fcaf42",
      "Domainname": "",
      "User": "",
      "AttachStdin": false,
      "AttachStdout": true,
      "AttachStderr": true,
      "Tty": false,
      "OpenStdin": false,
      "StdinOnce": false,
      "Env": [
        "SNYK_TOKEN=*************",
        "NO_UPDATE_NOTIFIER=true",
        "SNYK_CFG_DISABLESUGGESTIONS=true",
        "SNYK_INTEGRATION_NAME=DOCKER_DESKTOP",
        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
        "MAVEN_CONFIG=",
        "SNYK_INTEGRATION_VERSION="
      ],
      "Cmd": null,
      "Image": "snyk/snyk@sha256:b0353b1e0530a10c854f0ddeb871749490301c57c17ff1229fab3cd0b96cff23",
      "Volumes": null,
      "WorkingDir": "/app",
      "Entrypoint": [
        "snyk",
        "container",
        "test",
        "goof:latest"
      ],
      "OnBuild": null,
      "Labels": {
        "org.opencontainers.image.created": "2021-02-28T00:47:36Z",
        "org.opencontainers.image.revision": "829c9dab66d2e215744c04500b0b68853c8dea3d",
        "org.opencontainers.image.source": "https://github.com/snyk/snyk-images"
      }
    },
    "NetworkSettings": {
      "Bridge": "",
      "SandboxID": "178d60d189cc63ca9fff67eda18115bfd45fb62ec76b351b3562d98d5c7d823a",
      "HairpinMode": false,
      "LinkLocalIPv6Address": "",
      "LinkLocalIPv6PrefixLen": 0,
      "Ports": {},
      "SandboxKey": "/var/run/docker/netns/178d60d189cc",
      "SecondaryIPAddresses": null,
      "SecondaryIPv6Addresses": null,
      "EndpointID": "",
      "Gateway": "",
      "GlobalIPv6Address": "",
      "GlobalIPv6PrefixLen": 0,
      "IPAddress": "",
      "IPPrefixLen": 0,
      "IPv6Gateway": "",
      "MacAddress": "",
      "Networks": {
        "bridge": {
          "IPAMConfig": null,
          "Links": null,
          "Aliases": null,
          "NetworkID": "c6a7ef1699591956875b66524806eff2b8ab4064bae4895e31738d9acb60cd15",
          "EndpointID": "",
          "Gateway": "",
          "IPAddress": "",
          "IPPrefixLen": 0,
          "IPv6Gateway": "",
          "GlobalIPv6Address": "",
          "GlobalIPv6PrefixLen": 0,
          "MacAddress": "",
          "DriverOpts": null
        }
      }
    }
  }
]```

@glours glours mentioned this issue Apr 22, 2021
Merged
@glours glours mentioned this issue Apr 26, 2021
Closed
# for free to subscribe to this conversation on GitHub. Already have an account? #.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix issue when scanning a local image with the snyk containerized pro… docker/scan-cli-plugin
1 participant
@ericsmalling