Error during setup of clairctl for container scanning with clair

Question

I am trying to setup clairctl to scan our application images and so wanted to install the full stack of clairctl, clair scanner & postgress database. I did the following steps:

1. Acquired a VM running CentOS 7, 2 vCPU and 8 GB RAM.
2. Installed docker-compose as described here: https:// www.linuxhelp.com/how-to-install-docker-compose-on-centos-7.
3. Installed GO as described here: https:// linuxize.com/post/how-to-install-go-on-centos-7.
4. Downloaded and installed clairctl by referring to this page: https:// github.com/jgsqware/clairctl. In this step I faced some problems and tried to work around them as described below.

i) Downloaded the binary release of clairctl by running “curl -L https:// raw.githubusercontent.com/jgsqware/clairctl/master/install.sh | sh”

ii) Executed the command “git clone [email protected]:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl” which failed with error message

[root@clair-server ~]# git clone [email protected]:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl
Cloning into '/src/github.com/jgsqware/clairctl'...
The authenticity of host 'github.com (192.30.253.113)' can't be established.
RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
RSA key fingerprint is MD5:16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'github.com,192.30.253.113' (RSA) to the list of known hosts.
Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository exists.
[root@clair-server ~]#

So did the following to workaround the problem. If this is a generic issue which could affect many, you may want to update the project’s README.md with the workaround so that it helps other users of clairctl.

git clone git clone https:// github.com/jgsqware/clairctl.git
export GOPATH=$PATH:~/go
mkdir -p $GOPATH/src/github.com/jgsqware/clairctl
mv clairctl $GOPATH/src/github.com/jgsqware/

iii) Then executed the commands below which passed:

cd $GOPATH/src/github.com/jgsqware/clairctl
docker-compose up -d postgres

iv) Then executed the command “docker-compose exec clairctl clairctl health” which failed with error. I Googled about this error, examined the file docker-compose.yml. Based on it, I executed “docker-compose up -d clairctl” which is not mentioned. This is when images for clair and clairctl were downloaded and started. Then I ran “docker-compose exec clairctl clairctl health” which was successful. You may want to add the missing command: “docker-compose up -d postgres” to the documentation so that it helps other users of clairctl.

5. The current situation is given below. Is there some way for the second command (without docker-compose) to work? Could you please help me here?

[root@clair-server clairctl]# docker-compose exec clairctl clairctl health
Clair: ✔
[root@clair-server clairctl]# clairctl health --log-level debug
2018-09-19 09:45:27.038127 D | config: No config file used
2018-09-19 09:45:27.038608 D | clair: requesting health on: http:// localhost:6061/health
2018-09-19 09:45:27.040779 E | clair: requesting Clair health: Get http:// localhost:6061/health: dial tcp [::1]:6061: getsockopt: connection refused

Clair: ✘
[root@clair-server clairctl]#

6. I want to scan our application container and so did “docker login” and then analyze, but face problem seen below:

[root@clair-server clairctl]# docker login -u username -p the-password
[root@clair-server clairctl]# docker-compose exec clairctl clairctl analyze my-org/my-container:186 --log-level debug
2018-09-19 13:49:10.858615 D | config: Using config file: /home/clairctl/clairctl.yml
2018-09-19 13:49:10.859175 D | dockerdist: Downloading manifest for my-org/my-container:186
2018-09-19 13:49:10.859395 D | dockerdist: Retrieving repository client
2018-09-19 13:49:11.240796 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
client quit unexpectedly
2018-09-19 13:49:15.415043 C | cmd: retrieving manifest for "my-org/my-container:186": errors:
denied: requested access to the resource is denied
unauthorized: authentication required
[root@clair-server clairctl]#

[root@clair-server clairctl]#clairctl analyze my-org/my-container:186 --log-level debug
2018-09-19 09:51:33.513208 D | config: No config file used
2018-09-19 09:51:33.513675 D | dockerdist: Downloading manifest for my-org/my-container:186
2018-09-19 09:51:33.514031 D | dockerdist: Retrieving repository client
2018-09-19 09:51:37.131535 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
2018-09-19 09:51:41.656177 D | dockerdist: manifest type: *schema2.DeserializedManifest
2018-09-19 09:51:41.656235 D | dockerdist: retrieved schema2 manifest, no verification
2018-09-19 09:51:41.656286 I | config: retrieving interface for local IP
2018-09-19 09:51:41.656301 D | config: no interface provided, looking for docker0
2018-09-19 09:51:41.656830 I | clair: Pushing Layer 1/7 [sha256:605ce]
2018-09-19 09:51:41.656982 D | clair: Saving sha256:605ce1bd3f3164f2949a30501cc596f52a72de05da1306ab360055f0d7130c32[https:// registry-1.docker.io/v2]
2018-09-19 09:51:41.657113 D | clair: auth.insecureSkipVerify: true
2018-09-19 09:51:41.657150 D | clair: request.URL.String(): https:// registry-1.docker.io/v2/my-org/my-container/blobs/sha256:605ce1bd3f3164f2949a30501cc596f52a72de05da1306ab360055f0d7130c32
2018-09-19 09:51:42.809395 I | clair: pull from clair is unauthorized
2018-09-19 09:51:43.941475 I | clair: adding layer 1/7 [sha256:605ce]: pushing layer to clair: Post http:// localhost:6060/v1/layers: dial tcp [::1]:6060: getsockopt: connection refused
client quit unexpectedly
2018-09-19 09:51:43.941545 C | cmd: pushing image "my-org/my-container:186": pushing layer to clair: Post http:// localhost:6060/v1/layers: dial tcp [::1]:6060: getsockopt: connection refused
[root@clair-server clairctl]#

I want to eventually use the CLI to integrate clairctl with Jenkins to implement a quality/security gate. Is there some way for the scans to proceed (ideally without docker-compose) to work? Could you please help me here? I tried to Google around and read threads about how to overcome this barrier, but could not figure out a way. I thought of posting the question in clairctl/Lobby on Gitter, but thought I couldn't express myself in detail.

Any guidance, help would be highly appreciated. Could you please help me?

Answer 1

I eventually figured out that Clair server was running inside the container and its service ports - 6060 (API) and 6061 (Health) were available only inside the container context. I confirmed this by running these commands:

Command to see the open ports inside the clair container

docker-compose exec clair netstat -anp

Command to see the open ports inside the clairctl container

docker-compose exec clairctl netstat -anp

The clairctl analyze operation was failing inside the container as docker login context was not available inside. I figured out that I will have to expose the ports 6060, 6061 from inside Clair server outside the container context. Only then could it be visible using clairctl binary copied outside the container where the docker login context is available. I did the following three changes post which I could run the clairctl commands successfully.

1. Copied the file https://github.com/jgsqware/clairctl/blob/master/clairctl.yml.default as clairctl.yml into $HOME directory from where I had done docker login and was running clairctl commands.
2. Updated the value of uri parameter in above file from uri: http://clair to uri: http://localhost

3. Added the ports clause in section for clair into file /root/go/src/github.com/jgsqware/clairctl/docker-compose.yml as seen below

     clair:
       image: quay.io/coreos/clair:v2.0.0
       restart: unless-stopped
       ports:
         - "6060:6060"
         - "6061:6061"
   

This exposed the ports 6060, 6061 inside the clair container to the localhost, after which commands like clairctl health and clairctl analyze <container-image-name> worked successfully.