I am trying to setup clairctl to scan our application images and so wanted to install the full stack of clairctl, clair scanner & postgress database. I did the following steps:
- Acquired a VM running CentOS 7, 2 vCPU and 8 GB RAM.
- Installed docker-compose as described here: https:// www.linuxhelp.com/how-to-install-docker-compose-on-centos-7.
- Installed GO as described here: https:// linuxize.com/post/how-to-install-go-on-centos-7.
- Downloaded and installed clairctl by referring to this page: https:// github.com/jgsqware/clairctl. In this step I faced some problems and tried to work around them as described below.
i) Downloaded the binary release of clairctl by running “curl -L https:// raw.githubusercontent.com/jgsqware/clairctl/master/install.sh | sh”
ii) Executed the command “git clone [email protected]:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl” which failed with error message
[root@clair-server ~]# git clone [email protected]:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl
Cloning into '/src/github.com/jgsqware/clairctl'...
The authenticity of host 'github.com (192.30.253.113)' can't be established.
RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
RSA key fingerprint is MD5:16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'github.com,192.30.253.113' (RSA) to the list of known hosts.
Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository exists.
[root@clair-server ~]#
So did the following to workaround the problem. If this is a generic issue which could affect many, you may want to update the project’s README.md with the workaround so that it helps other users of clairctl.
git clone git clone https:// github.com/jgsqware/clairctl.git
export GOPATH=$PATH:~/go
mkdir -p $GOPATH/src/github.com/jgsqware/clairctl
mv clairctl $GOPATH/src/github.com/jgsqware/
iii) Then executed the commands below which passed:
cd $GOPATH/src/github.com/jgsqware/clairctl
docker-compose up -d postgres
iv) Then executed the command “docker-compose exec clairctl clairctl health” which failed with error. I Googled about this error, examined the file docker-compose.yml. Based on it, I executed “docker-compose up -d clairctl” which is not mentioned. This is when images for clair and clairctl were downloaded and started. Then I ran “docker-compose exec clairctl clairctl health” which was successful. You may want to add the missing command: “docker-compose up -d postgres” to the documentation so that it helps other users of clairctl.
- The current situation is given below. Is there some way for the second command (without docker-compose) to work? Could you please help me here?
[root@clair-server clairctl]# docker-compose exec clairctl clairctl health
Clair: ✔
[root@clair-server clairctl]# clairctl health --log-level debug
2018-09-19 09:45:27.038127 D | config: No config file used
2018-09-19 09:45:27.038608 D | clair: requesting health on: http:// localhost:6061/health
2018-09-19 09:45:27.040779 E | clair: requesting Clair health: Get http:// localhost:6061/health: dial tcp [::1]:6061: getsockopt: connection refused
Clair: ✘
[root@clair-server clairctl]#
- I want to scan our application container and so did “docker login” and then analyze, but face problem seen below:
[root@clair-server clairctl]# docker login -u username -p the-password
[root@clair-server clairctl]# docker-compose exec clairctl clairctl analyze my-org/my-container:186 --log-level debug
2018-09-19 13:49:10.858615 D | config: Using config file: /home/clairctl/clairctl.yml
2018-09-19 13:49:10.859175 D | dockerdist: Downloading manifest for my-org/my-container:186
2018-09-19 13:49:10.859395 D | dockerdist: Retrieving repository client
2018-09-19 13:49:11.240796 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
client quit unexpectedly
2018-09-19 13:49:15.415043 C | cmd: retrieving manifest for "my-org/my-container:186": errors:
denied: requested access to the resource is denied
unauthorized: authentication required
[root@clair-server clairctl]#
[root@clair-server clairctl]#clairctl analyze my-org/my-container:186 --log-level debug
2018-09-19 09:51:33.513208 D | config: No config file used
2018-09-19 09:51:33.513675 D | dockerdist: Downloading manifest for my-org/my-container:186
2018-09-19 09:51:33.514031 D | dockerdist: Retrieving repository client
2018-09-19 09:51:37.131535 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
2018-09-19 09:51:41.656177 D | dockerdist: manifest type: *schema2.DeserializedManifest
2018-09-19 09:51:41.656235 D | dockerdist: retrieved schema2 manifest, no verification
2018-09-19 09:51:41.656286 I | config: retrieving interface for local IP
2018-09-19 09:51:41.656301 D | config: no interface provided, looking for docker0
2018-09-19 09:51:41.656830 I | clair: Pushing Layer 1/7 [sha256:605ce]
2018-09-19 09:51:41.656982 D | clair: Saving sha256:605ce1bd3f3164f2949a30501cc596f52a72de05da1306ab360055f0d7130c32[https:// registry-1.docker.io/v2]
2018-09-19 09:51:41.657113 D | clair: auth.insecureSkipVerify: true
2018-09-19 09:51:41.657150 D | clair: request.URL.String(): https:// registry-1.docker.io/v2/my-org/my-container/blobs/sha256:605ce1bd3f3164f2949a30501cc596f52a72de05da1306ab360055f0d7130c32
2018-09-19 09:51:42.809395 I | clair: pull from clair is unauthorized
2018-09-19 09:51:43.941475 I | clair: adding layer 1/7 [sha256:605ce]: pushing layer to clair: Post http:// localhost:6060/v1/layers: dial tcp [::1]:6060: getsockopt: connection refused
client quit unexpectedly
2018-09-19 09:51:43.941545 C | cmd: pushing image "my-org/my-container:186": pushing layer to clair: Post http:// localhost:6060/v1/layers: dial tcp [::1]:6060: getsockopt: connection refused
[root@clair-server clairctl]#
I want to eventually use the CLI to integrate clairctl with Jenkins to implement a quality/security gate. Is there some way for the scans to proceed (ideally without docker-compose) to work? Could you please help me here? I tried to Google around and read threads about how to overcome this barrier, but could not figure out a way. I thought of posting the question in clairctl/Lobby on Gitter, but thought I couldn't express myself in detail.
Any guidance, help would be highly appreciated. Could you please help me?