Verifying the Clair Installation

[rammanoj]

I have been trying to install clair all day today. I couldn't even figure out what's happening wrong or how to verify if my installation went well. I followed the instructions given here. I have four containers running locally:

I visited http:localhost:8080/, and traefik is showing everything in green. So, I ran an image scan with Klar, but it failed. To verify if my clair is installed correctly. I visited http://localhost:6060/indexer and even the matcher's URL as well. It prompted me:

I also visited http://0.0.0.0:51221/ to check if the quay came up. But it replied "Service Unavailable".

Is the clair actually running ? How do I verify if it's working? I could not find any help in the documentation regarding this issue.

Any help would be appreciated.

@crozzy / @hdonnay

[hdonnay]

I don't know what klar is. What does running a report with clairctl report say? What do the logs say?

Your screenshot shows a 401, that indicates you have it configured with authentication.

[rammanoj]

@hdonnay Thanks for the reply. I guess you are right. Here is the screenshot of running clairctl:

However, I have just cloned and ran docker compose. Is authentication enabled by default ?

[hdonnay]

Yes, see local-dev/clair/config.yaml. You'll need to use that configuration. The help from the clairctl commands should explain how.

[hdonnay]

Do you have permissions for the repository docker.io/library/romantic_hawking? That's what the error clearly says.

Randomized host ports have no effect on the container network.

[rammanoj]

My bad! I was in assumption that it works for a local container. Thanks for pointing out!

I started the scan for a image. It has not outputted anything for some time now (~10 mins). Is it intended ?

I would also like to know if there are any official plugins to run the scan for local images / containers ? I found this out. But it seems like it is not regularly maintained!

[hdonnay]

No, Clair requires layers be accessible via HTTP at whatever addresses are provided in the manifest. Indexing can take large amounts of time depending on the resources available.

[rammanoj]

Got it! Could you please help me with how to specify username / password in case of private registries ?

[hdonnay]

The standard docker and podman authentication files are consulted.

[rammanoj]

@hdonnay Thanks a lot for all the help. I was able to setup and perform a few scans with Clair.

Initially, I tried with standard images like ubuntu:22.04. It worked and showed a few vulnerabilities. But when I tried with a sample image I developed (with a few vulnerabilities in it), it's just replying ok.

Does it take sometime for database to actually get refreshed and match ? (It's been 3 hours since DB is running)
Here is the output upon running cliar:

However, docker Hub has detected a few vulnerabilities:

[hdonnay]

There's no way to troubleshoot without logs and the JSON output.

[ssadeghh]

@hdonnay Thanks a lot for all the help. I was able to setup and perform a few scans with Clair.

Initially, I tried with standard images like ubuntu:22.04. It worked and showed a few vulnerabilities. But when I tried with a sample image I developed (with a few vulnerabilities in it), it's just replying ok.

Does it take sometime for database to actually get refreshed and match ? (It's been 3 hours since DB is running) Here is the output upon running cliar:

However, docker Hub has detected a few vulnerabilities:

hi, can you tell me how you handle authentication to scan other docker images and not just public images like ubuntu pls?

[hdonnay]

What have you tried? Docker/Podman configuration in the standard locations should work.

[ssadeghh]

I've tried Docker