Docker Static Analysis With Clair?

Question

Who can help to deal with Docker Static Analysis With Clair? I get an error when analyzing help me figure it out or tell me how to install the Docker Clair scanner correctly?

Getting Setup

git clone git@github.com:Charlie-belmer/Docker-security-example.git  

docker-compose.yml 
version: '2.1'

services:
  postgres:
    image: postgres:12.1
    restart: unless-stopped
    volumes:
      - ./docker-compose-data/postgres-data/:/var/lib/postgresql/data:rw
    environment:
      - POSTGRES_PASSWORD=ChangeMe
      - POSTGRES_USER=clair
      - POSTGRES_DB=clair
    
  clair:
    image: quay.io/coreos/clair:v4.3.4
    restart: unless-stopped
    volumes:
      - ./docker-compose-data/clair-config/:/config/:ro
      - ./docker-compose-data/clair-tmp/:/tmp/:rw
    depends_on: 
      postgres:
        condition: service_started
    command: [--log-level=debug, --config, /config/config.yml]
    user: root

  clairctl:
    image: jgsqware/clairctl:latest
    restart: unless-stopped
    environment: 
      - DOCKER_API_VERSION=1.41
    volumes:
      - ./docker-compose-data/clairctl-reports/:/reports/:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on: 
      clair: 
        condition: service_started
    user: root

docker-compose up

The server starts without errors but gets stuck on the same message I don't understand what he doesn't like

test@parallels-virtual-platform:~/Docker-security-example/clair$ docker-compose up
clair_postgres_1 is up-to-date
Recreating clair_clair_1 ... done
Recreating clair_clairctl_1 ... done
Attaching to clair_postgres_1, clair_clair_1, clair_clairctl_1
clair_1     | flag provided but not defined: -log-level
clair_1     | Usage of /bin/clair:
clair_1     |   -conf value
clair_1     |       The file system path to Clair's config file.
clair_1     |   -mode value
clair_1     |       The operation mode for this server. (default combo)
postgres_1  | 
postgres_1  | PostgreSQL Database directory appears to contain a database; Skipping initialization
postgres_1  | 
postgres_1  | 2021-11-16 22:55:36.851 UTC [1] LOG:  starting PostgreSQL 12.1 (Debian 12.1-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
postgres_1  | 2021-11-16 22:55:36.851 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres_1  | 2021-11-16 22:55:36.851 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres_1  | 2021-11-16 22:55:36.853 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres_1  | 2021-11-16 22:55:36.877 UTC [24] LOG:  database system was shut down at 2021-11-16 22:54:58 UTC
postgres_1  | 2021-11-16 22:55:36.888 UTC [1] LOG:  database system is ready to accept connections
postgres_1  | 2021-11-16 23:01:15.219 UTC [1] LOG:  received smart shutdown request
postgres_1  | 2021-11-16 23:01:15.225 UTC [1] LOG:  background worker "logical replication launcher" (PID 30) exited with exit code 1
postgres_1  | 
postgres_1  | PostgreSQL Database directory appears to contain a database; Skipping initialization
postgres_1  | 
postgres_1  | 2021-11-16 23:02:11.993 UTC [1] LOG:  starting PostgreSQL 12.1 (Debian 12.1-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
postgres_1  | 2021-11-16 23:02:11.994 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres_1  | 2021-11-16 23:02:11.994 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres_1  | 2021-11-16 23:02:11.995 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres_1  | 2021-11-16 23:02:12.009 UTC [26] LOG:  database system was interrupted; last known up at 2021-11-16 23:00:37 UTC
postgres_1  | 2021-11-16 23:02:12.164 UTC [26] LOG:  database system was not properly shut down; automatic recovery in progress
postgres_1  | 2021-11-16 23:02:12.166 UTC [26] LOG:  redo starts at 0/1745C50
postgres_1  | 2021-11-16 23:02:12.166 UTC [26] LOG:  invalid record length at 0/1745D38: wanted 24, got 0
postgres_1  | 2021-11-16 23:02:12.166 UTC [26] LOG:  redo done at 0/1745D00
postgres_1  | 2021-11-16 23:02:12.180 UTC [1] LOG:  database system is ready to accept connections
postgres_1  | 2021-11-16 23:02:12.471 UTC [33] ERROR:  duplicate key value violates unique constraint "lock_name_key"
postgres_1  | 2021-11-16 23:02:12.471 UTC [33] DETAIL:  Key (name)=(updater) already exists.
postgres_1  | 2021-11-16 23:02:12.471 UTC [33] STATEMENT:  INSERT INTO Lock(name, owner, until) VALUES($1, $2, $3)
clair_clair_1 exited with code 2
clair_1     | flag provided but not defined: -log-level
clair_1     | Usage of /bin/clair:
clair_1     |   -conf value
clair_1     |       The file system path to Clair's config file.
clair_1     |   -mode value
clair_1     |       The operation mode for this server. (default combo)
clair_1     | flag provided but not defined: -log-level
clair_1     | Usage of /bin/clair:
clair_1     |   -conf value
clair_1     |       The file system path to Clair's config file.
clair_1     |   -mode value
clair_1     |       The operation mode for this server. (default combo)
clair_clair_1 exited with code 2
clair_1     | flag provided but not defined: -log-level
clair_1     | Usage of /bin/clair:
clair_1     |   -conf value
clair_1     |       The file system path to Clair's config file.
clair_1     |   -mode value
clair_1     |       The operation mode for this server. (default combo)
clair_clair_1 exited with code 2
clair_1     | flag provided but not defined: -log-level
clair_1     | Usage of /bin/clair:
clair_1     |   -conf value
clair_1     |       The file system path to Clair's config file.
clair_1     |   -mode value
clair_1     |       The operation mode for this server. (default combo)
clair_clair_1 exited with code 2
clair_1     | flag provided but not defined: -log-level
clair_1     | Usage of /bin/clair:
clair_1     |   -conf value
clair_1     |       The file system path to Clair's config file.
clair_1     |   -mode value
clair_1     |       The operation mode for this server. (default combo)
clair_clair_1 exited with code 2
clair_1     | flag provided but not defined: -log-level
clair_1     | Usage of /bin/clair:
clair_1     |   -conf value
clair_1     |       The file system path to Clair's config file.
clair_1     |   -mode value
clair_1     |       The operation mode for this server. (default combo)

installing a bad container

docker pull imiell/bad-dockerfile

docker-compose exec clairctl clairctl analyze -l imiell/bad-dockerfile


client quit unexpectedly
2021-11-16 23:05:19.221606 C | cmd: pushing image "imiell/bad-dockerfile:latest": pushing layer to clair: Post http://clair:6060/v1/layers: dial tcp: lookup clair: Try again

I don't understand what he doesn't like for analysis?

Answer 1

I think your are using the old clairctl with the new Clair v4. You should be using clairctl from here: https://github.com/quay/clair/releases/tag/v4.3.5 .

Answer 2

I just solved this yesterday, the 4.3.4 version of Clair only supports two command-line options, mode , and conf . Your output bears this out:

clair_1     | flag provided but not defined: -log-level
clair_1     | Usage of /bin/clair:
clair_1     |   -conf value
clair_1     |       The file system path to Clair's config file.
clair_1     |   -mode value
clair_1     |       The operation mode for this server. (default combo)

Change the command line to only specify your configuration file (line 23 of your docker-compose.yml) and place your debug directive in the configuration file.

command: [--conf, /config/config.yml]

This should get Clair running.