Fatal rootfs scan error when scanning host from inside container

[adsick]

Description

When running trivy on host machine everything works fine. When executing the same Trivy command inside of a container it fails.
It fails specifically when it tries to scan the container's own /proc directory.

Desired Behavior

Host machine scanned from inside the container successfully

Actual Behavior

Fatal error     rootfs scan error: scan error: scan failed: failed analysis: walk filesystem: walk dir error: unknown error with /host/var/lib/docker/overlay2/c48d26a99394e434cf417de1ef1df4367da0043a3e3d201f8910de99c3789464/merged/proc/213/fdinfo/8: file info error: lstat /host/var/lib/docker/overlay2/c48d26a99394e434cf417de1ef1df4367da0043a3e3d201f8910de99c3789464/merged/proc/213/fdinfo/8: no such file or directory

Reproduction Steps

1. `docker run -rm -v /:/host -it alpine:3.11`
2. `apk add curl`
3. `trivy rootfs --offline-scan --skip-db-update --skip-java-db-update --list-all-pkgs --pkg-types os -f cyclonedx /host`
4. wait a little till the error

> b.t.w I find the official 'help' a bit misleading about "scanning from inside container" since `docker run -rm -it alpine:3.11` obviously does not have the access to the host:

>  # Scan from inside a container
>  $ docker run --rm -it alpine:3.11
>  / # curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | > sh -s -- -b /usr/local/bin
>  / # trivy rootfs /

Target

Filesystem

Scanner

None

Output Format

CycloneDX

Mode

Standalone

Debug Output

- rootfs scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:386
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:260
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:615
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:158
  - walk filesystem:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:113
  - walk dir error:
    github.com/aquasecurity/trivy/pkg/fanal/walker.(*FS).Walk
        /home/runner/work/trivy/trivy/pkg/fanal/walker/fs.go:34
  - unknown error with /host/var/lib/docker/overlay2/c48d26a99394e434cf417de1ef1df4367da0043a3e3d201f8910de99c3789464/merged/proc/229/fdinfo/8:
    github.com/aquasecurity/trivy/pkg/fanal/walker.(*FS).Walk.(*FS).onError.func2
        /home/runner/work/trivy/trivy/pkg/fanal/walker/fs.go:91
  - file info error:
    github.com/aquasecurity/trivy/pkg/fanal/walker.(*FS).Walk.(*FS).WalkDirFunc.func1
        /home/runner/work/trivy/trivy/pkg/fanal/walker/fs.go:68
  - lstat /host/var/lib/docker/overlay2/c48d26a99394e434cf417de1ef1df4367da0043a3e3d201f8910de99c3789464/merged/proc/229/fdinfo/8: no such file or directory

Operating System

host: Fedora, container: Alpine

Version

v0.55.2

Checklist

• Run trivy clean --all
• Read the troubleshooting

[adsick]

--skip-dirs /host/var/lib/docker/overlay2 helps, but I guess it should run just fine without it.

[adsick]

IMHO this kind of error should not be 'fatal' and stop all the scanning

[rbaxende]

This is still an issue, which I'm seeing when running Trivy from inside of a Bottlerocket admin container. Additionally, specifying globs is broken in this scenario.

For example, when running inside of a Bottlerocket admin container, there are two different /proc directories:

1. /.bottlerocket/rootfs/proc/
2. /.bottlerocket/rootfs/run/host-containerd/io.containerd.runtime.v2.task/default/admin/rootfs/proc/

Adding a --skip-dirs '**/proc' will not skip the above directores, and I get the "walk dir error...no such file or directory" error on those above /proc directories.

However, if I get a little more specific and make it --skip-dirs '/.bottlerocket/**/proc', then the skip does work.

According to the docs, something like --skip-dirs '**/proc' should be working.

Update: It looks like --skip-dirs '/**/proc' works (added a / in front of the **), but I didn't think I would need a leading /