Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Image scan fails with a popup having no useful information #8090

Open
ibmmi opened this issue Jan 15, 2025 · 9 comments
Open

Image scan fails with a popup having no useful information #8090

ibmmi opened this issue Jan 15, 2025 · 9 comments
Labels
area/images kind/bug Something isn't working triage/close-candidate Can this be closed?

Comments

@ibmmi
Copy link

ibmmi commented Jan 15, 2025

Actual Behavior

I pulled the image registry.redhat.io/openshift4/ose-cli:latest, which is publicly available to RedHat registered users. When trying to scan I obtain a popup with the message "Error trying to scan registry.redhat.io/openshift4/ose-cli:latest"

Steps to Reproduce

  • RD on Windows 11
  • Register to RedHat
  • docker pull registry.redhat.io/openshift4/ose-cli:latest
  • scan the pulled image

Result

Error popup having the message "Error trying to scan registry.redhat.io/openshift4/ose-cli:latest"

Expected Behavior

Scan report with vulnerabilities or, in the worst case scenario, an useful error message that allows me to fix the problem.

Additional Information

No response

Rancher Desktop Version

1.16.0

Rancher Desktop K8s Version

not enabled

Which container engine are you using?

moby (docker cli)

What operating system are you using?

Windows

Operating System / Build Version

Windows 11 Enterprise Version 23H2 OS Build 22631.4602

What CPU architecture are you using?

x64

Linux only: what package format did you use to install Rancher Desktop?

None

Windows User Only

Undisclosed, I don't think this has any impact on the problem at hand
@ibmmi ibmmi added the kind/bug Something isn't working label Jan 15, 2025
@jandubois
Copy link
Member

The issue is likely that Trivy is not scanning the local image but trying to scan it again. And then fails because it has no access to the registry:

❯ docker pull registry.redhat.io/openshift4/ose-cli:latest
Error response from daemon: Head "https://registry.redhat.io/v2/openshift4/ose-cli/manifests/latest": unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication

We need to verify if the scanner can get access to the credentials from the host.

@jandubois
Copy link
Member

I don't have access to the redhat registry, so can't test this directly. Need to check against a different image that needs credentials.

It looks like only the root user inside the VM has access to registry credentials from the host, and it also looks like trivy is being executed via the regular user account.

@ibmmi
Copy link
Author

ibmmi commented Jan 16, 2025

AFAIK, registration to RedHat should be free. Have you tried registering? After registration just docker login with the username and password...

@jandubois jandubois mentioned this issue Jan 24, 2025
Open
@jandubois
Copy link
Member

registration to RedHat should be free. Have you tried registering?

Registration is free for individual, personal use only, which would not apply here. Even though Rancher Desktop is free and open source, it is not a personal project, so I think using a personal account would be a violation of their terms of use.

I have tested this functionality with a local registry that requires authentication. For nerdctl the image scanning indeed fails because the image cannot be downloaded again (and the containerd socket is not in the default location, and some other reasons regarding image names).

With docker however I could scan the local disk image without problem. So I think the issue with the RedHat registry is something else. Could you attach the log files, or at least ~/Library/Logs/rancher-desktop/images.log, so I could check for additional information?

Please restart Rancher Desktop and just scan the image, so there is no other information in the log file.

We will have a fix for containerd/nerdctl in Rancher Desktop 1.18.0, but it seems like that will not make a difference for the RedHat registry.

@jandubois
Copy link
Member

I did all my previous testing on macOS, but I now repeated the test on Windows 10 with an image pulled from a private registry requiring authentication.

After pulling it from the shell using docker login and docker pull I selected the image in the UI and asked to "Scan" it. After a longish delay (it downloads almost 2GB of vulnerability databases on first run) it displayed the scan results just fine.

I've also confirmed that I cannot use a personal RedHat account to investigate issues while at work.

So unless I get additional log files with more details, there is not much else I can do.

@jandubois jandubois added the triage/needs-information Further information is requested label Jan 24, 2025
@ibmmi
Copy link
Author

ibmmi commented Jan 27, 2025 via email

@jandubois
Copy link
Member

This seems to be a problem with outdated cached information in your VM. Please run

❯ rdctl shell trivy clean --all

2025-01-27T10:35:56-08:00	INFO	Removing scan cache...
2025-01-27T10:35:56-08:00	INFO	Removing vulnerability database...
2025-01-27T10:35:56-08:00	INFO	Removing Java database...
2025-01-27T10:35:56-08:00	INFO	Removing check bundle...
2025-01-27T10:35:56-08:00	INFO	Removing VEX repositories...

And then try the scan again.

@ibmmi
Copy link
Author

ibmmi commented Jan 28, 2025 via email

@jandubois jandubois removed the triage/needs-information Further information is requested label Jan 28, 2025
@jandubois
Copy link
Member

I have done that and the error persists.

In that case there is nothing else I can do. The error seems to be between trivy and the redhat image.

I would recommend to file a new issue on trivy-db including the image you want to scan, and the error you get, including the reference to aquasecurity/trivy-db#435.

Please close this issue unless you get any information from trivy that indicates there is something in Rancher Desktop that could help to mitigate this problem!

@jandubois jandubois added the triage/close-candidate Can this be closed? label Jan 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/images kind/bug Something isn't working triage/close-candidate Can this be closed?
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jandubois @ibmmi