Answers: <p>I eventually figured out that Clair server was running inside the container and its service ports - 6060 (API) and 6061 (Health) were available only inside the container context. I confirmed this by running these commands:</p>
  
  <p>Command to see the open ports inside the clair container</p>
  
  <p><code>docker-compose exec clair netstat -anp</code></p>
  
  <p>Command to see the open ports inside the clairctl container</p>
  
  <p><code>docker-compose exec clairctl netstat -anp</code></p>
  
  <p>The clairctl analyze operation was failing inside the container as docker login context was not available inside. I figured out that I will have to expose the ports 6060, 6061 from inside Clair server outside the container context. Only then could it be visible using clairctl binary copied outside the container where the docker login context is available. I did the following three changes post which I could run the clairctl commands successfully.</p>
  
  <ol>
  <li>Copied the file <a href="https://github.com/jgsqware/clairctl/blob/master/clairctl.yml.default" rel="nofollow noreferrer">https://github.com/jgsqware/clairctl/blob/master/clairctl.yml.default</a> as clairctl.yml into $HOME directory from where I had done docker login and was running clairctl commands.</li>
  <li>Updated the value of <code>uri</code> parameter in above file from <code>uri: http://clair</code> to <code>uri: http://localhost</code></li>
  <li><p>Added the <code>ports</code> clause in section for <code>clair</code> into file /root/go/src/github.com/jgsqware/clairctl/docker-compose.yml as seen below</p>
  
  <pre><code>  clair:
      image: quay.io/coreos/clair:v2.0.0
      restart: unless-stopped
      ports:
        - "6060:6060"
        - "6061:6061"
  </code></pre></li>
  </ol>
  
  <p>This exposed the ports 6060, 6061 inside the clair container to the localhost, after which commands like <code>clairctl health</code> and <code>clairctl analyze &lt;container-image-name&gt;</code> worked successfully.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-09-25T05:17:53.173Z
Answers: 2018-09-25T05:17:53.173Z
Answers: shashi
Body: <p>I am trying to setup clairctl to scan our application images and so wanted to install the full stack of clairctl, clair scanner &amp; postgress database. I did the following steps:</p>
  
  <ol>
  <li>Acquired a VM running CentOS 7, 2 vCPU and 8 GB RAM.</li>
  <li>Installed docker-compose as described here: https:// www.linuxhelp.com/how-to-install-docker-compose-on-centos-7.</li>
  <li>Installed GO as described here: https:// linuxize.com/post/how-to-install-go-on-centos-7.</li>
  <li>Downloaded and installed clairctl by referring to this page: https:// github.com/jgsqware/clairctl. In this step I faced some problems and tried to work around them as described below.</li>
  </ol>
  
  <p>i) Downloaded the binary release of clairctl by running “curl -L https:// raw.githubusercontent.com/jgsqware/clairctl/master/install.sh | sh”</p>
  
  <p>ii) Executed the command “git clone git@github.com:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl” which failed with error message</p>
  
  <pre><code>[root@clair-server ~]# git clone git@github.com:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl
  Cloning into '/src/github.com/jgsqware/clairctl'...
  The authenticity of host 'github.com (192.30.253.113)' can't be established.
  RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
  RSA key fingerprint is MD5:16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48.
  Are you sure you want to continue connecting (yes/no)? yes
  Warning: Permanently added 'github.com,192.30.253.113' (RSA) to the list of known hosts.
  Permission denied (publickey).
  fatal: Could not read from remote repository.
  Please make sure you have the correct access rights and the repository exists.
  [root@clair-server ~]#
  </code></pre>
  
  <p>So did the following to workaround the problem. If this is a generic issue which could affect many, you may want to update the project’s README.md with the workaround so that it helps other users of clairctl.</p>
  
  <pre><code>git clone git clone https:// github.com/jgsqware/clairctl.git
  export GOPATH=$PATH:~/go
  mkdir -p $GOPATH/src/github.com/jgsqware/clairctl
  mv clairctl $GOPATH/src/github.com/jgsqware/
  </code></pre>
  
  <p>iii) Then executed the commands below which passed:</p>
  
  <pre><code>cd $GOPATH/src/github.com/jgsqware/clairctl
  docker-compose up -d postgres
  </code></pre>
  
  <p>iv) Then executed the command “docker-compose exec clairctl clairctl health” which failed with error. I Googled about this error, examined the file docker-compose.yml. Based on it, I executed “docker-compose up -d clairctl” which is not mentioned. This is when images for clair and clairctl were downloaded and started. Then I ran “docker-compose exec clairctl clairctl health” which was successful. You may want to add the missing command: “docker-compose up -d postgres” to the documentation so that it helps other users of clairctl.</p>
  
  <ol start="5">
  <li>The current situation is given below. Is there some way for the second command (without docker-compose) to work? Could you please help me here?</li>
  </ol>
  
  
  
  <pre><code>[root@clair-server clairctl]# docker-compose exec clairctl clairctl health
  Clair: ✔
  [root@clair-server clairctl]# clairctl health --log-level debug
  2018-09-19 09:45:27.038127 D | config: No config file used
  2018-09-19 09:45:27.038608 D | clair: requesting health on: http:// localhost:6061/health
  2018-09-19 09:45:27.040779 E | clair: requesting Clair health: Get http:// localhost:6061/health: dial tcp [::1]:6061: getsockopt: connection refused
  
  Clair: ✘
  [root@clair-server clairctl]#
  </code></pre>
  
  <ol start="6">
  <li>I want to scan our application container and so did “docker login” and then analyze, but face problem seen below:</li>
  </ol>
  
  
  
  <pre><code>[root@clair-server clairctl]# docker login -u username -p the-password
  [root@clair-server clairctl]# docker-compose exec clairctl clairctl analyze my-org/my-container:186 --log-level debug
  2018-09-19 13:49:10.858615 D | config: Using config file: /home/clairctl/clairctl.yml
  2018-09-19 13:49:10.859175 D | dockerdist: Downloading manifest for my-org/my-container:186
  2018-09-19 13:49:10.859395 D | dockerdist: Retrieving repository client
  2018-09-19 13:49:11.240796 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
  client quit unexpectedly
  2018-09-19 13:49:15.415043 C | cmd: retrieving manifest for "my-org/my-container:186": errors:
  denied: requested access to the resource is denied
  unauthorized: authentication required
  [root@clair-server clairctl]#
  
  [root@clair-server clairctl]#clairctl analyze my-org/my-container:186 --log-level debug
  2018-09-19 09:51:33.513208 D | config: No config file used
  2018-09-19 09:51:33.513675 D | dockerdist: Downloading manifest for my-org/my-container:186
  2018-09-19 09:51:33.514031 D | dockerdist: Retrieving repository client
  2018-09-19 09:51:37.131535 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
  2018-09-19 09:51:41.656177 D | dockerdist: manifest type: *schema2.DeserializedManifest
  2018-09-19 09:51:41.656235 D | dockerdist: retrieved schema2 manifest, no verification
  2018-09-19 09:51:41.656286 I | config: retrieving interface for local IP
  2018-09-19 09:51:41.656301 D | config: no interface provided, looking for docker0
  2018-09-19 09:51:41.656830 I | clair: Pushing Layer 1/7 [sha256:605ce]
  2018-09-19 09:51:41.656982 D | clair: Saving sha256:605ce1bd3f3164f2949a30501cc596f52a72de05da1306ab360055f0d7130c32[https:// registry-1.docker.io/v2]
  2018-09-19 09:51:41.657113 D | clair: auth.insecureSkipVerify: true
  2018-09-19 09:51:41.657150 D | clair: request.URL.String(): https:// registry-1.docker.io/v2/my-org/my-container/blobs/sha256:605ce1bd3f3164f2949a30501cc596f52a72de05da1306ab360055f0d7130c32
  2018-09-19 09:51:42.809395 I | clair: pull from clair is unauthorized
  2018-09-19 09:51:43.941475 I | clair: adding layer 1/7 [sha256:605ce]: pushing layer to clair: Post http:// localhost:6060/v1/layers: dial tcp [::1]:6060: getsockopt: connection refused
  client quit unexpectedly
  2018-09-19 09:51:43.941545 C | cmd: pushing image "my-org/my-container:186": pushing layer to clair: Post http:// localhost:6060/v1/layers: dial tcp [::1]:6060: getsockopt: connection refused
  [root@clair-server clairctl]#
  </code></pre>
  
  <p>I want to eventually use the CLI to integrate clairctl with Jenkins to implement a quality/security gate. Is there some way for the scans to proceed (ideally without docker-compose) to work? Could you please help me here? I tried to Google around and read threads about how to overcome this barrier, but could not figure out a way. I thought of posting the question in clairctl/Lobby on Gitter, but thought I couldn't express myself in detail.</p>
  
  <p>Any guidance, help would be highly appreciated. Could you please help me?</p>
  
Comments: CC BY-SA 4.0
Comments: 2018-09-21T05:09:04.813Z
Comments: Thank you for helping to edit formatting of the post. Frankly I had tried to not post some content in bold and to put code as code blocks. However, I couldn't figure out the precise way to get it done. Thanks again. Appreciate it!
Comments: shashi
Comments: CC BY-SA 4.0
Comments: 2018-09-21T06:40:52.020Z
Comments: There is a brief Markdown help on the right when you're editing, and a preview below the edit box. Some details are tricky, such as getting a code block inside an enumerated list. The rows of equals signs are a Markdown instruction to create a headline so you want to avoid that as a general separator.
Comments: tripleee
Tags: <containers><docker-compose><security><clair>
Title: Error during setup of clairctl for container scanning with clair
UserDisplayName: shashi
ThreadText: # Error during setup of clairctl for container scanning with clair
  
  (Asked by: username_0 on 2018-09-20)
  
  I am trying to setup clairctl to scan our application images and so wanted to install the full stack of clairctl, clair scanner & postgress database. I did the following steps:
  
  1. Acquired a VM running CentOS 7, 2 vCPU and 8 GB RAM.
  2. Installed docker-compose as described here: https:// www.linuxhelp.com/how-to-install-docker-compose-on-centos-7.
  3. Installed GO as described here: https:// linuxize.com/post/how-to-install-go-on-centos-7.
  4. Downloaded and installed clairctl by referring to this page: https:// github.com/jgsqware/clairctl. In this step I faced some problems and tried to work around them as described below.
  
  i) Downloaded the binary release of clairctl by running “curl -L https:// raw.githubusercontent.com/jgsqware/clairctl/master/install.sh | sh”
  
  ii) Executed the command “git clone git@github.com:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl” which failed with error message
  
  ```
  [root@clair-server ~]# git clone git@github.com:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl
  Cloning into '/src/github.com/jgsqware/clairctl'...
  The authenticity of host 'github.com (192.30.253.113)' can't be established.
  RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
  RSA key fingerprint is MD5:16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48.
  Are you sure you want to continue connecting (yes/no)? yes
  Warning: Permanently added 'github.com,192.30.253.113' (RSA) to the list of known hosts.
  Permission denied (publickey).
  fatal: Could not read from remote repository.
  Please make sure you have the correct access rights and the repository exists.
  [root@clair-server ~]#
  
  ```
  
  So did the following to workaround the problem. If this is a generic issue which could affect many, you may want to update the project’s README.md with the workaround so that it helps other users of clairctl.
  
  ```
  git clone git clone https:// github.com/jgsqware/clairctl.git
  export GOPATH=$PATH:~/go
  mkdir -p $GOPATH/src/github.com/jgsqware/clairctl
  mv clairctl $GOPATH/src/github.com/jgsqware/
  
  ```
  
  iii) Then executed the commands below which passed:
  
  ```
  cd $GOPATH/src/github.com/jgsqware/clairctl
  docker-compose up -d postgres
  
  ```
  
  iv) Then executed the command “docker-compose exec clairctl clairctl health” which failed with error. I Googled about this error, examined the file docker-compose.yml. Based on it, I executed “docker-compose up -d clairctl” which is not mentioned. This is when images for clair and clairctl were downloaded and started. Then I ran “docker-compose exec clairctl clairctl health” which was successful. You may want to add the missing command: “docker-compose up -d postgres” to the documentation so that it helps other users of clairctl.
  
  5. The current situation is given below. Is there some way for the second command (without docker-compose) to work? Could you please help me here?
  
  ```
  [root@clair-server clairctl]# docker-compose exec clairctl clairctl health
  Clair: ✔
  [root@clair-server clairctl]# clairctl health --log-level debug
  2018-09-19 09:45:27.038127 D | config: No config file used
  2018-09-19 09:45:27.038608 D | clair: requesting health on: http:// localhost:6061/health
  2018-09-19 09:45:27.040779 E | clair: requesting Clair health: Get http:// localhost:6061/health: dial tcp [::1]:6061: getsockopt: connection refused
  
  Clair: ✘
  [root@clair-server clairctl]#
  
  ```
  
  6. I want to scan our application container and so did “docker login” and then analyze, but face problem seen below:
  
  ```
  [root@clair-server clairctl]# docker login -u username -p the-password
  [root@clair-server clairctl]# docker-compose exec clairctl clairctl analyze my-org/my-container:186 --log-level debug
  2018-09-19 13:49:10.858615 D | config: Using config file: /home/clairctl/clairctl.yml
  2018-09-19 13:49:10.859175 D | dockerdist: Downloading manifest for my-org/my-container:186
  2018-09-19 13:49:10.859395 D | dockerdist: Retrieving repository client
  2018-09-19 13:49:11.240796 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
  client quit unexpectedly
  2018-09-19 13:49:15.415043 C | cmd: retrieving manifest for "my-org/my-container:186": errors:
  denied: requested access to the resource is denied
  unauthorized: authentication required
  [root@clair-server clairctl]#
  
  [root@clair-server clairctl]#clairctl analyze my-org/my-container:186 --log-level debug
  2018-09-19 09:51:33.513208 D | config: No config file used
  2018-09-19 09:51:33.513675 D | dockerdist: Downloading manifest for my-org/my-container:186
  2018-09-19 09:51:33.514031 D | dockerdist: Retrieving repository client
  2018-09-19 09:51:37.131535 D | dockerdist: endpoint.TLSConfig.InsecureSkipVerify: true
  2018-09-19 09:51:41.656177 D | dockerdist: manifest type: *schema2.DeserializedManifest
  2018-09-19 09:51:41.656235 D | dockerdist: retrieved schema2 manifest, no verification
  2018-09-19 09:51:41.656286 I | config: retrieving interface for local IP
  2018-09-19 09:51:41.656301 D | config: no interface provided, looking for docker0
  2018-09-19 09:51:41.656830 I | clair: Pushing Layer 1/7 [sha256:605ce]
  2018-09-19 09:51:41.656982 D | clair: Saving sha256:605ce1bd3f3164f2949a30501cc596f52a72de05da1306ab360055f0d7130c32[https:// registry-1.docker.io/v2]
  2018-09-19 09:51:41.657113 D | clair: auth.insecureSkipVerify: true
  2018-09-19 09:51:41.657150 D | clair: request.URL.String(): https:// registry-1.docker.io/v2/my-org/my-container/blobs/sha256:605ce1bd3f3164f2949a30501cc596f52a72de05da1306ab360055f0d7130c32
  2018-09-19 09:51:42.809395 I | clair: pull from clair is unauthorized
  2018-09-19 09:51:43.941475 I | clair: adding layer 1/7 [sha256:605ce]: pushing layer to clair: Post http:// localhost:6060/v1/layers: dial tcp [::1]:6060: getsockopt: connection refused
  client quit unexpectedly
  2018-09-19 09:51:43.941545 C | cmd: pushing image "my-org/my-container:186": pushing layer to clair: Post http:// localhost:6060/v1/layers: dial tcp [::1]:6060: getsockopt: connection refused
  [root@clair-server clairctl]#
  
  ```
  
  I want to eventually use the CLI to integrate clairctl with Jenkins to implement a quality/security gate. Is there some way for the scans to proceed (ideally without docker-compose) to work? Could you please help me here? I tried to Google around and read threads about how to overcome this barrier, but could not figure out a way. I thought of posting the question in clairctl/Lobby on Gitter, but thought I couldn't express myself in detail.
  
  Any guidance, help would be highly appreciated. Could you please help me?
  
  **Tags:** containers, docker-compose, security, clair
  
  > **Comments:**
  > **username_0**: Thank you for helping to edit formatting of the post. Frankly I had tried to not post some content in bold and to put code as code blocks. However, I couldn't figure out the precise way to get it done. Thanks again. Appreciate it!  
  > **username_1**: There is a brief Markdown help on the right when you're editing, and a preview below the edit box. Some details are tricky, such as getting a code block inside an enumerated list. The rows of equals signs are a Markdown instruction to create a headline so you want to avoid that as a general separator.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2018-09-25. Score: 0 | Accepted answer
  
  I eventually figured out that Clair server was running inside the container and its service ports - 6060 (API) and 6061 (Health) were available only inside the container context. I confirmed this by running these commands:
  
  Command to see the open ports inside the clair container
  
  `docker-compose exec clair netstat -anp`
  
  Command to see the open ports inside the clairctl container
  
  `docker-compose exec clairctl netstat -anp`
  
  The clairctl analyze operation was failing inside the container as docker login context was not available inside. I figured out that I will have to expose the ports 6060, 6061 from inside Clair server outside the container context. Only then could it be visible using clairctl binary copied outside the container where the docker login context is available. I did the following three changes post which I could run the clairctl commands successfully.
  
  1. Copied the file <https://github.com/jgsqware/clairctl/blob/master/clairctl.yml.default> as clairctl.yml into $HOME directory from where I had done docker login and was running clairctl commands.
  2. Updated the value of `uri` parameter in above file from `uri: http://clair` to `uri: http://localhost`
  3. Added the `ports` clause in section for `clair` into file /root/go/src/github.com/jgsqware/clairctl/docker-compose.yml as seen below
  
     ```
       clair:
         image: quay.io/coreos/clair:v2.0.0
         restart: unless-stopped
         ports:
           - "6060:6060"
           - "6061:6061"
  
     ```
  
  This exposed the ports 6060, 6061 inside the clair container to the localhost, after which commands like `clairctl health` and `clairctl analyze <container-image-name>` worked successfully.
  
  
  ---
  
  