nurmi
commented
4 years ago Hi @reimgun -
The docker-compose that anchore supplies by default is really meant as a quick start/simple/single host/single analyzer config - for a more scaled up deployment we'd recommend using the Helm chart and start using multiple hosts so that there is enough host resource to support parallel load, and the configuration for running multiple services is handled for you with Helm chart.
That being said, if you have a lot of resource on a single server and still want to run multiple analyzers on a single host, in order to add more analyzers to a deployment successfully, the system needs to have each analyzer register with a unique hostname and 'host id'. In a nutshell, the quickest way to achieve this is to make the service name (in docker compose), ANCHORE_ENDPOINT_HOSTNAME, and ANCHORE_HOST_ID environment variables the same name - e.g.
analyzer0:
...
environment:
- ANCHORE_ENDPOINT_HOSTNAME=analyzer0
- ANCHORE_HOST_ID=analyzer0
...
...
analyzer1:
...
environment:
- ANCHORE_ENDPOINT_HOSTNAME=analyzer1
- ANCHORE_HOST_ID=analyzer1
...
...With a successful configuration, you will then see multiple analyzer services running in both the output of docker-compose and the anchore system status output:
% docker-compose ps | grep analyzer
aevolumedev_analyzer0_1 /docker-entrypoint.sh anch ... Up (health: starting) 8228/tcp
aevolumedev_analyzer1_1 /docker-entrypoint.sh anch ... Up (health: starting) 8228/tcp
% anchore-cli system status | grep analyzer
Service analyzer (analyzer0, http://analyzer0:8228): up
Service analyzer (analyzer1, http://analyzer1:8228): up
% The telltale characteristic of ensuring that this is working is to queue up a few images for analysis, and confirm after a few minutes that more than one is in the 'analyzing' state in parallel
% anchore-cli image add centos:7
...
% anchore-cli image add centos:8
...
% sleep 15
% anchore-cli image list | grep analyzing
docker.io/centos:7 sha256:c2f1d5a9c0a81350fa0ad7e1eee99e379d75fe53823d44b5469eb2eb6092c941 analyzing
docker.io/centos:8 sha256:fd84102fc72960dd1b8da0ee3b4c13e3b0c1d2a085de118bc4c97821cd986e02 analyzing
%If everything is set up correctly, then you will be able to see as many unique digest images in 'analyzing' state as you have correctly configured analyzers.
Note again, that even with multiple analyzers, you will not see 'faster' analysis times by adding concurrency if your underlying server resources are constrained, as the analyzers will be competing for CPU, IO and memory resources - using the Helm chart and allocating multiple servers/nodes to your deployment is the recommended path.
Best -Dan
zhill
reimgun
nightfurys
Is this a request for help?: yes
Is this a BUG REPORT or a FEATURE REQUEST? (choose one): BUG REPORT
Version of Anchore Engine and Anchore CLI if applicable:
docker-compose exec api anchore-cli system status Service catalog (anchore-quickstart, http://catalog:8228): up Service analyzer (anchore-quickstart, http://analyzer:8228): up Service policy_engine (anchore-quickstart, http://policy-engine:8228): up Service simplequeue (anchore-quickstart, http://queue:8228): up Service apiext (anchore-quickstart, http://api:8228): up
Engine DB Version: 0.0.13 Engine Code Version: 0.7.3 anchore-cli, version 0.7.2
we have the following infrastructure:
Anchore engine V0.7.3 installed(docker-compose) on separate Jenkins Slave Server Redhat 7.8 with docker installed docker-ce-19.03.5-3.el7.x86_64 docker-compose ps Name Command State Ports
aevolume_analyzer_1 /docker-entrypoint.sh anch ... Up 8228/tcp aevolume_analyzer_2 /docker-entrypoint.sh anch ... Up 8228/tcp aevolume_analyzer_3 /docker-entrypoint.sh anch ... Up 8228/tcp aevolume_analyzer_4 /docker-entrypoint.sh anch ... Up 8228/tcp aevolume_api_1 /docker-entrypoint.sh anch ... Up 0.0.0.0:8228->8228/tcp aevolume_catalog_1 /docker-entrypoint.sh anch ... Up 8228/tcp aevolume_db_1 docker-entrypoint.sh postgres Up 5432/tcp aevolume_policy-engine_1 /docker-entrypoint.sh anch ... Up 8228/tcp aevolume_queue_1 /docker-entrypoint.sh anch ... Up 8228/tcp
What happened: i have started 3 jenkins build jobs to build docker images in parallel and scan them with anchore(only OS Feeds no nvdv2 Feeds). this was the result: 3 jobs starting 1 anchore job and the last one win`s.
the Fail Report shows that only at_ubi8_dotnet_radarlive_calc:latest was scanned.
What did you expect to happen: i expect that builds/anchore scans should work in parallel
Any relevant log output from /var/log/anchore: in the log files are no warnings or errors.
What docker images are you using: ubi8 -> https://www.redhat.com/en/blog/introducing-red-hat-universal-base-image
How to reproduce the issue: run 3 or 4 jenkins builds in parallel
Anything else we need to know: