Can't scan images via Clair

[seanlutner]

I'll start by saying that I'm not sure if this is an issue with Klar or with Clair itself. I've setup two different instances of Klar and Clair (local on my laptop and on a remote system) and I am seeing errors when trying to scan any Docker images.

→ ./klar my_team/centos7
Can't pull image: Token request returned 401%                                                                                                    
→ ./klar registry.domain.com:31832/my_team/centos7
Decode error
Can't pull image: json: cannot unmarshal number into Go value of type docker.Image% ```

When I look at the logs from the Clair container, I see no errors and I've set CLAIR_ADDR to the clair instance. Any idea what's happening and what I can do to fix it?

[hashmap]

Thanks for your report. Klar tries to follow docker images output convention for image naming to make UX better. Which means:

• my_team/centos7 considered as an image in Docker public registry, translated to the full name registry-1.docker.io/my_team/centos7:latest
• centos7 considered as an official image in Docker public registry, translated to the full name registry-1.docker.io/library/centos7:latest For those cases Klar expects docker credentials to be set it's why you get Can't pull image: Token request returned 401
• registry.domain.com/my_team/centos7 is considered as an image my_team/centos7 in private registry registry.domain.com. Unfortunately only HTTPS (port 443) is supported at the moment, it's why you got a strange error when you specified the port 31832. I'm going to add this functionality.

[hashmap]

Please try a new version (v 1.1)

[seanlutner]

Awesome, that worked! Thanks for the super fast turn around. On additional question. Is Klar doing the docker pull on the image or is that passed off to Clair? My registry uses an internally signed SSL certificate, so I'm wondering where I need to add that as trusted.

[hashmap]

Cool. Klar retrieves only metadata via HTTPS and send it to Clair which pulls layer by layer, so technically both components make requests to the registry.