{"Error":{"Message":"could not find layer"}}

[wcc526]

/root/projects/bin/analyze-local-images quay.io/coreos/clair-git:latest
2017-04-26 15:42:40.385232 I | Saving quay.io/coreos/clair-git:latest to local disk (this may take some time)
2017-04-26 15:42:48.722948 I | Retrieving image history
2017-04-26 15:42:48.735735 I | Analyzing 18 layers...
2017-04-26 15:42:48.735755 I | Analyzing
2017-04-26 15:42:48.738308 I | Could not analyze layer: Got response 400 with message {"Error":{"Message":"could not find layer"}}

docker attach 3bb0b52dfece
2017-04-26 07:37:23.915746 E | clair: layer : failed to extract data from /tmp/analyze-local-image-217567589//layer.tar: could not find layer
2017-04-26 07:37:23.915991 I | v1: 172.18.0.1:37518 "POST /v1/layers" 400 (1.223681ms)
2017-04-26 07:39:31.313341 I | v1: 10.2.4.191:50398 "GET /v1/namespaces" 200 (801.95µs)
2017-04-26 07:42:05.768879 E | clair: layer : failed to extract data from /tmp/analyze-local-image-278772881//layer.tar: could not find layer
2017-04-26 07:42:05.769150 I | v1: 172.18.0.1:37538 "POST /v1/layers" 400 (1.375868ms)
2017-04-26 07:42:20.720419 E | clair: layer : failed to extract data from /tmp/analyze-local-image-463395154//layer.tar: could not find layer
2017-04-26 07:42:20.720817 I | v1: 172.18.0.1:37544 "POST /v1/layers" 400 (1.533479ms)
2017-04-26 07:42:48.737657 E | clair: layer : failed to extract data from /tmp/analyze-local-image-217560860//layer.tar: could not find layer
2017-04-26 07:42:48.738027 I | v1: 172.18.0.1:37550 "POST /v1/layers" 400 (1.346907ms)
2017-04-26 07:43:08.665162 E | clair: layer : failed to extract data from /tmp/analyze-local-image-047019759//layer.tar: could not find layer
2017-04-26 07:43:08.665431 I | v1: 172.18.0.1:37554 "POST /v1/layers" 400 (1.735923ms)

docker version
Client:
Version: 1.12.0
API version: 1.24
Package version: docker-1.12.0-1004.el7.centos.x86_64
Go version: go1.6.3
Git commit: c5ec0f8/1.12.0
Built:
OS/Arch: linux/amd64

Server:
Version: 1.12.0
API version: 1.24
Package version: docker-1.12.0-1004.el7.centos.x86_64
Go version: go1.6.3
Git commit: c5ec0f8/1.12.0
Built:
OS/Arch: linux/amd64

[srkiNZ84]

I get this same issue with Docker 1.13.0:

ubuntu@ip-172-31-17-220:~$ docker version
Client:
 Version:      1.13.0
 API version:  1.25
 Go version:   go1.7.3
 Git commit:   49bf474
 Built:        Tue Jan 17 09:50:17 2017
 OS/Arch:      linux/amd64

Server:
 Version:      1.13.0
 API version:  1.25 (minimum version 1.12)
 Go version:   go1.7.3
 Git commit:   49bf474
 Built:        Tue Jan 17 09:50:17 2017
 OS/Arch:      linux/amd64
 Experimental: false

It looks like the same issue as #69 but that's marked as Closed/Fixed. Maybe a regression?

[wcc526]

clair not support docker 1.13.0,Please use docker 1.9.1

Clair is broken because of the content addressability inconsistencies in docker 1.10 (clair works fine till docker version 1.9.1); "docker history" command gives SHA256 layer IDs, while "docker save" command saves the layers.tar files in plain layer-UID directories.
Not sure if clair is going to fix the issue or will it be taken care of when distribution/distribution#727 feature is supported by Docker.

#69

[jzelinskie]

closing due to age. the analyze-local-images tool is deprecated and you should use clairctl instead. thanks

[archmangler]

I'm getting this same issue with the latest clair versions using Docker version 18.03.1-ce, build 9ee9f40. Is there a resolution for this issue or is claire's image scanning functionality broken?

[gojihotsauce]

Running into this same issue using clairctl.

[Karreg]

Same here... clair-git is broken, and clair seems broken too. Docker CE 18.03.1 and clairctl 1.2.8

[jzelinskie]

clairctl does not support Clair v3. Clair is not broken.

[Karreg]

Thanks for the feedback. I'm a little lost since it's not displayed as "deprecated" contrary to analyze-local-images.

I guess it means we have to find another CLI. I'll go back to my search then. Seems Klar could be the only option? I'll check that. Thanks.

[jzelinskie]

clairctl was never an official tool, whereas analyze-local-images was once checked into this git repository and was recommended only as a development tool.

I believe reg now works with Clair v3, but I haven't tested it myself.

[Karreg]

The issue, for me, is that there don't seem to be any "official" tool. The only list is Integration tools and Clairctl is listed. Even before analyze-local-images.

Yesterday I have tried paclair without success (the tool is crashing). Next test is Yair, but the CLI is a real need, and possibilities are not clear on that side :(

It takes far much time to find a way to scan images with Clair than setuping Clair. A real "official" tool with release cycles matching the one of Clair would be a great way to improve Clair.

[calbutl]

@archmangler I am having the same troubles now with Docker version 18.03.1-ce. Did you resolve your issue?

[prashant-wipro]

This is a prevailing issue, please provide the steps to resolve this issue. We are getting the same issue with the current version of Clair.

[prashant-wipro]

Adding further details here:

Docker version used:

docker version
Client: Docker Engine - Community
 Version:           19.03.10
 API version:       1.40
 Go version:        go1.13.10
 Git commit:        9424aeaee9
 Built:             Thu May 28 22:18:06 2020
 OS/Arch:           linux/amd64
 Experimental:      false

 

Server: Docker Engine - Community
 Engine:
  Version:          19.03.11
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.13.10
  Git commit:       42e35e61f3
  Built:            Mon Jun  1 09:12:26 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

Here is the klar command output:

----> HTTP REQUEST:
GET /v2/dockerrepo/busybox/manifests/latest HTTP/1.1
Host: jfrogprod.somesite.com
Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.v1+prettyjws
Authorization: Basic NNNNNNNNNNNNNNNNNNNNNNNNN

<---- HTTP RESPONSE:
HTTP/1.1 200 OK
Content-Length: 527
Accept-Ranges: bytes
Cache-Control: no-store
Connection: keep-alive
Content-Disposition: attachment; filename="manifest.json"
Content-Type: application/vnd.docker.distribution.manifest.v2+json
Date: Thu, 09 Jul 2020 08:12:07 GMT
Docker-Content-Digest: sha256:edafc0a0fb057813850d1ba44014914ca02d671ae247107ca70c94db686e7de6
Docker-Distribution-Api-Version: registry/2.0
Etag: 209b229a55becf82d40e1c8be22b5abac11e454a
Last-Modified: Tue, 28 Jan 2020 14:41:13 GMT
Server: Artifactory/6.18.1
Set-Cookie: AWSALB=ib9pMKS/z6bnpwgZVH4vdoBr8GqJV388BZj4/Na4b9KQBFnSUBWu1TwTOckTUPElkRTYYgxTiRlzZL51riRGy50IP/p4y89uT2Dt7fPqHmMg6D/0Ize6Bra5Smes; Expires=Thu, 16 Jul 2020 08:12:07 GMT; Path=/
Set-Cookie: AWSALBCORS=ib9pMKS/z6bnpwgZVH4vdoBr8GqJV388BZj4/Na4b9KQBFnSUBWu1TwTOckTUPElkRTYYgxTiRlzZL51riRGy50IP/p4y89uT2Dt7fPqHmMg6D/0Ize6Bra5Smes; Expires=Thu, 16 Jul 2020 08:12:07 GMT; Path=/; SameSite=None; Secure
X-Artifactory-Filename: manifest.json
X-Artifactory-Id: a82bf4e0b9da329738c800d95393806813c01680
X-Artifactory-Node-Id: art-15749495715654
X-Checksum-Md5: 5c344f652b0b64b941621f2ebba6c3cb
X-Checksum-Sha1: 209b229a55becf82d40e1c8be22b5abac11e454a
X-Checksum-Sha256: edafc0a0fb057813850d1ba44014914ca02d671ae247107ca70c94db686e7de6

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/vnd.docker.container.image.v1+json",
      "size": 1497,
      "digest": "sha256:6d5fcfe5ff170471fcc3c8b47631d6d71202a1fd44cf3c147e50c8de21cf0648"
   },
   "layers": [
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 760984,
         "digest": "sha256:bdbbaa22dec6b7fe23106d2c1b1f43d9598cd8fc33706cc27c1d938ecd5bffc7"
      }
   ]
}
----> HTTP REQUEST:
POST /v1/layers HTTP/1.1
Host: localhost:6060
Content-Type: application/json

{"Layer":{"Name":"6d5fcfe5ff170471fcc3c8b47631d6d71202a1fd44cf3c147e50c8de21cf0648bdbbaa22dec6b7fe23106d2c1b1f43d9598cd8fc33706cc27c1d938ecd5bffc7","Path":"https://jfrogprod.somesite.com/v2/dockerrepo/busybox/blobs/sha256:bdbbaa22dec6b7fe23106d2c1b1f43d9598cd8fc33706cc27c1d938ecd5bffc7","ParentName":"","Format":"Docker","Features":null,"Headers":{"Authorization":"Basic NNNNNNNNNNNNNNNNNNNNNNNNN"}}}
<---- HTTP RESPONSE:
HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=utf-8
Date: Thu, 09 Jul 2020 08:12:07 GMT
Server: clair

{"Error":{"Message":"could not find layer"}}

Failed to analyze using API v1: push image https://jfrogprod.somesite.com/v2/dockerrepo/busybox:latest to Clair failed: push error 400: {"Error":{"Message":"could not find layer"}}

Failed to analyze using API v3: push image https://jfrogprod.somesite.com/v2/dockerrepo/busybox:latest to Clair failed: rpc error: code = Unavailable desc = transport is closing

Failed to analyze, exiting

[git-prabhut]

Had same issue with Docker-CE (19.03.6) running on Linux/amd64.

When I opened the port 9279 (using ufw command), it started working.