OCI Tarballs not working #5135

ReillyBrogan · 2023-09-07T02:07:21Z

ReillyBrogan
Sep 7, 2023

Description

Buildkit (and Docker when using the buildx plugin) exports an OCI image as a tar file when building with --output type=oci,dest=path/to/output.tar. Trivy errors out when scanning this archive with the following error:

FATAL   image scan error: scan error: unable to initialize a scanner: unable to initialize the archive scanner: 2 errors occurred:
        * unable to open output.tar as a Docker image: file manifest.json not found in tar
        * unable to open output.tar as an OCI Image: stat output.tar/index.json: not a directory

Desired Behavior

For it to successfully scan the image.

Actual Behavior

Error message

Reproduction Steps

1. Use buildkit to build a sample dockerfile with `buildctl build --frontend=dockerfile.v0 --local context=. --local dockerfile=. --output type=oci,dest=path/to/output.tar`
2. `trivy image --input output.tar

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

None

Debug Output

2023-09-06T21:06:36.996-0500    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-09-06T21:06:36.997-0500    DEBUG   Ignore statuses {"statuses": null}
2023-09-06T21:06:37.007-0500    DEBUG   cache dir:  /home/reilly/.cache/trivy
2023-09-06T21:06:37.007-0500    DEBUG   DB update was skipped because the local DB is the latest
2023-09-06T21:06:37.007-0500    DEBUG   DB Schema: 2, UpdatedAt: 2023-09-07 00:26:18.880588019 +0000 UTC, NextUpdate: 2023-09-07 06:26:18.880587319 +0000 UTC, DownloadedAt: 2023-09-07 01:26:59.398513802 +0000 UTC
2023-09-06T21:06:37.007-0500    INFO    Vulnerability scanning is enabled
2023-09-06T21:06:37.007-0500    DEBUG   Vulnerability type:  [os library]
2023-09-06T21:06:37.007-0500    INFO    Secret scanning is enabled
2023-09-06T21:06:37.007-0500    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-09-06T21:06:37.007-0500    INFO    Please see also https://aquasecurity.github.io/trivy/v0.45/docs/scanner/secret/#recommendation for faster secret detection
2023-09-06T21:06:37.014-0500    FATAL   image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:424
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:268
  - unable to initialize a scanner:
    github.com/aquasecurity/trivy/pkg/commands/artifact.scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:679
  - unable to initialize the archive scanner:
    github.com/aquasecurity/trivy/pkg/commands/artifact.archiveStandaloneScanner
        /home/runner/work/trivy/trivy/pkg/commands/artifact/scanner.go:27
  - 2 errors occurred:
        * unable to open output.tar as a Docker image: file manifest.json not found in tar
        * unable to open output.tar as an OCI Image: stat output.tar/index.json: not a directory

Operating System

Linux

Version

Version: 0.45.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-09-07 00:26:18.880588019 +0000 UTC
  NextUpdate: 2023-09-07 06:26:18.880587319 +0000 UTC
  DownloadedAt: 2023-09-07 01:26:59.398513802 +0000 UTC

Checklist

Run trivy image --reset
Read the troubleshooting

Answered by DmitriyLewen

Dec 12, 2023

Hello everyone!

We do not currently support OCI tar images - https://aquasecurity.github.io/trivy/v0.48/docs/target/container_image/#tar-files.
But we support image directories for OCI images - https://aquasecurity.github.io/trivy/v0.48/docs/target/container_image/#oci-layout.

To avoid compressing images in tar using buildx, use tar parameter - https://docs.docker.com/build/exporters/oci-docker/
e.g.:

➜  buildkit git:(master) ✗ docker buildx build -o type=oci,tar=false,dest=myimage . 
...

➜  buildkit git:(master) ✗ trivy image --input myimage
2023-12-12T14:00:38.631+0600	INFO	Vulnerability scanning is enabled
2023-12-12T14:00:38.632+0600	INFO	Secret scanning is enabled
2023-12-12T14:00:3…

View full answer

jemag · 2023-12-06T16:51:30Z

jemag
Dec 6, 2023

I can reproduce.
Just want to mention that it is possible to use --output type=docker to have the manifest.json and make it work in the meantime (although this won't be a true OCI compliant output).

In the long run, trivy should definitely support OCI tarballs

0 replies

jemag · 2023-12-06T16:53:21Z

jemag
Dec 6, 2023

As a last note, you need v0.12.x+ to reproduce this, since there was a bug before which would include the manifest.json, this has since been fixed, see: moby/buildkit#4131

0 replies

DmitriyLewen · 2023-12-08T07:14:30Z

DmitriyLewen
Dec 8, 2023
Maintainer

Hello!
Can you check the file structure of your tar archives?
This appears to be the #3080 case.

0 replies

jemag · 2023-12-08T17:19:36Z

jemag
Dec 8, 2023

This is the content of the OCI archive with buildkit v.0.12.3:

The issue you mentionned has the manifest.json inside the archive, which is not the case here. As mentioned in my previous comment, manifest.json has been removed since buildkit v0.12.x, as it was a bug and should not have been there in the first place. The Docker manifest.json is not part of OCI spec.

1 reply

DmitriyLewen Dec 11, 2023
Maintainer

Thank you very much for this!
This will help me.

Give me some time. I will try to solve this problem.

DmitriyLewen · 2023-12-12T08:07:38Z

DmitriyLewen
Dec 12, 2023
Maintainer

Hello everyone!

We do not currently support OCI tar images - https://aquasecurity.github.io/trivy/v0.48/docs/target/container_image/#tar-files.
But we support image directories for OCI images - https://aquasecurity.github.io/trivy/v0.48/docs/target/container_image/#oci-layout.

To avoid compressing images in tar using buildx, use tar parameter - https://docs.docker.com/build/exporters/oci-docker/
e.g.:

➜  buildkit git:(master) ✗ docker buildx build -o type=oci,tar=false,dest=myimage . 
...

➜  buildkit git:(master) ✗ trivy image --input myimage
2023-12-12T14:00:38.631+0600	INFO	Vulnerability scanning is enabled
2023-12-12T14:00:38.632+0600	INFO	Secret scanning is enabled
2023-12-12T14:00:38.632+0600	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-12-12T14:00:38.632+0600	INFO	Please see also https://aquasecurity.github.io/trivy/v0.48/docs/scanner/secret/#recommendation for faster secret detection
2023-12-12T14:00:38.641+0600	INFO	Detected OS: alpine
2023-12-12T14:00:38.641+0600	INFO	Detecting Alpine vulnerabilities...
2023-12-12T14:00:38.645+0600	INFO	Number of language-specific files: 3
2023-12-12T14:00:38.645+0600	INFO	Detecting gobinary vulnerabilities...

myimage (alpine 3.18.5)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


usr/bin/buildctl (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│                           Library                            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/contrib/instrumentation/google.golang.o- │ CVE-2023-47108 │ HIGH     │ fixed  │ v0.45.0           │ 0.46.0        │ opentelemetry-go-contrib: DoS vulnerability in otelgrpc due │
│ rg/grpc/otelgrpc                                             │                │          │        │                   │               │ to unbound cardinality metrics                              │
│                                                              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-47108                  │
└──────────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

usr/bin/buildkit-runc (gobinary)

Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌───────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│                Library                │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├───────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/cyphar/filepath-securejoin │ GHSA-6xv5-86q9-7xr8 │ MEDIUM   │ fixed  │ v0.2.3            │ 0.2.4         │ SecureJoin: on windows, paths outside of the rootfs could be │
│                                       │                     │          │        │                   │               │ inadvertently produced...                                    │
│                                       │                     │          │        │                   │               │ https://github.com/advisories/GHSA-6xv5-86q9-7xr8            │
├───────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net                      │ CVE-2023-39325      │ HIGH     │        │ v0.8.0            │ 0.17.0        │ golang: net/http, x/net/http2: rapid stream resets can cause │
│                                       │                     │          │        │                   │               │ excessive work (CVE-2023-44487)                              │
│                                       │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
│                                       ├─────────────────────┼──────────┤        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                                       │ CVE-2023-3978       │ MEDIUM   │        │                   │ 0.13.0        │ golang.org/x/net/html: Cross site scripting                  │
│                                       │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-3978                    │
│                                       ├─────────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                                       │ CVE-2023-44487      │          │        │                   │ 0.17.0        │ HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable   │
│                                       │                     │          │        │                   │               │ to a DDoS attack...                                          │
│                                       │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
└───────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

usr/bin/buildkitd (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│                           Library                            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/contrib/instrumentation/google.golang.o- │ CVE-2023-47108 │ HIGH     │ fixed  │ v0.45.0           │ 0.46.0        │ opentelemetry-go-contrib: DoS vulnerability in otelgrpc due │
│ rg/grpc/otelgrpc                                             │                │          │        │                   │               │ to unbound cardinality metrics                              │
│                                                              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-47108                  │
└──────────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

But tar compression is enabled for buildx by default.
Looks like we need to add support for OCI tarballs.
I created #5775 for this task.

Regards, Dmitriy

0 replies

Navigation Menu

Repository navigation

OCI Tarballs not working #5135

Uh oh!

{{title}}

Uh oh!

Replies: 5 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

OCI Tarballs not working #5135

Uh oh!

ReillyBrogan Sep 7, 2023

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 5 comments · 1 reply

Uh oh!

jemag Dec 6, 2023

Uh oh!

jemag Dec 6, 2023

Uh oh!

DmitriyLewen Dec 8, 2023 Maintainer

Uh oh!

jemag Dec 8, 2023

Uh oh!

DmitriyLewen Dec 11, 2023 Maintainer

Uh oh!

Uh oh!

DmitriyLewen Dec 12, 2023 Maintainer

ReillyBrogan
Sep 7, 2023

Replies: 5 comments 1 reply

jemag
Dec 6, 2023

jemag
Dec 6, 2023

DmitriyLewen
Dec 8, 2023
Maintainer

jemag
Dec 8, 2023

DmitriyLewen Dec 11, 2023
Maintainer

DmitriyLewen
Dec 12, 2023
Maintainer