False positives due to a layer having different parents

[MrTrustor]

Hello,

First of all, thank you for your work, Clair is an impressive software.

We are using Clair internally for our private repositories and we ran into the issue described in #68. To sum up: Clair is not aware of the whole chain of layers that make up a Docker image. As a layer is identified by its content, you can have the same layer in different images, with different parents, leading to false positives (or false negatives).

Here is how we ran into the problem:

1. We built an image FROM grafana/grafana:4.1.1. Clair informed us that there were some vulnerabilities in this image (because it was not built from the latest debian:jessie image). The Dockerfile looks like this:

FROM grafana/grafana:4.1.1
COPY file1 /foo
COPY file2.sh /bar
ENTRYPOINT ['/bar/file2.sh']

2. To fix the problem, we took the Dockerfile from grafana/grafana:4.1.1 and sourced our image directly from the latest debian:jessie:

FROM debian:jessie
ARG DOWNLOAD_URL
RUN apt-get update && \
    apt-get -y --no-install-recommends install libfontconfig curl ca-certificates && \
    apt-get clean && \
    curl ${DOWNLOAD_URL} > /tmp/grafana.deb && \
    dpkg -i /tmp/grafana.deb && \
    rm /tmp/grafana.deb && \
    curl -L https://github.com/tianon/gosu/releases/download/1.7/gosu-amd64 > /usr/sbin/gosu && \
    chmod +x /usr/sbin/gosu && \
    apt-get remove -y curl && \
    apt-get autoremove -y && \
    rm -rf /var/lib/apt/lists/*
EXPOSE 3000
COPY file1 /foo
COPY file2.sh /bar
ENTRYPOINT ['/bar/file2.sh']

The last few layers are the same in the 2 resulting images, but the parents are not. In the first case, the parents have some vulnerabilities while they have not in the second (they have only vulnerabilities for which there is no fix).

When POSTing the layers of the second image to Clair, we got a 201 status code, but the parent of the layers were not updated in the database. So, when fetching the vulnerabilities for the last layer of the second image, we actually got the vulnerabilities of the first image.

In #68, it is said that the issue has been identified and put into the roadmap, but the current roadmap makes no mention of it. Is this problem still identified somewhere?

[MrTrustor]

Any answer to this?

[jzelinskie]

This issue does not effect Clair v3 as we force users to post all the layers in an image upfront and we do not conflate relationships outside of that specified ancestry.