Trivy doesn't work with Docker Desktop configured to use containerd to pull and store images

[GrayCatCode]

Description

Trivy can't find local images (on Windows or WSL Linux distros) when running Docker Desktop configured to use containerd to pull and store images. Instead of scanning the local Docker image, I had to use the image's TAR file to scan instead.

Desired Behavior

I would have hoped (not expected) that Trivy would find the local images even though Docker Desktop has been configured to use the new local image format repository with containerd.

Actual Behavior

Trivy could not find the local image specified in the scan command and thus created no scan report.

Reproduction Steps

BASh v5.2.21 in ~/SP-694/trivy_scan_reports/table (142) >> trivy image -f table <image_name) -o <image_name>_trivy_table.txt --debug
2024-09-24T16:05:02-04:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-09-24T16:05:02-04:00       DEBUG   Cache dir       dir="/home/andy/.cache/trivy"
2024-09-24T16:05:02-04:00       DEBUG   Cache dir       dir="/home/andy/.cache/trivy"
2024-09-24T16:05:02-04:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-09-24T16:05:02-04:00       DEBUG   Ignore statuses statuses=[]
2024-09-24T16:05:02-04:00       DEBUG   DB update was skipped because the local DB is the latest
2024-09-24T16:05:02-04:00       DEBUG   DB info schema=2 updated_at=2024-09-24T18:14:28.501989995Z next_update=2024-09-25T00:14:28.501989764Z downloaded_at=2024-09-24T19:28:28.757544822Z
2024-09-24T16:05:02-04:00       DEBUG   [pkg] Package types     types=[os library]
2024-09-24T16:05:02-04:00       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-09-24T16:05:02-04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-09-24T16:05:02-04:00       INFO    [secret] Secret scanning is enabled
2024-09-24T16:05:02-04:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-24T16:05:02-04:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-24T16:05:02-04:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-09-24T16:05:02-04:00       DEBUG   Initializing scan cache...      type="fs"
2024-09-24T16:05:02-04:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-09-24T16:05:02-04:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-09-24T16:05:02-04:00       DEBUG   [image] Detected image ID       image_id="sha256:75cae5dc80cb39885b12722378fc47d9092875ccbfdb4c973684453d403a24c8"
2024-09-24T16:05:02-04:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:0186c1255553590a3fd62ce206b7d5e351e9ab5cca9703c4c32110d9dc91c956]
2024-09-24T16:05:02-04:00       DEBUG   [image] Detected base layers    diff_ids=[]
2024-09-24T16:05:02-04:00       DEBUG   OS is not detected.
2024-09-24T16:05:02-04:00       DEBUG   Detected OS: unknown
2024-09-24T16:05:02-04:00       INFO    Number of language-specific files       num=0
2024-09-24T16:05:02-04:00       DEBUG   [vex] VEX filtering is disabled

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

BASh v5.2.21 in ~/SP-694/trivy_scan_reports/table (142) >> trivy image -f table nexus-docker.farsight.internal/bitnami/mongodb:7.0.3-debian-11-r1 -o nexus-docker_farsight_internal_bitnami_mongodb_7pt0pt3-debian-11-r1_trivy_table.txt --debug
2024-09-24T16:05:02-04:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-09-24T16:05:02-04:00       DEBUG   Cache dir       dir="/home/andy/.cache/trivy"
2024-09-24T16:05:02-04:00       DEBUG   Cache dir       dir="/home/andy/.cache/trivy"
2024-09-24T16:05:02-04:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-09-24T16:05:02-04:00       DEBUG   Ignore statuses statuses=[]
2024-09-24T16:05:02-04:00       DEBUG   DB update was skipped because the local DB is the latest
2024-09-24T16:05:02-04:00       DEBUG   DB info schema=2 updated_at=2024-09-24T18:14:28.501989995Z next_update=2024-09-25T00:14:28.501989764Z downloaded_at=2024-09-24T19:28:28.757544822Z
2024-09-24T16:05:02-04:00       DEBUG   [pkg] Package types     types=[os library]
2024-09-24T16:05:02-04:00       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-09-24T16:05:02-04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-09-24T16:05:02-04:00       INFO    [secret] Secret scanning is enabled
2024-09-24T16:05:02-04:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-24T16:05:02-04:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-24T16:05:02-04:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-09-24T16:05:02-04:00       DEBUG   Initializing scan cache...      type="fs"
2024-09-24T16:05:02-04:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-09-24T16:05:02-04:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-09-24T16:05:02-04:00       DEBUG   [image] Detected image ID       image_id="sha256:75cae5dc80cb39885b12722378fc47d9092875ccbfdb4c973684453d403a24c8"
2024-09-24T16:05:02-04:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:0186c1255553590a3fd62ce206b7d5e351e9ab5cca9703c4c32110d9dc91c956]
2024-09-24T16:05:02-04:00       DEBUG   [image] Detected base layers    diff_ids=[]
2024-09-24T16:05:02-04:00       DEBUG   OS is not detected.
2024-09-24T16:05:02-04:00       DEBUG   Detected OS: unknown
2024-09-24T16:05:02-04:00       INFO    Number of language-specific files       num=0
2024-09-24T16:05:02-04:00       DEBUG   [vex] VEX filtering is disabled

Operating System

Ubuntu 24.04 LTS running in WSL on Windows 11

Version

Version: 0.55.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-09-24 18:14:28.501989995 +0000 UTC
  NextUpdate: 2024-09-25 00:14:28.501989764 +0000 UTC
  DownloadedAt: 2024-09-24 19:28:28.757544822 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-09-11 01:10:55.779117612 +0000 UTC
  NextUpdate: 2024-09-14 01:10:55.779117401 +0000 UTC
  DownloadedAt: 2024-09-12 00:39:45.13205206 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

According to the log output, Trivy appears to find your image but doesn't detect OS.

2024-09-24T16:05:02-04:00       DEBUG   [image] Detected image ID       image_id="sha256:75cae5dc80cb39885b12722378fc47d9092875ccbfdb4c973684453d403a24c8"
2024-09-24T16:05:02-04:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:0186c1255553590a3fd62ce206b7d5e351e9ab5cca9703c4c32110d9dc91c956]
2024-09-24T16:05:02-04:00       DEBUG   [image] Detected base layers    diff_ids=[]
...
2024-09-24T16:05:02-04:00       DEBUG   OS is not detected.

[knqyf263]

We can look into if if you share the image.

[GrayCatCode]

How is the best way for me to do that? :)

[GrayCatCode]

I also notice that, when I run the Trivy extension in Docker Desktop against an image in the containerd image store I get the following message:

An error occurred while scanning <image_name> FATAL Fatal error image scan error: scan error: scan failed: failed analysis: analyze error: pipeline error: failed to analyze layer (sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef): walk error: failed to extract the archive: unexpected EOF

[GrayCatCode]

I would definitely like to provide you with an image if that would be helpful ... let me know how best to do that for you. 👍🏻

[knqyf263]

It would be great if you could share a small Dockerfile to reproduce the problem.