https://rancher.com/ logo
Join Slack
Powered by
I am doing a trivy scan on my image `trivy image ...
# general
b
I am doing a trivy scan on my image 
trivy image --severity CRITICAL,HIGH --exit-code 1 segment-api:latest
--- and I get this error
Copy code
2025-03-31T13:32:31+01:00	INFO	[vulndb] Need to update DB
2025-03-31T13:32:31+01:00	INFO	[vulndb] Downloading vulnerability DB...
2025-03-31T13:32:31+01:00	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
61.66 MiB / 61.66 MiB [---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 7.36 MiB p/s 8.6s
2025-03-31T13:32:40+01:00	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-03-31T13:32:40+01:00	INFO	[vuln] Vulnerability scanning is enabled
2025-03-31T13:32:40+01:00	INFO	[secret] Secret scanning is enabled
2025-03-31T13:32:40+01:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-03-31T13:32:40+01:00	INFO	[secret] Please see also <https://aquasecurity.github.io/trivy/v0.59/docs/scanner/secret#recommendation> for faster secret detection
2025-03-31T13:32:41+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: unable to find the specified image "segment-api:latest" in ["docker" "containerd" "podman" "remote"]: 4 errors occurred:
	* docker error: unable to inspect the image (segment-api:latest): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
	* containerd error: containerd socket not found: /run/containerd/containerd.sock
	* podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
	* remote error: GET <https://index.docker.io/v2/library/segment-api/manifests/latest>: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:library/segment-api Type:repository]]
m
Hi Sandeep, your question is quite vague, are you running the trivy command on your local machine, rancher-desktop, CI pipeline?
b
In my local machine
m
what is your container runtime? docker, podman, nerdctl?
b
docker
m
are you running the trivy cli or using docker to run a trivy container image?
b
trivy cli
m
Am less familiar with docker, but can you check that you have docker.sock in 
/var/run/docker.sock
? Is your user part of the docker group?
b
yes my user is part of docker group
m
I just searched that image and I don't see a segment-api in dockerhub. Is that a custom image you created?
b
yes thats the image I have build in my
local
and I am running to trivy to scan the image
m
then you need to specify 
localhost/segment-api:latest
by default if you provide just the image name it defers to dockerhub
b
same error @mysterious-animal-29850 
sandeep.das@D4092W76P6 iiris-apis % trivy image --severity CRITICAL,HIGH --exit-code 1 localhost/segment-api:latest
Copy code
2025-04-01T03:40:44+01:00	INFO	[vuln] Vulnerability scanning is enabled
2025-04-01T03:40:44+01:00	INFO	[secret] Secret scanning is enabled
2025-04-01T03:40:44+01:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-04-01T03:40:44+01:00	INFO	[secret] Please see also <https://aquasecurity.github.io/trivy/v0.59/docs/scanner/secret#recommendation> for faster secret detection
2025-04-01T03:40:45+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: unable to find the specified image "localhost/segment-api:latest" in ["docker" "containerd" "podman" "remote"]: 4 errors occurred:
	* docker error: unable to inspect the image (localhost/segment-api:latest): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
	* containerd error: containerd socket not found: /run/containerd/containerd.sock
	* podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
	* remote error: GET <https://index.docker.io/v2/localhost/segment-api/manifests/latest>: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:localhost/segment-api Type:repository]]
m
When you run ‘docker images’ is the image you built in the list?
b
Yes...
Copy code
sandeep.das@D4092W76P6 iiris-apis % docker image ls
REPOSITORY                                          TAG                    IMAGE ID       CREATED         SIZE
segment-api                                         latest                 86cd9a653dbc   14 hours ago    965MB
m
Ok, I take back the localhost. You should refer to your container as segment-api. Are you running docker in rootless mode?
b
Ok it works now @mysterious-animal-29850. Here is the revised command 
trivy image --severity CRITICAL,HIGH --exit-code 1 --docker-host unix:///Users/sandeep.das/.rd/docker.sock segment-api:latest
Open Issue: docker context isn't respected to select the docker daemon https://github.com/aquasecurity/trivy/issues/7686
m
The error states it can’t connect to the docker daemon. Check that it’s running and you have access to it
I asked if you were using rancher desktop… for this reason…
👍 1
b
will keep an eye on this open issue, thanks for your inputs
7 Views
Open in Slack
PreviousNext
Powered by