Snyk: [🐛] Authentication failed error when testing container with Dockerfile

[maprokes]

• node -v: v12.18.0
• npm -v: 6.14.4
• snyk -v: 1.423.0
• OS: Linux
• Command run: snyk container test local/service --file=local/image/Dockerfile

Expected behavior

Container is tested for vulns.

Actual behaviour

After building the image and running command above I get the following error:
Authentication failed. Please check the API token on https://snyk.io

If I run the test without --file switch it runs fine

Steps to reproduce

snyk auth

Dockerfile :

FROM golang:alpine AS build-env
RUN apk update && apk add ca-certificates git && update-ca-certificates && rm -rf /var/cache/apk/*

Build image:

docker build -t local/service:1234 -f services/local/Dockerfile .

Debug log

snyk --debug container test local/service --file=services/local/Dockerfile
  snyk test {
  _: [ 'local/service', [Circular] ],
  debug: true,
  file: 'services/local/Dockerfile',
  docker: true,
  experimental: true,
  callGraphBuilderTimeout: '300'
} +0ms
  snyk Docker.save: targetImage: local/service, destination: /tmp/tmp-11108-Wq18uTJTkqd4/c9cbba40-f77c-420d-9793-f48b489d715e/image.tar +0ms
  snyk Potential policy locations found: [] +0msvice/services/local/Dockerfile
  snyk sending request to: https://snyk.io/api/v1/test-dependencies +0ms
  snyk request body size: 10441 +0ms
  snyk gzipped request body size: 2132 +1ms
  snyk not using proxy +1ms
  snyk Can't remove folder /tmp/tmp-11108-Wq18uTJTkqd4/c9cbba40-f77c-420d-9793-f48b489d715e, got error null +0ms
  snyk:run-test Error running test {
  error: CustomError: Authentication failed. Please check the API token on https://snyk.io
      at Object.AuthFailedError (/home/martin/.config/yarn/global/node_modules/snyk/src/lib/errors/authentication-failed-error.ts:9:17)
      at handleTestHttpErrorResponse (/home/martin/.config/yarn/global/node_modules/snyk/src/lib/snyk-test/run-test.ts:453:13)
      at /home/martin/.config/yarn/global/node_modules/snyk/src/lib/snyk-test/run-test.ts:436:21
      at module.exports (/home/martin/.config/yarn/global/node_modules/snyk/src/lib/request/index.ts:19:7)
      at runMicrotasks (<anonymous>)
      at processTicksAndRejections (internal/process/task_queues.js:97:5) {
    code: 403,
    innerError: undefined,
    userMessage: 'Authentication failed. Please check the API token on https://snyk.io',
    strCode: 'authfail'
  }
} +0ms
  snyk-test Failed to test 1 projects, errors: +0ms
  snyk-test error: FailedToRunTestError: Authentication failed. Please check the API token on https://snyk.io
    at runTest (/home/martin/.config/yarn/global/node_modules/snyk/src/lib/snyk-test/run-test.ts:322:11)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:97:5) +1ms
Error: 
Testing local/service...

Authentication failed. Please check the API token on https://snyk.io
    at test (/home/martin/.config/yarn/global/node_modules/snyk/src/cli/commands/test/index.ts:309:19)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:97:5)
  snyk analytics {
  args: [
    'local/service',
    {
      debug: true,
      file: 'services/local/Dockerfile',
      docker: true,
      experimental: true,
      callGraphBuilderTimeout: '300',
      org: undefined,
      showVulnPaths: 'some'
    }
  ],
  command: 'bad-command',
  org: undefined,
  metadata: {
    local: true,
    policies: 0,
    policyLocations: [],
    payloadSize: 10441,
    gzippedPayloadSize: 2132,
    'error-message': '\n' +
      'Testing local/service...\n' +
      '\n' +
      'Authentication failed. Please check the API token on https://snyk.io',
    error: 'Error: \n' +
      'Testing local/service...\n' +
      '\n' +
      'Authentication failed. Please check the API token on https://snyk.io\n' +
      '    at test (/home/martin/.config/yarn/global/node_modules/snyk/src/cli/commands/test/index.ts:309:19)\n' +
      '    at runMicrotasks (<anonymous>)\n' +
      '    at processTicksAndRejections (internal/process/task_queues.js:97:5)',
    'error-code': 403,
    command: 'test'
  },
  version: '1.423.0',
  os: 'Linux 4.15',
  nodeVersion: 'v12.18.0',
  standalone: false,
  integrationName: '',
  integrationVersion: '',
  integrationEnvironment: '',
  integrationEnvironmentVersion: '',
  id: 'b8b15532560cafc69cd4d5e84cbec5864f4c34ea',
  ci: false,
  durationMs: 3690,
  metrics: {
    network_time: { type: 'timer', values: [Array], total: 227 },
    cpu_time: { type: 'synthetic', values: [Array], total: 3463 }
  }
} +0ms

  snyk Exit code: 2 +0ms
  snyk sending request to: https://snyk.io/api/v1/analytics/cli +271ms
  snyk request body size: 1183 +0ms
  snyk gzipped request body size: 648 +0ms
  snyk not using proxy +0ms

Screenshots

If applicable, add screenshots to help explain your problem.

[ernestojeda]

Hi @maprokes I am running into the same issue and found a workaround. The Dockerfile I am testing also has the same && rm -rf /var/cache/apk/* in a RUN command. I found if removed that rm command and the issue went away. You could try changing your RUN command to this:

RUN apk add --update --no-cache ca-certificates git && update-ca-certificates

[husseyd]

Hi @maprokes I am running into the same issue and found a workaround. The Dockerfile I am testing also has the same && rm -rf /var/cache/apk/* in a RUN command. I found if removed that rm command and the issue went away. You could try changing your RUN command to this:

RUN apk add --update --no-cache ca-certificates git && update-ca-certificates

Interesting, it's happening to me too in the same situation. Can't see why removing the apk cache causes this.

[husseyd]

This is not limited to only rm -rf /var/cache/apk/*, but some other changes to Alpine.

I've been hardening Docker images, removing apk and busybox - removing either of these prevents Snyk scans that specify the Dockerfile, but scans without specifying the Dockerfile are okay. Funnily the below works if I remove the last pwd in the RUN command..., which is where I actually need to run the above rm -rf command.

E.g. this is also incompatible with --file=...:

FROM alpine:latest
RUN apk add --update --no-cache openjdk11-jre-headless && \
    apk upgrade --no-cache && \
    addgroup -S MY_GROUP && adduser -S MY_USER -G MY_GROUP && \
    apk del --no-cache busybox && \
    ls
USER MY_USER
EXPOSE 8080
WORKDIR /app

This error occurs with all of the below:
synk test --docker <docker-image> --file=<path/to/Dockerfile>,
snyk container test <docker-image> --file=<path/to/Dockerfile>, and
docker scan <docker-image> --file=<path/to/Dockerfile>