Trivy: Cannot scan distroless images

[atbentley]

Description

Trivy cannot scan distroless docker images.

What did you expect to happen?

Trivy would be able to scan the distroless image for vulnerabilities

What happened instead?

Trivy failed with an unexpected error

Output of run with -debug:

trivy --debug gcr.io/distroless/java:11
2019-07-24T13:30:13.936+0200    DEBUG   cache dir:  /Users/andrew/Library/Caches/trivy
2019-07-24T13:30:13.936+0200    DEBUG   db path: /Users/andrew/Library/Caches/trivy/db/trivy.db
2019-07-24T13:30:13.939+0200    INFO    Updating vulnerability database...
2019-07-24T13:30:13.939+0200    DEBUG   git pull
2019-07-24T13:30:15.077+0200    DEBUG   total updated files: 1
2019-07-24T13:30:15.107+0200    DEBUG   Vulnerability type:  [os library]
2019-07-24T13:30:15.196+0200    DEBUG   OS family: debian, OS version: 9.9
2019-07-24T13:30:15.196+0200    FATAL   error in image scan:
    github.com/knqyf263/trivy/pkg.Run
        /root/project/pkg/run.go:166
  - failed to scan image:
    github.com/knqyf263/trivy/pkg/scanner.ScanImage
        /root/project/pkg/scanner/scan.go:54
  - failed to analyze OS packages:
    github.com/knqyf263/trivy/pkg/scanner/ospkg.Scan
        /root/project/pkg/scanner/ospkg/scan.go:51
  - Failed to analyze packages:
    github.com/knqyf263/fanal/analyzer.init.ializers
        /go/pkg/mod/github.com/knqyf263/[email protected]/analyzer/analyzer.go:27

Output of trivy -v:

trivy version 0.1.4

Additional details (base image name, container registry info...):

Google publishes "distroless" docker images that are very slim and only contain packages critical to your runtime. See https://github.com/GoogleContainerTools/distroless

These images don't contain much, but they do still contain glibc, openssl, libssl, etc.

I briefy tried the nodejs image and the java11 image, both failed for the same reason

[knqyf263]

Now, Trivy can scan distroless images 🎉 Thank you, @atbentley @tomoyamachi

[atbentley]

Thanks for the work @knqyf263 and @tomoyamachi! I can confirm it is working perfectly 🙂

[avthart]

Thanks! I was also expecting the same issue with using distroless.

[thabach]

I don't see it working on trivy version 0.1.6. On trying to scan Google's distroless base image gcr.io/distroless/base:latestI get

I must be doing something wrong, please advise.

[knqyf263]

v0.1.6 doesn't support distroless. You need to wait for v0.1.7.

[thabach]

... or can I build from source myself and see it work today 💯 ?

[knqyf263]

Exactly. I'm going to release a new version shortly.

[thabach]

Just built it locally on my Mac

and works like a charm - awesome work - very nice !