Scanning image from ECR is not working

[milosara78]

Description

I have pulled the image from ECR and tried to run the scan on the same but it gives error message as below . But the same time if i try pull an image from docker hub and scan it , that completely works fine . Here i know there is a documentation to use kube manifest for secrets to be used but in the case of pulling and scanning for stand alone operation like mine is not working. Can you help here

2024-02-01T10:14:57.986Z        FATAL   image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: 4 errors occurred:
        * docker error: unable to inspect the image (xxxx.dkr.ecr.us-east-1.amazonaws.com/xxx:latest): permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/images/xxxx.dkr.ecr.us-east-1.amazonaws.com/xxx:latest/json": dial unix /var/run/docker.sock: connect: permission denied
        * containerd error: failed to initialize a containerd client: failed to dial "/run/containerd/containerd.sock": connection error: desc = "transport: error while dialing: dial unix /run/containerd/containerd.sock: connect: permission denied"
        * podman error: unable to initialize Podman client: no podman socket found: stat /run/user/1000/snap.trivy/podman/podman.sock: no such file or directory
        * remote error: GET https://xxxxx.dkr.ecr.us-east-1.amazonaws.com/v2/xxxxx/manifests/latest: unexpected status code 401 Unauthorized: Not Authorized

Desired Behavior

Scan results should be available

Actual Behavior

Throws error

Reproduction Steps

1.docker pull istio/distroless:latest
2. trivy image istio/distroless:latest
3. aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin xxxxxxx.dkr.ecr.us-east-1.amazonaws.com
4. docker pull xxxx.dkr.ecr.us-east-1.amazonaws.com/xxx:latest
5.trivy image xxxx.dkr.ecr.us-east-1.amazonaws.com/xxx:latest
...

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

None

Debug Output

2024-02-01T10:11:41.916Z        FATAL   image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:425
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:269
  - unable to initialize a scanner:
    github.com/aquasecurity/trivy/pkg/commands/artifact.scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:700
  - unable to initialize an image scanner:
    github.com/aquasecurity/trivy/pkg/commands/artifact.imageStandaloneScanner
        /home/runner/work/trivy/trivy/pkg/commands/artifact/scanner.go:18

### Operating System

Ubuntu

### Version

```bash
trivy --version
Version: 0.48.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-02-01 06:14:12.062920223 +0000 UTC
  NextUpdate: 2024-02-01 12:14:12.062919402 +0000 UTC
  DownloadedAt: 2024-02-01 09:21:25.144043046 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[DmitriyLewen]

Hello @saravanan-ai
Thanks for your report!

Have you tried using Trivy Credential?
Do you use default path to docker config file?

Regards, Dmitriy

[milosara78]

I had used AWS ECR login ,that adds the token in docker config.json
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin xxxxxxx.dkr.ecr.us-east-
and then i used the image scan with trivy image xxxx.dkr.ecr.us-east-1.amazonaws.com/xxx:latest

as similar to
$ docker login ghcr.io
Username:
Password:
$ trivy image ghcr.io/your/private_image

[DmitriyLewen]

Okay, thanks for answer.

dial unix /var/run/docker.sock: connect: permission denied

It looks like there is permissions problem with docker.sock file.
Can you try running Trivy with sudo (just as an experiment)?