Unable to scan docker image using docker distribution

[jakub-bochenski]

$ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock ghcr.io/cyclonedx/cdxgen --type docker tykio/tyk-gateway:v5.8
Ensure docker/podman service or Docker for Desktop is running.
Check if the post-installation steps were performed correctly as per this documentation https://docs.docker.com/engine/install/linux-postinstall/
Ensure docker/podman service or Docker for Desktop is running.
Check if the post-installation steps were performed correctly as per this documentation https://docs.docker.com/engine/install/linux-postinstall/
Unable to pull tykio/tyk-gateway:v5.8. Check if the name is valid. Perform any authentication prior to invoking cdxgen.
Try manually pulling this image using docker pull tykio/tyk-gateway:v5.8
OCI BOM generation has failed due to problems with exporting the image tykio/tyk-gateway:v5.8.

[prabhu]

Appears like a devops question. Maybe it needs env variable such as DOCKER_HOST, DOCKER_CMD and so on?

[jakub-bochenski]

I don't understand what you mean.
/var/run/docker.sock is the default DOCKER_HOST as per https://docs.docker.com/reference/cli/dockerd/#daemon-socket-option
There is no DOCKER_CMD variable documented for Docker.

Anyhow adding -e DOCKER_HOST=/var/run/docker.sock does not help

[prabhu]

Must be because the cdxgen image is running as a non-root user. Perhaps try some other image from this list. You don't need docker really. Just download a fully self-contained single executable application for your OS from here. Example: https://github.com/CycloneDX/cdxgen/releases/download/v11.7.0/cdxgen-linux-amd64

[jakub-bochenski]

I tried docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -u0:0 ghcr.io/cyclonedx/cdxgen --type docker tykio/tyk-gateway:v5.8
Now I get empty output -- nothing is printed

[prabhu]

cdxgen is silent by default (lots of historical context, so it needs the person to be involved with the community and not merely be a visitor). It needs -e CDXGEN_DEBUG_MODE=debug. Then, depending on the images, a few more environment variables are needed for correct extraction, etc. Even after doing this, it still may not work because of container limitations, which is completely unrelated to the cdxgen project or anything we do.

[taleodor]

One way we are using to scan docker images is saving them as tarballs first (via docker save -o image.tar image). Then you can mount them into cdxgen docker image which works.

[jakub-bochenski]

thanks, I know docker images are basically tarballs with metadata, but I was looking for a direct way to scan an image with containerized cdxgen