Fails if runners are on arm64 (?)
- Dominant language
- JavaScript
- Stars
- 287
- Forks
- 95
- Avg merge
- 13h 23m
- Merged PRs (30d)
- 13
Description
Hi,
Using the scan-action against a private ECR, it worked fine while we were producing AMD64 images, but now that we produce buildx arm64 images (index + arm64 image only), it fails. Below an extract from the action log.
Also, our runners are self-hosted, and also run on arm64.
```
Downloading grype v0.97.1 via https://raw.githubusercontent.com/anchore/grype/main/install.sh
sh /home/runner/work/_temp/3e39c01b-3a7e-48ba-879d-76168fc72e48 -d -b /tmp/grype-download-Us0ma7 v0.97.1
[info] checking github for release tag='v0.97.1'
[debug] http_download(url=https://github.com/anchore/grype/releases/v0.97.1)
[info] fetching release script for tag='v0.97.1'
[debug] http_download(url=https://get.anchore.io/grype/v0.97.1/install.sh)
[info] checking github for release tag='v0.97.1'
[debug] http_download(url=https://github.com/anchore/grype/releases/v0.97.1)
[info] using release tag='v0.97.1' version='0.97.1' os='linux' arch='amd64'
[debug] downloading files into /tmp/tmp.xaCkqPySYX
[debug] http_download(url=https://github.com/anchore/grype/releases/download/v0.97.1/grype_0.97.1_checksums.txt)
[debug] http_download(url=https://github.com/anchore/grype/releases/download/v0.97.1/grype_0.97.1_linux_amd64.tar.gz)
[info] installed /tmp/grype-download-Us0ma7/grype
/opt/hostedtoolcache/grype/0.97.1/x64/grype -v -o table --file /home/runner/work/Shift/Shift/grype-results-shift/connector-bloomberg-backend.out --fail-on medium 123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c
[0000] INFO grype version: 0.97.1
[0000] INFO docker pulling image image=123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c
[0000] INFO downloading new vulnerability DB
[0002] INFO gathered packages packages=0 time=2.890892375s
[0007] INFO downloaded vulnerability DB time=7.912473676s url=https://grype.anchore.io/databases/v6/vulnerability-db_v6.0.3_2025-08-12T01:31:01Z_1754972022.tar.zst?checksum=sha256%3A08ec6965228cd1cfdcf8fe06b477d0d6a003e0885498bc69b792c649716df402
[0024] INFO installed new vulnerability DB built=2025-08-12T04:13:42Z version=v6.0.3
[0024] INFO loaded DB status=valid time=24.868855915s
[0024] ERROR failed to catalog: errors occurred attempting to resolve '123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c':
- snap: snap file "123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c" does not exist
- docker: no matching manifest for linux/amd64 in the manifest list entries
- podman: podman not available: no host address
- containerd: containerd not available: failed to dial "/run/containerd/containerd.sock": connection error: desc = "transport: error while dialing: dial unix /run/containerd/containerd.sock: connect: permission denied"
- oci-registry: failed to get image from registry: no child with platform linux/amd64 in index 123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c
- snap: no snap found with name '123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c'
- additionally, the following providers failed with file does not exist: docker-archive, oci-archive, oci-dir, singularity, oci-dir, local-file, local-directory
```
Thank you.
Contributor guide
Research direction
No source file or test is named. Start by tracing the action's Grype installation and invocation shown in the log, then inspect how the requested linux/amd64 platform is selected for the ECR image; done means the action can catalog the arm64-only image on the reported arm64 runner.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker, github-actions
- Domain
- ci-cd, cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100