anchore / anchore/scan-action

Fails if runners are on arm64 (?)

Open
#503 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
287
Forks
95
Avg merge
13h 23m
Merged PRs (30d)
13

Description

Hi,

Using the scan-action against a private ECR, it worked fine while we were producing AMD64 images, but now that we produce buildx arm64 images (index + arm64 image only), it fails. Below an extract from the action log.

Also, our runners are self-hosted, and also run on arm64.

```
Downloading grype v0.97.1 via https://raw.githubusercontent.com/anchore/grype/main/install.sh
sh /home/runner/work/_temp/3e39c01b-3a7e-48ba-879d-76168fc72e48 -d -b /tmp/grype-download-Us0ma7 v0.97.1
[info] checking github for release tag='v0.97.1'

[debug] http_download(url=https://github.com/anchore/grype/releases/v0.97.1)

[info] fetching release script for tag='v0.97.1'

[debug] http_download(url=https://get.anchore.io/grype/v0.97.1/install.sh)

[info] checking github for release tag='v0.97.1'

[debug] http_download(url=https://github.com/anchore/grype/releases/v0.97.1)

[info] using release tag='v0.97.1' version='0.97.1' os='linux' arch='amd64'

[debug] downloading files into /tmp/tmp.xaCkqPySYX

[debug] http_download(url=https://github.com/anchore/grype/releases/download/v0.97.1/grype_0.97.1_checksums.txt)

[debug] http_download(url=https://github.com/anchore/grype/releases/download/v0.97.1/grype_0.97.1_linux_amd64.tar.gz)

[info] installed /tmp/grype-download-Us0ma7/grype

/opt/hostedtoolcache/grype/0.97.1/x64/grype -v -o table --file /home/runner/work/Shift/Shift/grype-results-shift/connector-bloomberg-backend.out --fail-on medium 123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c
[0000] INFO grype version: 0.97.1

[0000] INFO docker pulling image image=123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c

[0000] INFO downloading new vulnerability DB

[0002] INFO gathered packages packages=0 time=2.890892375s

[0007] INFO downloaded vulnerability DB time=7.912473676s url=https://grype.anchore.io/databases/v6/vulnerability-db_v6.0.3_2025-08-12T01:31:01Z_1754972022.tar.zst?checksum=sha256%3A08ec6965228cd1cfdcf8fe06b477d0d6a003e0885498bc69b792c649716df402

[0024] INFO installed new vulnerability DB built=2025-08-12T04:13:42Z version=v6.0.3

[0024] INFO loaded DB status=valid time=24.868855915s

[0024] ERROR failed to catalog: errors occurred attempting to resolve '123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c':
- snap: snap file "123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c" does not exist
- docker: no matching manifest for linux/amd64 in the manifest list entries
- podman: podman not available: no host address
- containerd: containerd not available: failed to dial "/run/containerd/containerd.sock": connection error: desc = "transport: error while dialing: dial unix /run/containerd/containerd.sock: connect: permission denied"
- oci-registry: failed to get image from registry: no child with platform linux/amd64 in index 123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c
- snap: no snap found with name '123456789012.dkr.ecr.eu-central-2.amazonaws.com/shift/connector-bloomberg-backend:axxxxxxc-feat-dependabot-pip-docker-db--d187-9340629e46e8ece39c7d1e5f6c62255d23126d5c'
- additionally, the following providers failed with file does not exist: docker-archive, oci-archive, oci-dir, singularity, oci-dir, local-file, local-directory
```

Thank you.

Contributor guide

Open the contributing guide

Research direction

No source file or test is named. Start by tracing the action's Grype installation and invocation shown in the log, then inspect how the requested linux/amd64 platform is selected for the ECR image; done means the action can catalog the arm64-only image on the reported arm64 runner.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker, github-actions
Domain
ci-cd, cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.