docker / docker/scout-cli

Running CVE scans with multiple instances of docker scout CLI simultaneously results in cache errors in v1.19.0

Open
#210 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
454
Forks
134
PR merge metrics
No merged PRs in 30d

Description

When running cve scans for images' archives with multiple instances of docker scout CLI v1.19.0 in the same time, some runs fail with the following error:

ERROR   failed to index image: failed to initialize cache: cache may be in use by another process: timeout

This happen even when using different cache dirs for different processes (cache isolation issue?)

NOTE: This error does not happen when using docker scout CLI v1.18.4

Script to reproduce:

#!/usr/bin/env bash

# Provide path to docker scout binary as the first argument for this script
docker_scout=$1

# Create a temporary Docker config just for this test and put the plugin there.
# This is just to simply test arbitrary versions of Docker Scout without affecting actual installation
DOCKER_CONFIG="$(mktemp -d)"
trap 'rm -rf "$DOCKER_CONFIG"' EXIT
export DOCKER_CONFIG
# Copy the user's docker config as well for login details.
cp $HOME/.docker/config.json $DOCKER_CONFIG/config.json
mkdir -p "$DOCKER_CONFIG/cli-plugins"
cp "$docker_scout" "$DOCKER_CONFIG/cli-plugins/docker-scout"
chmod +x "$DOCKER_CONFIG/cli-plugins/docker-scout"

# Some popular images from Dockerhub as an example
docker pull traefik:latest
docker pull postgres:latest
docker save traefik > traefik.tar
docker save postgres > postgres.tar

docker scout version

# We are running scans for the same images in a loop here, but the error also occurs when running scans for different images every time
for try in {1..5} ; do
  cache1="$(mktemp -d)/scout_cache"
  echo "Using cache $cache1"
  DOCKER_SCOUT_CACHE_DIR="$cache1" docker scout cves --only-severity "critical" --exit-code --locations archive://traefik.tar &
  
  cache2="$(mktemp -d)/scout_cache"
  echo "Using cache $cache2"
  DOCKER_SCOUT_CACHE_DIR="$cache2" docker scout cves --only-severity "critical" --exit-code --locations archive://postgres.tar &
done
wait
rm traefik.tar postgres.tar

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided Bash reproduction and the docker scout cves entry point, comparing concurrent scans in v1.19.0 with v1.18.4. Investigate how DOCKER_SCOUT_CACHE_DIR is handled during archive indexing; done means concurrent scans succeed without cache timeout errors, including when each process uses a separate cache directory.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.