Running CVE scans with multiple instances of docker scout CLI simultaneously results in cache errors in v1.19.0
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Description
When running cve scans for images' archives with multiple instances of docker scout CLI v1.19.0 in the same time, some runs fail with the following error:
ERROR failed to index image: failed to initialize cache: cache may be in use by another process: timeout
This happen even when using different cache dirs for different processes (cache isolation issue?)
NOTE: This error does not happen when using docker scout CLI v1.18.4
Script to reproduce:
#!/usr/bin/env bash
# Provide path to docker scout binary as the first argument for this script
docker_scout=$1
# Create a temporary Docker config just for this test and put the plugin there.
# This is just to simply test arbitrary versions of Docker Scout without affecting actual installation
DOCKER_CONFIG="$(mktemp -d)"
trap 'rm -rf "$DOCKER_CONFIG"' EXIT
export DOCKER_CONFIG
# Copy the user's docker config as well for login details.
cp $HOME/.docker/config.json $DOCKER_CONFIG/config.json
mkdir -p "$DOCKER_CONFIG/cli-plugins"
cp "$docker_scout" "$DOCKER_CONFIG/cli-plugins/docker-scout"
chmod +x "$DOCKER_CONFIG/cli-plugins/docker-scout"
# Some popular images from Dockerhub as an example
docker pull traefik:latest
docker pull postgres:latest
docker save traefik > traefik.tar
docker save postgres > postgres.tar
docker scout version
# We are running scans for the same images in a loop here, but the error also occurs when running scans for different images every time
for try in {1..5} ; do
cache1="$(mktemp -d)/scout_cache"
echo "Using cache $cache1"
DOCKER_SCOUT_CACHE_DIR="$cache1" docker scout cves --only-severity "critical" --exit-code --locations archive://traefik.tar &
cache2="$(mktemp -d)/scout_cache"
echo "Using cache $cache2"
DOCKER_SCOUT_CACHE_DIR="$cache2" docker scout cves --only-severity "critical" --exit-code --locations archive://postgres.tar &
done
wait
rm traefik.tar postgres.tar
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the provided Bash reproduction and the docker scout cves entry point, comparing concurrent scans in v1.19.0 with v1.18.4. Investigate how DOCKER_SCOUT_CACHE_DIR is handled during archive indexing; done means concurrent scans succeed without cache timeout errors, including when each process uses a separate cache directory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100