microsoft / microsoft/component-detection

Component detection does not scan Linux file system if the image is not a docker image.

Open
#691 3 comments 0 reactions 0 assignees View on GitHub
detector:linux status:requirements type:feature
Dominant language
C#
Stars
553
Forks
135
Avg merge
20h 58m
Merged PRs (30d)
6

Description

Hello,

We were trying to create SBOM for our production image using [sbom-tool](https://github.com/microsoft/sbom-tool/blob/72f937bfb9dcb3fe43e2d13e4744e0c7975dad9b/docs/sbom-tool-arguments.md?plain=1#L61) but it seems we have hit a blocker.

Our image is not created using docker, its a VM image created using packer.

SBOM tool uses component-detection tool to get the dependencies and for Linux it seems only way is passing docker image to the tool.

We tried running to component-detection tool directly on the VM from which we create the image but it does not capture any Linux packages installed on the image.

Linux scanner logs "No instructions received to scan docker images." and then returns.

[syft tool](https://github.com/anchore/syft#supported-sources) does support scanning of a file system which is what component-detection tool uses for Linux scanner.

What is the workaround to detect Linux packages from the filesystem? We are blocked on this currently and unable to meet our SBOM requirement.

AB#2088307

Contributor guide

Open the contributing guide

Research direction

Start with the Linux scanner path described in the report and the linked sbom-tool arguments documentation. Reproduce the behavior outside a Docker image, then trace the "No instructions received to scan docker images" result. Done means Linux packages are detected from the filesystem of a VM image or the supported limitation is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, docker
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.