Tag manifest is queued to be scanned

[sbenhai]

I'm trying to scan some image using Clair on my GCP machine, but every image I used got the same issue:
"The manifest for this tag is queued to be scanned for vulnerabilities" (link)

When I'm trying to use ClairCTL I get "502 Bad Gateway":

instance-2:~$ ./clairctl-linux-amd64 -D report ubuntu 2021-06-28T14:53:20Z DBG fetching ref=ubuntu 2021-06-28T14:53:20Z DBG using text output 2021-06-28T14:53:21Z DBG found manifest digest=sha256:376209074d481dca0a9cf4282710cd30a9e7ff402dea8261acdaaf57a18971dd ref=ubuntu 2021-06-28T14:53:21Z DBG method=GET path=/indexer/api/v1/index_report/sha256:376209074d481dca0a9cf4282710cd30a9e7ff402dea8261acdaaf57a18971dd status="502 Bad Gateway" 2021-06-28T14:53:21Z DBG index error error="unexpected return status: 502" ref=ubuntu 2021-06-28T14:53:21Z ERR error="unexpected return status: 502"

[crozzy]

I'm trying to scan some image using Clair on my GCP machine, but every image I used got the same issue:
"The manifest for this tag is queued to be scanned for vulnerabilities" (link)

It's a little hard to debug this without the logs from the quay container pertaining to it's communication with clair. You should check them to see if quay gives some more info.

When I'm trying to use ClairCTL I get "502 Bad Gateway":

instance-2:~$ ./clairctl-linux-amd64 -D report ubuntu 2021-06-28T14:53:20Z DBG fetching ref=ubuntu 2021-06-28T14:53:20Z DBG using text output 2021-06-28T14:53:21Z DBG found manifest digest=sha256:376209074d481dca0a9cf4282710cd30a9e7ff402dea8261acdaaf57a18971dd ref=ubuntu 2021-06-28T14:53:21Z DBG method=GET path=/indexer/api/v1/index_report/sha256:376209074d481dca0a9cf4282710cd30a9e7ff402dea8261acdaaf57a18971dd status="502 Bad Gateway" 2021-06-28T14:53:21Z DBG index error error="unexpected return status: 502" ref=ubuntu 2021-06-28T14:53:21Z ERR error="unexpected return status: 502"

For the report command clairctl is acting as a client to a running clair instance, hence you will need to specify a clair host (if it differs from the default http://localhost:6060/).

[hdonnay]

Also note that ubuntu is taken to mean docker.io/library/ubuntu:latest, which says very little about what's happening with quay-clair communication.