Skip to content

Container scanning does not support public docker registries

Summary

Container scanning does not support public docker registries like the ones available through docker.io.

Steps to reproduce

  1. Create a project with a .gitlab-ci.yml
  2. Add the following content to the file above:
include:
  - template: Security/Container-Scanning.gitlab-ci.yml
variables:
  DOCKER_IMAGE: python:3.4-alpine
  1. Run the pipeline and check the content of the container_scanning job.

Example Project

This pipeline can be used as an example.

What is the current bug behavior?

After the job has ended with failure the log will show:

GET https://auth.docker.io/token?scope=repository%3Alibrary%2Fpython%3Apull&service=registry.docker.io: unsupported status code 401; body: {"details":"incorrect username or password"}

What is the expected correct behavior?

The container scanner should be able to access the image and run the analyzer similar to the following:

[INFO] [2021-07-28 18:43:52 +0000] []  ▶  Scanning container python:3.4-alpine for vulnerabilities with severity level UNKNOWN or higher, with gcs 4.3.5 and Trivy Version: 0.19.2, advisories updated at 2021-07-28

Relevant logs and/or screenshots

Raw logs can be found here

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info 

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check 
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)


(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)


(we will only investigate if the tests are passing)

Possible fixes

Only use CI_REGISTRY_USER / CI_REGISTRY_PASSWORD by default if image.domain == env['CI_REGISTRY'], and otherwise use anonymous auth.

Edited by Thiago Figueiró