Merge pull request #74 from ANDDEV-OSS/dd/v4

Creation of Clair V4 databases

.github/workflows/docker-image.v4.yml

@@ -0,0 +1,100 @@
+name: Docker Image v4 CI
+
+on:
+  push:
+    branches: [master]
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      POSTGRES_IMAGE: "postgres:16-alpine"
+      CLAIR_VERSION: "4.7.4"
+      CLAIR_LOCAL_SCAN_IMAGE: "arminc/clair-local-scan-v4"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Runner diskspace workaround
+        run: |
+          # Symlink docker image and containers folders to /mnt (GitHub Action space limitation work around)
+          docker system prune -a -f
+          sudo systemctl stop docker
+          sudo mv /var/lib/docker /mnt/docker
+
+          json_content='{ 
+            "exec-opts": ["native.cgroupdriver=cgroupfs"],
+            "cgroup-parent": "/actions_job",
+            "data-root": "/mnt/docker"
+          }'
+
+          echo "$json_content" > /tmp/daemon.json
+          sudo mv /tmp/daemon.json /etc/docker/daemon.json
+          sudo rm -fr /var/lib/docker
+          sudo systemctl start docker
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+          install: true
+
+      - name: Build image
+        run: docker build -t $CLAIR_LOCAL_SCAN_IMAGE --build-arg VERSION=$CLAIR_VERSION clair/v4
+
+      - name: Start Postgres and run clair
+        run: |
+          docker pull $POSTGRES_IMAGE
+          docker run -d --name postgres -e 'PGDATA=/var/lib/postgresql/clair' -e POSTGRES_PASSWORD=password $POSTGRES_IMAGE
+      - name: Wait for database
+        run: |
+          sleep 30
+      - name: Docker Postgres info
+        run: |
+          docker ps -a
+          docker logs postgres
+      - name: Run Clair
+        run: |
+          docker run --rm -d --link postgres:postgres -e PGPASSWORD=password $POSTGRES_IMAGE pg_isready -U postgres -h postgres
+          docker run -d --name clair --link postgres:postgres $CLAIR_LOCAL_SCAN_IMAGE
+      - name: Wait for clair
+        run: |
+          sleep 10
+      - name: Docker Postgres info
+        run: |
+          docker ps -a
+          docker logs postgres
+      - name: Docker Clair info
+        run: |
+          docker ps -a
+          docker logs clair
+      - name: Checking
+        run: |
+          ./clair/v4/check.sh
+      - name: Docker logs
+        run: |
+          docker logs clair
+      - name: Tag images
+        run: |
+          docker stop clair
+          docker stop postgres
+          docker commit postgres arminc/clair-db-v4:$(date +%Y-%m-%d)
+          docker tag arminc/clair-db-v4:$(date +%Y-%m-%d) arminc/clair-db-v4:latest
+          docker tag $CLAIR_LOCAL_SCAN_IMAGE ${CLAIR_LOCAL_SCAN_IMAGE}:${CLAIR_VERSION}_${GITHUB_SHA}
+          docker images
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Push images
+        run: |
+          docker push ${CLAIR_LOCAL_SCAN_IMAGE}:${CLAIR_VERSION}_${GITHUB_SHA}
+          docker push $CLAIR_LOCAL_SCAN_IMAGE:latest
+          docker push arminc/clair-db-v4:$(date +%Y-%m-%d)
+          docker push arminc/clair-db-v4:latest

clair/v4/Dockerfile

@@ -0,0 +1,10 @@
+ARG  VERSION=4.7.4
+
+FROM quay.io/projectquay/clair:${VERSION} as src
+
+COPY config.yaml /config/config.yaml
+
+# Copied from the original image
+EXPOSE 8080 8081
+ENTRYPOINT ["/bin/clair"]
+CMD ["-mode", "combo", "-conf", "/config/config.yaml"]

clair/v4/check.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -ex
+
+CONTAINER="${1:-clair}"
+COUNTER=1
+MAX=360
+
+while true; do
+    if docker logs "${CONTAINER}" 2>&1 | grep "starting background updates" >&/dev/null
+    then
+        break
+    fi
+
+    if docker logs "${CONTAINER}" 2>&1 | grep "ERROR" >&/dev/null
+    then
+        docker logs -n 25 "${CONTAINER}"
+        echo "Error during update." >&2
+        exit 1
+    fi
+
+    docker logs -n 1 "${CONTAINER}"
+    sleep 10
+    ((COUNTER++))
+
+    if [ "${COUNTER}" -eq "${MAX}" ]; then
+        echo "Took to long"
+        exit 1
+    fi
+done
+echo ""

clair/v4/config.yaml

@@ -0,0 +1,32 @@
+# Copyright 2015 clair authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+introspection_addr: ":8081"
+http_listen_addr: ":8080"
+log_level: debug
+indexer:
+  connstring: host=postgres port=5432 user=postgres password=password sslmode=disable statement_timeout=60000
+  scanlock_retry: 10
+  layer_scan_concurrency: 5
+  migrations: true
+matcher:
+  connstring: host=postgres port=5432 user=postgres password=password sslmode=disable statement_timeout=60000
+  max_conn_pool: 100
+  migrations: true
+matchers: {}
+notifier:
+  connstring: host=postgres port=5432 user=postgres password=password sslmode=disable statement_timeout=60000
+  migrations: true
+  delivery_interval: 1m
+  poll_interval: 5m