How to install locally and why do I get a strange answer ?

[ipaqsa]

I build from source code (clair and clairctl), and run Postergesql and then run clair. I give him the config from local-dev/clair/config (but replace all the URLs with localhost) and I run clairctl with the same config, and two questions arise:

1. How to run the output of repotr to some GUI and
2. Why when scanning some images, for example alt, I get "alt ok" in response , does this mean the image is really clean ? or I don't understand the structure of the project...

[ipaqsa]

Also, in docker-compose, nothing starts except trafika, I mean clairctl works, but the gui does not open

[hdonnay]

There is no GUI.

[ipaqsa]

Thanks, i got it, grafana only for visualisation metrics Prometheus; a result is stored in postegrsql in matcher

[ipaqsa]

My final task is to make a package for ALT linux and teach clair to check our images

[hdonnay]

There's some documentation on how to implement distribution support here. The main hurdle is going to be an advisory database for ALT; even some large distributions like CentOS don't have this.

[hdonnay]

1. We do not ship a GUI.
2. Clairctl reporting "ok" means Clair did not find anything it knows about.

You can look at the JSON output to see what Clair found in the image. From your other comments it sounds like you're using a distro without vulnerability information, which predictably means Clair didn't find anything.

[ipaqsa]

Thank you for your answer, I am getting an image from docker hub, and if I understood correctly, the problems are simply that clair does not find vulnerabilities in the image? It turns out that our image does not contain any same ubuntu vulnerability?

[hdonnay]

It would need to be an Ubuntu image to have Ubuntu vulnerabilities. Just like one wouldn't expect Red Hat vulnerabilities to apply to Alpine.

[ipaqsa]

Thanks, It was really logical 😂

I got answers for all the questions, thank you!