Confusing error when scanning invalid image

[AXDOOMER]

Description

When scanning an invalid image, Trivy will output many errors which makes things more confusing that they should.

Example:

trivy image almfe-qkkkkaiw/fijewoew:19.3
2023-11-14T17:14:21.485-0500    INFO    Vulnerability scanning is enabled
2023-11-14T17:14:21.485-0500    INFO    Secret scanning is enabled
2023-11-14T17:14:21.485-0500    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-11-14T17:14:21.485-0500    INFO    Please see also https://aquasecurity.github.io/trivy/v0.45/docs/scanner/secret/#recommendation for faster secret detection
2023-11-14T17:14:21.735-0500    FATAL   image scan error: scan error: unable to initialize a scanner: unable to initialize a docker scanner: 4 errors occurred:
        * unable to inspect the image (almfe-qkkkkaiw/fijewoew:19.3): Error response from daemon: No such image: almfe-qkkkkaiw/fijewoew:19.3
        * failed to initialize a containerd client: failed to dial "/run/containerd/containerd.sock": connection error: desc = "transport: error while dialing: dial unix /run/containerd/containerd.sock: connect: permission denied"
        * unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
        * GET https://index.docker.io/v2/almfe-qkkkkaiw/fijewoew/manifests/19.3: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:almfe-qkkkkaiw/fijewoew Type:repository]]

Trivy seems to blame the container runtime, but there is no issue with it as running trivy image debian:12 will be successful.

Desired Behavior

Trivy should indicate that it's unable to scan the image and state why (e.g. image not found, image name invalid, etc.)

Actual Behavior

image scan error: scan error: unable to initialize a scanner: unable to initialize a docker scanner: 4 errors occurred:
* unable to inspect the image (almfe-qkkkkaiw/fijewoew:19.3): Error response from daemon: No such image: almfe-qkkkkaiw/fijewoew:19.3
* failed to initialize a containerd client: failed to dial "/run/containerd/containerd.sock": connection error: desc = "transport: error while dialing: dial unix /run/containerd/containerd.sock: connect: permission denied"
* unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
* GET https://index.docker.io/v2/almfe-qkkkkaiw/fijewoew/manifests/19.3: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:almfe-qkkkkaiw/fijewoew Type:repository]]

Reproduction Steps

Run `trivy image almfe-qkkkkaiw/fijewoew:19.3`

Target

Container Image

Scanner

None

Output Format

None

Mode

None

Debug Output

2023-11-14T17:26:11.616-0500    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-11-14T17:26:11.617-0500    DEBUG   Ignore statuses {"statuses": null}
2023-11-14T17:26:11.620-0500    DEBUG   cache dir:  /home/ax/.cache/trivy
2023-11-14T17:26:11.620-0500    DEBUG   DB update was skipped because the local DB is the latest
2023-11-14T17:26:11.620-0500    DEBUG   DB Schema: 2, UpdatedAt: 2023-11-14 18:12:29.342695082 +0000 UTC, NextUpdate: 2023-11-15 00:12:29.342694791 +0000 UTC, DownloadedAt: 2023-11-14 22:01:23.190887833 +0000 UTC
2023-11-14T17:26:11.620-0500    INFO    Vulnerability scanning is enabled
2023-11-14T17:26:11.620-0500    DEBUG   Vulnerability type:  [os library]
2023-11-14T17:26:11.620-0500    INFO    Secret scanning is enabled
2023-11-14T17:26:11.620-0500    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-11-14T17:26:11.620-0500    INFO    Please see also https://aquasecurity.github.io/trivy/v0.45/docs/scanner/secret/#recommendation for faster secret detection
2023-11-14T17:26:11.935-0500    FATAL   image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:424
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:268
  - unable to initialize a scanner:
    github.com/aquasecurity/trivy/pkg/commands/artifact.scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:679
  - unable to initialize a docker scanner:
    github.com/aquasecurity/trivy/pkg/commands/artifact.imageStandaloneScanner
        /home/runner/work/trivy/trivy/pkg/commands/artifact/scanner.go:17
  - 4 errors occurred:
        * unable to inspect the image (almfe-qkkkkaiw/fijewoew:19.3): Error response from daemon: No such image: almfe-qkkkkaiw/fijewoew:19.3
        * failed to initialize a containerd client: failed to dial "/run/containerd/containerd.sock": connection error: desc = "transport: error while dialing: dial unix /run/containerd/containerd.sock: connect: permission denied"
        * unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
        * GET https://index.docker.io/v2/almfe-qkkkkaiw/fijewoew/manifests/19.3: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:almfe-qkkkkaiw/fijewoew Type:repository]]

Operating System

Linux

Version

0.45

Checklist

• Run trivy image --reset
• Read the troubleshooting

[knqyf263]

• unable to inspect the image (almfe-qkkkkaiw/fijewoew:19.3): Error response from daemon: No such image: almfe-qkkkkaiw/fijewoew:19.3

Actually, the error says "no such image". I think it is clear enough to understand why it's failing, but I suppose your point is that Trivy shows 4 error messages and it's confusing.

Trivy supports several image sources and doesn't know from which source the user wants to fetch the image. That's why it shows several errors from Docker, contained, Podman, and container registries. If you pass --image-src docker, the error can be clearer as the single error is shown.

If you have any ideas to improve that, we'd like to hear that.

[AXDOOMER]

Could it say from which daemon it got the error "Error response from daemon"?

On my installation of WSL, I often get socket errors, so it made sense to me that connection error: desc = "transport: error while dialing: dial unix /run/containerd/containerd.sock: connect: permission denied was the error and it made sense to me that the program could interpret that as an error response from the daemon.

Without knowing the inner workings of Trivy, I can't know if these are meant to be different error messages or are similar to a stack trace.

Note that the debug output doesn't help clarify what's happening when you don't know that Trivy is trying to connect to different docker engines.

[knqyf263]

Created #5600