Docker - 无法拉取 fsLayers - Clair Scan 失败

Question

dbdr-publish:
    stage: publish
    extends: .rules
    image: registry.aws.site.mycompany.com:443/dx/containers/build-image:latest
    script:
      - >
        kaniko 
        --context $CI_PROJECT_DIR 
        --destination $CI_REGISTRY_IMAGE/dbdr:$DLA_TARGET 
        --dockerfile=$CI_PROJECT_DIR/Dockerfile-dbdr 
        --skip-unused-stages 
        --cache=false
        --cache-repo=""

Docker 文件

FROM docker.aws.site.mycompany.com:443/postgres:latest AS postgres

RUN psql --version && \
    pg_dump --version && \
    pg_restore --version

初始输出

psql (PostgreSQL) 17.0 (Debian 17.0-1.pgdg120+1)
pg_dump (PostgreSQL) 17.0 (Debian 17.0-1.pgdg120+1)
pg_restore (PostgreSQL) 17.0 (Debian 17.0-1.pgdg120+1)
INFO[0020] Taking snapshot of full filesystem...   
INFO[0021] No files were changed, appending empty layer to config. No layer added to image.

further logs...


INFO[0021] Pushing image to registry........
INFO[0021] Pushed image to 1 destinations               
Total time taken for building image: 22 secs , exit code: 0
scanning image registry...... using https://clair-current.aws.site.mycompany.com:443 ...
Started scan at: Tue Oct 29 10:37:27 UTC 2024
image to scan is: registry.... 3a95e5af
requesting whitelist from [https://clair-whitelist.aws.site.mycompany.com]
read whitelist from service: https://clair-whitelist.aws.site.mycompany.com
using whitelist file [/builds/klar/whitelist.yaml]
read whitelist from file: /builds/klar/whitelist.yaml
Can't pull fsLayers - ensure that the image's file system layers were written in Docker format by inspecting the manifest
         

主要错误

Can't pull fsLayers - ensure that the image's file system layers were written in Docker format by inspecting the manifest

其他版本也出现相同的错误，例如示例

postgres:16.1

Answer 1

尝试包含此标签：

--oci-layout=false

这将迫使 Kaniko 在 Docker 中创建兼容层。