failed to detect vulnerabilities: failed to scan application libraries: failed vulnerability detection of libraries: failed to initialize a driver: unsupported type bitnami

[itsmednkv]

Question

Hello,

actualy i use trivy in version0.49.1

if i scan a bitnami image there is already an error:

"failed to detect vulnerabilities: failed to scan application libraries: failed vulnerability detection of libraries: failed to initialize a driver: unsupported type bitnami"

i thought i had read that there was already a solution for this. Was I wrong or did I just overlook the solution?

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

Client/Server

Operating System

No response

Version

ghcr.io/aquasecurity/trivy:0.49.1

[DmitriyLewen]

Hello @itsmednkv
There appears to be a problem with your image.
We currently have no errors with this text (same issue for old version of Trivy - #4566).

I tried the last image:

➜  ~ docker run -it --rm ghcr.io/aquasecurity/trivy:0.49.1 -d image docker.io/bitnami/rabbitmq:3.11.17-debian-11-r2 
...

docker.io/bitnami/rabbitmq:3.11.17-debian-11-r2 (debian 11.7)

Total: 210 (UNKNOWN: 0, LOW: 109, MEDIUM: 51, HIGH: 44, CRITICAL: 6)

Trivy works correctly.

Can you run docker run -it --rm ghcr.io/aquasecurity/trivy:0.49.1 --version command?

Regards, Dmitriy

[itsmednkv]

trivy-operator:
Image: ghcr.io/aquasecurity/trivy-operator:0.19.1
trivy:
Image: ghcr.io/aquasecurity/trivy:0.49.1

here are the informations of our systems.

This here say the trivy on scan:

2024-03-22T06:32:09.633Z FATAL image scan error: scan error: scan failed: scan failed: failed to detect vulnerabilities via RPC: twirp error internal: failed scan, docker.io/bitnami/redis:7.2.4-debian-11-r4: failed to detect vulnerabilities: failed to scan application libraries: failed vulnerability detection of libraries: failed to initialize a driver: unsupported type bitnami

and the following say the operator:

goroutine 662 [select]: runtime.gopark(0xc001dfe6a0?, 0x4?, 0x40?, 0x7d?, 0xc001dfe610?) /opt/hostedtoolcache/go/1.21.8/x64/src/runtime/proc.go:398 +0xce fp=0xc000ed5c98 sp=0xc000ed5c78 pc=0x43f02e runtime.selectgo(0xc000ed5ea0, 0xc001dfe608, 0x100000000000004?, 0x0, 0xc002ce3a40?, 0x1) /opt/hostedtoolcache/go/1.21.8/x64/src/runtime/select.go:327 +0x725 fp=0xc000ed5db8 sp=0xc000ed5c98 pc=0x44f4a5 k8s.io/client-go/util/workqueue.(*delayingType).waitingLoop(0xc002d09860) /home/runner/go/pkg/mod/k8s.io/client-go@v0.29.3/util/workqueue/delaying_queue.go:276 +0x305 fp=0xc000ed5fc8 sp=0xc000ed5db8 pc=0x127f625 k8s.io/client-go/util/workqueue.newDelayingQueue.func1() /home/runner/go/pkg/mod/k8s.io/client-go@v0.29.3/util/workqueue/delaying_queue.go:113 +0x25 fp=0xc000ed5fe0 sp=0xc000ed5fc8 pc=0x127ecc5 runtime.goexit() /opt/hostedtoolcache/go/1.21.8/x64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc000ed5fe8 sp=0xc000ed5fe0 pc=0x4726e1 created by k8s.io/client-go/util/workqueue.newDelayingQueue in goroutine 399 /home/runner/go/pkg/mod/k8s.io/client-go@v0.29.3/util/workqueue/delaying_queue.go:113 +0x21f

[DmitriyLewen]

We removed this error in v0.42.1 (see #4577).

So you can't see this error for ghcr.io/aquasecurity/trivy:0.49.1.

Can you please open new discusson in https://github.com/aquasecurity/trivy-operator/discussions?
It seems like some kind of trivy-operator setting uses old Trivy version.

[chen-keinan]

@DmitriyLewen the env used by @itsmednkv is trivy-operator v0.21.2 which use trivy v0.50.1.

after reviewing the config its look like issue between trivy client and trivy server communications

[DmitriyLewen]

@chen-keinan Thanks for this investigation!

Now I think I know the reason:
@itsmednkv Did you update your server Trivy?

Trivy uses Client part to detect packages, but Trivy checks drivers in Server part.

[itsmednkv]

Thank you. This did it.