我正在尝试从Docker容器运行gcloud artifacts docker images scan
。
docker run --rm -it \
--read-only --volume "$HOME/.config/gcloud:/root/.config/gcloud" \
--entrypoint /bin/bash \
google/cloud-sdk:latest
正确的命令是gcloud artifacts docker images scan $IMAGE --remote --location=us
。但是我得到了以下错误(添加了--verbosity=debug
以获得更多输出):
root@aaa50fa5cb97:/# gcloud artifacts docker images scan $IMAGE --remote --location=us --verbosity=debug
DEBUG: Running [gcloud.artifacts.docker.images.scan] with arguments: [--location: "us", --remote: "True", --verbosity: "debug", RESOURCE_URI: $IMAGE]
⠛ Scanning container image
⠛ Locally extracting packages and versions from remote container image
. Remotely initiating analysis of packages and versions
X Scanning container image
X Locally extracting packages and versions from remote container image $IMAGE, '--remote=True', '--provide_fake_results=False', '--undefok=additional_package_types,verbose_errors']
Failed.
DEBUG: (gcloud.artifacts.docker.images.scan) Extraction failed: unknown error (exit code: 2)
Traceback (most recent call last):
File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 987, in Execute
resources = calliope_command.Run(cli=self, args=args)
File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 807, in Run
resources = command_instance.Run(args)
File "/usr/lib/google-cloud-sdk/lib/surface/artifacts/docker/images/scan.py", line 186, in Run
tracker.FailStage('extract',
File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/core/console/progress_tracker.py", line 940, in FailStage
raise failure_exception # pylint: disable=raising-bad-type
googlecloudsdk.command_lib.artifacts.ondemandscanning_util.ExtractionFailedError: Extraction failed: unknown error (exit code: 2)
ERROR: (gcloud.artifacts.docker.images.scan) Extraction failed: unknown error (exit code: 2)
该命令在我的机器上运行时没有任何问题,其他命令(如gcloud artifacts docker images list
)在从容器运行时返回预期的结果。
由于其他gcloud
命令按预期工作,我不认为它与身份验证有关。我希望scan命令能够成功提取包而不会出错。
1条答案
按热度按时间relj7zay1#
我想出来了!和你有同样的问题,网上似乎没有什么帮助。在我的例子中,我有一个
serviceAccount
,它在GCP中只有roles/ondemandscanning.admin
IAM权限,如on-demand scanning documentation中所述。它在
Locally extracting packages and versions from remote container image
步骤上一直失败。我试着用“超级管理员”serviceAccount
运行它,这次本地提取步骤工作了,但在按需扫描步骤中出现了权限错误!修复
虽然没有记录,但还是有点道理的:您的按需扫描
serviceAccount
还必须具有artifactRegistry
权限。我用admin
进行了测试,它工作正常,但我假设reader
就足够了。