“提取失败:从Docker Container运行`gcloud artifacts docker images scan`时出现未知错误

4dbbbstv  于 2023-05-16  发布在  Docker
关注(0)|答案(1)|浏览(175)

我正在尝试从Docker容器运行gcloud artifacts docker images scan

docker run --rm -it \
  --read-only --volume "$HOME/.config/gcloud:/root/.config/gcloud" \
  --entrypoint /bin/bash \
  google/cloud-sdk:latest

正确的命令是gcloud artifacts docker images scan $IMAGE --remote --location=us。但是我得到了以下错误(添加了--verbosity=debug以获得更多输出):

root@aaa50fa5cb97:/# gcloud artifacts docker images scan $IMAGE --remote --location=us --verbosity=debug
DEBUG: Running [gcloud.artifacts.docker.images.scan] with arguments: [--location: "us", --remote: "True", --verbosity: "debug", RESOURCE_URI: $IMAGE]
⠛ Scanning container image                                                                                                  
  ⠛ Locally extracting packages and versions from remote container image                                                    
  . Remotely initiating analysis of packages and versions                                                                   
X Scanning container image                                                                                                  
  X Locally extracting packages and versions from remote container image $IMAGE, '--remote=True', '--provide_fake_results=False', '--undefok=additional_package_types,verbose_errors']
Failed.                                                                                                                     
DEBUG: (gcloud.artifacts.docker.images.scan) Extraction failed: unknown error (exit code: 2)
Traceback (most recent call last):
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 987, in Execute
    resources = calliope_command.Run(cli=self, args=args)
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 807, in Run
    resources = command_instance.Run(args)
  File "/usr/lib/google-cloud-sdk/lib/surface/artifacts/docker/images/scan.py", line 186, in Run
    tracker.FailStage('extract',
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/core/console/progress_tracker.py", line 940, in FailStage
    raise failure_exception  # pylint: disable=raising-bad-type
googlecloudsdk.command_lib.artifacts.ondemandscanning_util.ExtractionFailedError: Extraction failed: unknown error (exit code: 2)
ERROR: (gcloud.artifacts.docker.images.scan) Extraction failed: unknown error (exit code: 2)

该命令在我的机器上运行时没有任何问题,其他命令(如gcloud artifacts docker images list)在从容器运行时返回预期的结果。
由于其他gcloud命令按预期工作,我不认为它与身份验证有关。我希望scan命令能够成功提取包而不会出错。

relj7zay

relj7zay1#

我想出来了!和你有同样的问题,网上似乎没有什么帮助。在我的例子中,我有一个serviceAccount,它在GCP中只有roles/ondemandscanning.admin IAM权限,如on-demand scanning documentation中所述。
它在Locally extracting packages and versions from remote container image步骤上一直失败。我试着用“超级管理员”serviceAccount运行它,这次本地提取步骤工作了,但在按需扫描步骤中出现了权限错误!

修复

虽然没有记录,但还是有点道理的:您的按需扫描serviceAccount还必须具有artifactRegistry权限。我用admin进行了测试,它工作正常,但我假设reader就足够了。

相关问题