scanning a docker image created from docker load

[yzl]

Asking on the off-chance that someone happens to know (I'm iterating in CI slowly): if I start from a docker tarball, do I have to do something other than docker load < tarball.tar in order to come up with an artifact that cnspec can scan as a docker image? When I try to scan the result of my docker load command, I get

Run cnspec scan container image <imagerepo>:pr-238-migrate-schema -f /home/runner/work/_actions/kong/shared-actions/main/check-images/mondoo-policy-CIS-Distribution-Independent-Linux-Benchmark-Level-1-for-Container_2023-01-23_1674514096.yaml --score-threshold 100
→ no Mondoo configuration file provided. using defaults
→ detected ci-cd environment
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=1
Scanned 1 assets

scratch
    X <imagerepo>:pr-238-migrate-schema@741a46a4f011

For detailed output, run this scan with "-o full".

Error: Process completed with exit code 1.

[imilchev]

docker load is the only thing you need to do, indeed. It seems like there is some other issue with this scan but it doesn't get printed out in the output. Could you run the same thing with --log-level debug and provide the output?

[chris-rock]

1. Latest versions of cnspec print more errors so the error is more clear
2. Most likely what happens here is that you scan a scratch container. For that reason the out-of-the-box linux policies do not apply and there will be no policy that match scratch.

Can you share what you want to test on the scratch container? That would help us to give you better instructions.

[chris-rock]

The next version of cnspec will allow you to scan a tar image without the need for docker. #1116 and mondoohq/cnspec#481

[chris-rock]

You run the following to scan tar files:

docker save debian:11 > debian11.tar  
cnspec scan container tar debian11.tar