Getting unauthorized message trying analyze an image

[pmneve]

Expected behavior

Some kind of analysis report(s)

Actual behavior

$ container-diff analyze a7fee75a1ef3 ERRO[0002] error retrieving image a7fee75a1ef3: UNAUTHORIZED: authentication required; [map[Type:repository Class: Name:library/a7fee75a1ef3 Action:pull]]

Information

• container-diff version: v0.15.0
• Operating system: MacOs Mojave 10.14.3

Steps to reproduce the behavior

1. Install container-diff (used brew)
2. container-diff analyze a7fee75a1ef3

[GuilhermoReadonly]

Same behaviour here. We use an insecure registry if it can help

[jonjohnsonjr]

$ container-diff analyze a7fee75a1ef3

Are you trying to analyze an image in your daemon or the registry? The error message seems to indicate it's trying to pull that image from dockerhub, but I don't think that's what you intended.

[davewichers]

I have the same problem. I created a local image called: benchmark:latest (which has IMAGE ID: THE_ID) I then used: docker tag THE_ID wichers/benchmark:latest, so I could then push wichers/benchmark:latest to the docker repo with: docker push ...

When I run: docker images, the 1st three lines of output are: REPOSITORY TAG ... benchmark latest wichers/benchmark latest

And when I tried: container-diff analyze benchmark:latest I get the 'error retrieving image' error, but if I try: container-diff analyze wichers/benchmark:latest it works.

I'm guessing because the later exists in the Docker repo online. However, the container-diff help output says: "If no prefix is specified, the local daemon will be checked first." and yet that does NOT appear to be working.

I tried: container-diff analyze daemon://benchmark:latest and that DOES work. So people can use that as a workaround, but the tool really should try the local daemon first, and then the remote daemon, as the instructions say it does.

NOTE: I just noticed this comment in the usage instructions:

Note: container-diff does not support references images by Docker ID directly. If your image only has an ID in your local Docker daemon, you'll need to tag it using docker tag before using it with container-diff

This might be relevant to those of you trying to use image IDs directly.

[normoes]

I get the same error when trying to analyze an image locally tagged like this:

user/image

If tagged like this (without repo):

image

it works.

[infinite-monkeys]

And when I tried: container-diff analyze benchmark:latest I get the 'error retrieving image' error, but if I try: container-diff analyze wichers/benchmark:latest it works.

I tried: container-diff analyze daemon://benchmark:latest and that DOES work. So people can use that as a workaround, but the tool really should try the local daemon first, and then the remote daemon, as the instructions say it does.

I had trouble with a similar scenario (v0.15.0 built from git 2db6995), but in my case the container-diff analyze daemon://bar:latest did NOT work, but neither did container-diff analyze foo/bar:latest.

When I do strace -f -e read,write -s 3000 container-diff-linux-amd64 analyze daemon://foo/bar:latest it looks like it is trying to search index.docker.io, but my image is only local.

[pid 14787] write(7, "GET /v1.26/images/get?names=index.docker.io%2Ffoo%2Fbar%3Alatest HTTP/1.1\r\nHost: docker\r\nUser-Agent: Go-http-client/1.1\r\n\r\n", 123) = 123
[pid 14786] read(7, "HTTP/1.1 500 Internal Server Error\r\nApi-Version: 1.26\r\nContent-Type: application/json\r\nDocker-Experimental: false\r\nServer: Docker/1.13.1 (linux)\r\nDate: Tue, 08 Jun 2021 08:51:26 GMT\r\nContent-Length: 39\r\n\r\n{\"message\":\"reference does not exist\"}\n", 4096) = 244

What did seem to work was adding a fake something-that-looked-more-like-a-server -- docker tag bar:latest foo.com/bar:latest And now container-diff-linux-amd64 analyze daemon://foo.com/bar:latest seems to function as expected.