Issue with the default Clair configuration and not reporting vulnerabilities

Author: mfosterroxCreated Apr 1, 2025Updated Jul 1, 2025

Hi Clair team,

Clair is being used to scan a container for vulnerabilities alongside ACS scannerv4. I have a situation where scanner v4 is reporting vulnerabilities and Clair is showing them as false. We've altered the configuration on for Clair to ignore_unpatched: false

yaml

introspection_addr: :8089
http_listen_addr: :8080
log_level: debug
indexer:
  connstring: '<omitted>'
  scanlock_retry: 10
  layer_scan_concurrency: 5
  migrations: True
matcher:
  connstring: '<omitted>'
  migrations: True
  indexer_addr: http://clair-indexer:8080/
  update_retention: 10
notifier:
  indexer_addr: http://clair-indexer:8080/
  matcher_addr: http://clair-matcher:8080/
  connstring: '<omitted>'
  migrations: True
  delivery_interval: 2m
  disable_summary: False
  poll_interval: 2m
updaters:
  config:
    rhel:
      ignore_unpatched: false
metrics:
  name: "prometheus"

Even with this configuration clair is not reporting vulnerabilities that Scannerv4 is picking up.

Source: quay/clair

View original on GitHub View discussion on GitHub