Chapter 3. Setting up Clair on standalone Red Hat Quay deployments For standalone Red Hat Quay deployments, you can set up Clair manually. Procedure In your Red Hat Quay installation directory, create a new directory for the Clair database data: USD mkdir /home/<user-name>/quay-poc/postgres-clairv4 Set the appropriate permissions for the postgres-clairv4 file by entering the following command: USD setfacl -m u:26:-wx /home/<user-name>/quay-poc/postgres-clairv4 Deploy a Clair PostgreSQL database by entering the following command: USD sudo podman run -d --name postgresql-clairv4 \ -e POSTGRESQL_USER=clairuser \ -e POSTGRESQL_PASSWORD=clairpass \ -e POSTGRESQL_DATABASE=clair \ -e POSTGRESQL_ADMIN_PASSWORD=adminpass \ -p 5433:5432 \ -v /home/<user-name>/quay-poc/postgres-clairv4:/var/lib/pgsql/data:Z \ registry.redhat.io/rhel8/postgresql-13:1-109 Install the PostgreSQL uuid-ossp module for your Clair deployment: USD podman exec -it postgresql-clairv4 /bin/bash -c 'echo "CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\"" | psql -d clair -U postgres' Example output CREATE EXTENSION Note Clair requires the uuid-ossp extension to be added to its PostgreSQL database. For users with proper privileges, creating the extension will automatically be added by Clair. If users do not have the proper privileges, the extension must be added before start Clair. If the extension is not present, the following error will be displayed when Clair attempts to start: ERROR: Please load the "uuid-ossp" extension. (SQLSTATE 42501) . Stop the Quay container if it is running and restart it in configuration mode, loading the existing configuration as a volume: USD sudo podman run --rm -it --name quay_config \ -p 80:8080 -p 443:8443 \ -v USDQUAY/config:/conf/stack:Z \ {productrepo}/{quayimage}:{productminv} config secret Log in to the configuration tool and click Enable Security Scanning in the Security Scanner section of the UI. Set the HTTP endpoint for Clair using a port that is not already in use on the quay-server system, for example, 8081 . Create a pre-shared key (PSK) using the Generate PSK button. Security Scanner UI Validate and download the config.yaml file for Red Hat Quay, and then stop the Quay container that is running the configuration editor. Extract the new configuration bundle into your Red Hat Quay installation directory, for example: USD tar xvf quay-config.tar.gz -d /home/<user-name>/quay-poc/ Create a folder for your Clair configuration file, for example: USD mkdir /etc/opt/clairv4/config/ Change into the Clair configuration folder: USD cd /etc/opt/clairv4/config/ Create a Clair configuration file, for example: http_listen_addr: :8081 introspection_addr: :8088 log_level: debug indexer: connstring: host=quay-server.example.com port=5433 dbname=clair user=clairuser password=clairpass sslmode=disable scanlock_retry: 10 layer_scan_concurrency: 5 migrations: true matcher: connstring: host=quay-server.example.com port=5433 dbname=clair user=clairuser password=clairpass sslmode=disable max_conn_pool: 100 migrations: true indexer_addr: clair-indexer notifier: connstring: host=quay-server.example.com port=5433 dbname=clair user=clairuser password=clairpass sslmode=disable delivery_interval: 1m poll_interval: 5m migrations: true auth: psk: key: "MTU5YzA4Y2ZkNzJoMQ==" iss: ["quay"] # tracing and metrics trace: name: "jaeger" probability: 1 jaeger: agent: endpoint: "localhost:6831" service_name: "clair" metrics: name: "prometheus" For more information about Clair's configuration format, see Clair configuration reference . Start Clair by using the container image, mounting in the configuration from the file you created: Note Running multiple Clair containers is also possible, but for deployment scenarios beyond a single container the use of a container orchestrator like Kubernetes or OpenShift Container Platform is strongly recommended. 3.1. Using Clair with an upstream image for Red Hat Quay For most users, independent upgrades of Clair from the current version (4.7.2) are unnecessary. In some cases, however, customers might want to pull an image of Clair from the upstream repository for various reasons, such as for specific bug fixes or to try new features that have not yet been released downstream. You can use the following procedure to run an upstream version of Clair with Red Hat Quay. Important Upstream versions of Clair have not been fully tested for compatibility with Red Hat Quay. As a result, this combination might cause issues with your deployment. Procedure Enter the following command to stop Clair if it is running: USD podman stop <clairv4_container_name> Navigate to the upstream repository , find the version of Clair that you want to use, and pull it to your local machine. For example: USD podman pull quay.io/projectquay/clair:nightly-2024-02-03 Start Clair by using the container image, mounting in the configuration from the file you created: USD podman run -d --name clairv4 \ -p 8081:8081 -p 8088:8088 \ -e CLAIR_CONF=/clair/config.yaml \ -e CLAIR_MODE=combo \ -v /etc/opt/clairv4/config:/clair:Z \ quay.io/projectquay/clair:nightly-2024-02-03

Commands:
mkdir /home/<user-name>/quay-poc/postgres-clairv4
setfacl -m u:26:-wx /home/<user-name>/quay-poc/postgres-clairv4
sudo podman run -d --name postgresql-clairv4 -e POSTGRESQL_USER=clairuser -e POSTGRESQL_PASSWORD=clairpass -e POSTGRESQL_DATABASE=clair -e POSTGRESQL_ADMIN_PASSWORD=adminpass -p 5433:5432 -v /home/<user-name>/quay-poc/postgres-clairv4:/var/lib/pgsql/data:Z registry.redhat.io/rhel8/postgresql-13:1-109
podman exec -it postgresql-clairv4 /bin/bash -c 'echo "CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\"" | psql -d clair -U postgres'
CREATE EXTENSION
sudo podman run --rm -it --name quay_config -p 80:8080 -p 443:8443 -v USDQUAY/config:/conf/stack:Z {productrepo}/{quayimage}:{productminv} config secret
tar xvf quay-config.tar.gz -d /home/<user-name>/quay-poc/
mkdir /etc/opt/clairv4/config/
cd /etc/opt/clairv4/config/
http_listen_addr: :8081 introspection_addr: :8088 log_level: debug indexer: connstring: host=quay-server.example.com port=5433 dbname=clair user=clairuser password=clairpass sslmode=disable scanlock_retry: 10 layer_scan_concurrency: 5 migrations: true matcher: connstring: host=quay-server.example.com port=5433 dbname=clair user=clairuser password=clairpass sslmode=disable max_conn_pool: 100 migrations: true indexer_addr: clair-indexer notifier: connstring: host=quay-server.example.com port=5433 dbname=clair user=clairuser password=clairpass sslmode=disable delivery_interval: 1m poll_interval: 5m migrations: true auth: psk: key: "MTU5YzA4Y2ZkNzJoMQ==" iss: ["quay"] tracing and metrics trace: name: "jaeger" probability: 1 jaeger: agent: endpoint: "localhost:6831" service_name: "clair" metrics: name: "prometheus"
sudo podman run -d --name clairv4 -p 8081:8081 -p 8088:8088 -e CLAIR_CONF=/clair/config.yaml -e CLAIR_MODE=combo -v /etc/opt/clairv4/config:/clair:Z registry.redhat.io/quay/clair-rhel8:v3.10.9
podman stop <clairv4_container_name>
podman pull quay.io/projectquay/clair:nightly-2024-02-03
podman run -d --name clairv4 -p 8081:8081 -p 8088:8088 -e CLAIR_CONF=/clair/config.yaml -e CLAIR_MODE=combo -v /etc/opt/clairv4/config:/clair:Z quay.io/projectquay/clair:nightly-2024-02-03