Clair v4容器部署时Updater URL无法解析求助

问题根源 #

你的Docker Compose配置中，clair-network网络设置了internal: true，这会限制该网络内的容器只能在容器之间通信，完全无法访问外部互联网。而Clair的Updater组件必须访问各个Linux发行版的官方安全更新源才能获取漏洞数据，因此所有外部请求都出现了超时错误。

解决方案 #

修改Docker Compose的网络配置，移除internal: true参数，让容器能够访问外部网络：

修改后的Docker Compose配置 #

services:
  matcher:
    image: quay.io/projectquay/clair:4.7.2
    depends_on:
      clair-database:
        condition: service_healthy
    environment:
      CLAIR_MODE: matcher
      CLAIR_CONF: /config/config.yaml
    volumes:
      - ./clair-config/:/config
    restart: unless-stopped
    container_name: clair-matcher
    networks:
      - clair-network


  indexer:
    image: quay.io/projectquay/clair:4.7.2
    depends_on:
      clair-database:
        condition: service_healthy
    volumes:
      - ./clair-config/:/config
    restart: unless-stopped
    container_name: clair-indexer
    environment:
      CLAIR_MODE: "indexer"
      CLAIR_CONF: /config/config.yaml
    networks:
      - clair-network

  clair-database:
    container_name: clair-database
    image: docker.io/library/postgres:13
    environment:
      POSTGRES_HOST_AUTH_METHOD: trust
    volumes:
      - ./config/init.sql:/docker-entrypoint-initdb.d/init.sql
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test:
        - CMD-SHELL
        - "pg_isready -U postgres"
      interval: 5s
      timeout: 4s
      retries: 12
      start_period: 10s
    networks:
      - clair-network

networks:
  clair-network:
    driver: bridge
    # 移除了 internal: true 参数

验证步骤 #

1. 重启Clair服务：

docker-compose down && docker-compose up -d

2. 进入容器测试网络连通性：

docker exec -it clair-matcher curl https://secdb.alpinelinux.org/last-update

如果能正常返回内容，说明网络已经恢复正常，Clair的Updater会自动开始同步漏洞数据。

额外说明 #

如果你的环境需要容器通过代理访问外部网络，可以在Clair的服务配置中添加代理环境变量，例如：

services:
  matcher:
    # ...其他配置
    environment:
      # ...原有环境变量
      HTTP_PROXY: http://your-proxy:port
      HTTPS_PROXY: http://your-proxy:port
      NO_PROXY: clair-database,clair-indexer
  indexer:
    # ...其他配置
    environment:
      # ...原有环境变量
      HTTP_PROXY: http://your-proxy:port
      HTTPS_PROXY: http://your-proxy:port
      NO_PROXY: clair-database,clair-matcher

内容的提问来源于stack exchange，提问作者F.M.