JFrog xray ancestor for docker

Question

I am currently deployed two A and B artifacts in artifactory and those are indexed in xray. B is the base image is in A. I was in xray ui looking at B, but then in ancestor tab I am not finding A as ancestor listed.

Please let me know anything I am missing.

Edit:

Basically my aim is to fetch the ancestors of certain artifacts to ascertain component relations, running some ui regression tests. It deals with currently types - npm, maven, pypi and docker. Any pointers towards any similar issues with these types are appreciated.

Chen Keinan Chen Keinan · Accepted Answer · 2019-11-24T07:36:14

What you see in the UI related to the way Xray index docker images, I'll explain. when Docker image is been indexed in Xray it indexes the manifest.json (abstraction of the docker image) as the root parent and the layers as it's descendants.

Note: the ancestor/descendants view you see in the UI is relation based on checksum

If docker B has 2 layers once it becomes the base layer of docker A it will be shown as 1 layer in Docker A (with different checksum)

In the example, you provided above you have :


             Docker-A (manifest.json)                  Docker-B (manifest.json)
                    /          \                            /           \
                   /            \                          /             \
                 1/             2\                       1/              2\    
 Base Layer(B)+Another Layer(B) Another Layer(A)   Base Layer(B)  Another Layer(B)

Manifest of Docker-A is not the ancestor of manifest Docker-B, therefore, you will not see it in the UI.

If, for example, Docker-B will have only one layer and it the base layer of docker-A then the same layer with the same checksum will be shown in Docker-A

       Docker-A (manifest.json)                  Docker-B (manifest.json)
                /          \                                  |           
               /            \                                 |            
             1/             2\                               1|                     
      Base Layer(B)    Another Layer(A)                Base layer(B)

In this case, if you check the ancestor's tab of the Base Layer(B) you'll see both Docker-A and Docker-B

JFrog xray ancestor for docker

1 Answers