How to Bypass Vulnerability Checks When Importing Docker Containers in Astra Linux

When working with Docker in Astra Linux, you may encounter issues while importing containers. For example, the command:

docker load -i container.tar

might be interrupted due to a detected vulnerability. The error may look like this:

directory '/var/lib/docker/overlay2/aa94cbac24f124f2725f0fb78022d5ce3309c75ccd34b6e18ca40ec1d8eb9d0c/diff' contains vulnerabilities! [{oval:astra:def:4374014773234437469147563906627 true Astra Linux – vulnerability in db5.3 }].

The same error can occur when pulling images.

Causes of the Problem

The issue arises when Astra Linux detects vulnerabilities in the container’s content. Astra 1.7 Update 4 introduced the OpenSCAP vulnerability scanner, which checks for vulnerabilities against the oval-db database. The scanner is enabled by default and prohibits further use of the container upon detecting a vulnerability.

Solutions to the Problem

Fixing the Vulnerability

The first option is to try to fix the vulnerability. However, this may be problematic if the image was not created by you.

Bypassing Vulnerability Checks

If fixing the issue is not feasible, you can bypass the vulnerability checks by adding a corresponding setting to the Docker configuration file.

Steps to Bypass the Check

Open or create the file /etc/docker/daemon.json.

Add the following line:

{ "astra-sec-level": 6 }

You can quickly add the line with the command:

sudo cat << EOF > /etc/docker/daemon.json
{ "astra-sec-level" : 6 }
EOF

Restart Docker:

sudo systemctl restart docker

Conclusion

Now you know how to bypass vulnerability checks when importing Docker containers in Astra Linux. This solution can help you continue working without interruptions, although it is always recommended to be cautious about security issues.