Clair healthcheck configuration

[flomickl]

Hi, I am running clair with podman run but in the logs following message occurs.

{"level":"warn","component":"introspection/New","time":"2024-07-12T07:23:18Z","message":"no health check configured; unconditionally reporting OK"}

So how to set up the health check correctly?
I am using clair:4.7.4

many thanks in advance!

I thought it would be enough to set introspection_addr: in the config.yml

Here my clair config.yml

config.yaml 
---
log_level: warn
introspection_addr: ":8000"
http_listen_addr: ":6000"
updaters:
  sets:
    - "alpine"
    - "aws"
    - "debian"
    - "oracle"
    - "osv"
    - "photon"
    - "rhcc"
    - "rhel"
    - "suse"
    - "ubuntu"
indexer:
  connstring: "host=clair-db port=5432 user=clair password=clair dbname=indexer sslmode=disable"
  scanlock_retry: 10
  layer_scan_concurrency: 5
  migrations: true
matcher:
  connstring: "host=clair-db port=5432 user=clair password=clair dbname=matcher sslmode=disable"
  migrations: true
matchers:
  names:
  - "alpine-matcher"
  - "aws-matcher"
  - "debian-matcher"
  - "gobin"
  - "java-maven"
  - "oracle"
  - "photon"
  - "python"
  - "rhel"
  - "rhel-container-matcher"
  - "suse"
  - "ubuntu"
notifier:
  connstring: "host=clair-db port=5432 user=clair password=clair dbname=notifier sslmode=disable"
  indexer_addr: http://localhost:6000/
  matcher_addr: http://localhost:6000/
  migrations: true
  delivery_interval: 5s
  poll_interval: 15s
  webhook:
    target: "http://localhost:6000/secscan/notification"
    callback: "http://localhost:6000/notifier/api/v1/notification/"
metrics:
  name: "prometheus"

# ===== AUTH
auth: 
  psk:
    key: 'XXXXXXXXXXXXXXXXX'
    iss:
      - 'quay'

It is not obvious in the documentation how to call the health endpoint as well. I couldn't find any information.

curl http://localhost:8000/healthz

return ok
but mentioned in the warning unconditionally reporting OK`

If I use clairctl, it fails

clairctl --config /data/quay/clairctl.yml health

Clair: ✘

my clairctl.yml is

clair:
  port: 6060
  healthPort: 8000
  uri: http://localhost
  report:
    path: /data/quay/reports
  auth:
    insecureSkipVerify: false
    psk:
      key: XXXXXXXXX
      iss: quay

At the end here my podman run command.

podman run \
  --name clair \
  --network quay-backend \
  --network clair-backend \
  --network traefik-proxy \
  -it \
  -d \
  -v /data/quay/config/clair/config.yaml:/src/clair/config.yaml:ro,Z \
  --env-file /data/quay/clair.env \
  -e TZ=Europe/Berlin \
  -e CLAIR_CONF="/src/clair/config.yaml" \
  -e CLAIR_MODE="combo" \
  -e CLAIR_DB_USER="clair" \
  -e CLAIR_DB_PASSWORD="clair" \
  -e TZ=Europe/Berlin \
  --health-cmd="curl -f http://localhost:8000/healthz || exit 1" \
  --health-interval=30s \
  --health-timeout=10s \
  --health-retries=3 \
  quay.io/projectquay/clair:4.7.4 \
  bash -c "cd /src/clair/cmd/clair; go run -mod vendor ."

[hdonnay]

Yeah, it's a (perhaps cryptic) warning that the health check doesn't have any logic besides "is the process running?".