Running Clair in single fargate task for container scanning

[meghanabsrinath]

We are running clair and clair-db containers as part of a single AWS fargate task. Below is a snippet of our task definition.

{
    "family": "clair",
    "networkMode": "awsvpc",
    "containerDefinitions": [
        {
            "name": "db",
            "image": "arminc/clair-db:2017-05-05",
            "essential": true,
            "command": [
                "sh",
                "-c",
                "echo clair db runs"
            ],
            "portMappings": [
                {
                    "containerPort": 5432,
                    "hostPort": 5432,
                    "protocol": "tcp"
                }
            ],
        },
        {
            "name": "clair",
            "image": "quay.io/coreos/clair:v2.1.6",
            "essential": true,
            "command": [
                "sh",
                "-c",
                "echo clair runs"
            ],
            "portMappings": [
                {
                    "containerPort": 6060,
                    "hostPort": 6060,
                    "protocol": "tcp"
                }
            ],

Below is a part of config.yaml where we have specified the connection string for the database.

clair:
  database:
    type: pgsql
    options:
      source: host=localhost port=5432 user=postgres password=xxxx sslmode=disable statement_timeout=60000

As per the AWS fargate docs, localhost can be used to communicate between these two containers of a single task. So clair container should ideally be able to link to the clair-db container running on localhost:5432 on the same network to perform the scanning. Clair-db container is running fine in fargate, but clair container is failing with the below logs:

{"Event":"pgsql: could not open database: dial tcp 127.0.0.1:5432: connect: connection refused","Level":"fatal","Location":"main.go:97","Time":"2021-03-23 13:26:38.737437"}

As per this comment, we have tried running the same images in docker by specifying the container name of clair-db in the config.yaml instead of localhost and it is working. Is there any reason why a connection to localhost not working for clair container in fargate approach.

[hdonnay]

This doesn't seem like a clair issue.