ClairV4 readiness for operation

[slashben]

We install ClairV4 in a K8s cluster from scratch in our solution.

We see that we are able to scan images and get results, or at least, getting back "200 - OK". At the beginning the scan results are empty, but after 10+ minutes for the same images we start to get non-empty results.

How should we use Clair? We assume that in the first X minutes it downloads definitions and etc. Is there an API to query when it is "ready for operation".

Thx
B

[hdonnay]

Clair only returns results when it's ready. "Ready," meaning "has vulnerabilities to match against." This does mean there's a "ramp-up" period where matching results are changing rapidly, but that's a consequence of 2 other choices:

1. The total set of updaters is not known beforehand and will change over time.
2. By nature of being a distributed system, one node running its set of updaters to completion doesn't mean all updaters have run to completion.