Prisma Cloud Compute : Registry Images not being scanned by Defenders with Error "failed to find supported manifest"

Prisma Cloud Compute : Registry Images not being scanned by Defenders with Error "failed to find supported manifest"

4293
Created On 02/26/23 04:32 AM - Last Modified 02/26/23 04:43 AM


Symptom


  • Going to Defend > Vulnerabilities > Images > Registry Settings tab, Images are not being scanned by Prisma Cloud Compute Defenders with Error "failed to find supported manifest".

Screenshot 2023-02-26 at 11.56.25 AM.png

Defender Logs

Sample Error Messages seen for both Linux and Windows Images in Defender logs:
ERRO YYYY-MM-DDT scanner.go:308 Failed to query image details <IMAGE> failed to find supported manifest {Manifests:[{Digest:sha256:<SHA Value> Platform:{Architecture:ppc64le Os:linux}}
ERRO YYYY-MM-DDT scanner.go:308 Failed to query image details <IMAGE> failed to find supported manifest {Manifests:[{Digest:sha256:<SHA Value> Platform:{Architecture:s390x Os:linux}}
ERRO YYYY-MM-DDT scanner.go:308 Failed to query image details <IMAGE> failed to find supported manifest {Manifests:[{Digest:sha256:<SHA Value> Platform:{Architecture:amd64 Os:windows}}


Environment


  • Prisma Cloud Compute


Cause


  • Prisma Cloud currently supports x86_64 and ARM64 architectures : System Requirements
  • If images are on a different architecture eg. Linux s390x or Windows amd64 (as seen in above error messages), they may not be scanned with Error 'failed to find supported manifest'.


Resolution


  • Exclude the Repositories known to use a different architecture in their images from being scanned.
  • This can be done by entering the repo/image name in the field 'Repositories to exclude' under Registry settings.
Screenshot 2023-02-26 at 12.18.17 PM.png
 
  • Meanwhile, you can consider submitting a Feature Request for scanning images of other architectures, that can be evaluated by our internal teams to include support in future releases : https://prismacloud.ideas.aha.io/


Additional Information


  • The Container OS version must match the Host OS version where Defender runs.
  • For example, Defender on Windows Server 1803 can scan nanoserver:1803, but it can’t scan nanoserver:1809.
  • Conversely, Defender on Windows Server 1809 can scan nanoserver:1809, but it can’t scan nanoserver:1803.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kH64CAE&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language