Prisma Cloud Compute : Registry Images not being scanned by Defenders with Error "failed to find supported manifest"
7752
Created On 02/26/23 04:32 AM - Last Modified 11/26/24 04:04 AM
Symptom
- Going to Defend > Vulnerabilities > Images > Registry Settings tab, Images are not being scanned by Prisma Cloud Compute Defenders with Error "failed to find supported manifest".
Defender Logs
Sample Error Messages seen for both Linux and Windows Images in Defender logs:
ERRO YYYY-MM-DDT scanner.go:308 Failed to query image details <IMAGE> failed to find supported manifest {Manifests:[{Digest:sha256:<SHA Value> Platform:{Architecture:ppc64le Os:linux}}
ERRO YYYY-MM-DDT scanner.go:308 Failed to query image details <IMAGE> failed to find supported manifest {Manifests:[{Digest:sha256:<SHA Value> Platform:{Architecture:s390x Os:linux}}
ERRO YYYY-MM-DDT scanner.go:308 Failed to query image details <IMAGE> failed to find supported manifest {Manifests:[{Digest:sha256:<SHA Value> Platform:{Architecture:amd64 Os:windows}}Environment
- Prisma Cloud Compute
Cause
- Prisma Cloud currently supports x86_64 and ARM64 architectures : System Requirements
- If images are on a different architecture eg. Linux s390x or Windows amd64 (as seen in above error messages), they may not be scanned with Error 'failed to find supported manifest'.
Resolution
- Exclude the Repositories known to use a different architecture in their images from being scanned.
- This can be done by entering the repo/image name in the field 'Repositories to exclude' under Registry settings.
Additional Information
- The Container OS version must match the Host OS version where Defender runs.
- For example, Defender on Windows Server 1803 can scan nanoserver:1803, but it can’t scan nanoserver:1809.
- Conversely, Defender on Windows Server 1809 can scan nanoserver:1809, but it can’t scan nanoserver:1803.