<p>I am using Clair for Vulnerability checks in my harbor.</p>
<p>Services like Clair that have thousands of hosts continually hitting the hosting git server(<a href="https://git.launchpad.net/ubuntu-cve-tracker/" rel="nofollow noreferrer">https://git.launchpad.net/ubuntu-cve-tracker/</a>) saturate the server, and so there are scaling measures in place that causes it to return a 503 error when too many clients are concurrently hitting it.</p>
<p>These are my errors in my Clair pod:</p>
<pre><code>{&quot;Event&quot;:&quot;could not pull ubuntu-cve-tracker repository&quot;,&quot;Level&quot;:&quot;error&quot;,&quot;Location&quot;:&quot;ubuntu.go:174&quot;,
&quot;Time&quot;:&quot;2021-06-25 06:38:32.859806&quot;,&quot;error&quot;:&quot;exit status 128&quot;,
&quot;output&quot;:&quot;Cloning into '.'...

fatal: unable to access '[https://git.launchpad.net/ubuntu-cve-tracker/':|https://git.launchpad.net/ubuntu-cve-tracker/%27:] 
The requested URL returned error: 503\n&quot;} 

{&quot;Event&quot;:&quot;an error occured when fetching update&quot;,&quot;Level&quot;:&quot;error&quot;,&quot;Location&quot;:&quot;updater.go:246&quot;,
&quot;Time&quot;:&quot;2021-06-25 06:38:32.859934&quot;,&quot;error&quot;:&quot;could not download requested resource&quot;,&quot;updater name&quot;:&quot;ubuntu&quot;}
</code></pre>
<pre><code>panic: runtime error: slice bounds out of range goroutine 549 [running]: github.com/coreos/clair/ext/vulnsrc/rhel.toFeatureVersions(0xc000208390, 0x2, 0xc000246070, 0x1, 0x1, 0xc0001bc200, 0x1, 0x1, 0x0, 0x908f38, ...) /go/src/github.com/coreos/clair/ext/vulnsrc/rhel/rhel.go:292 +0xc3b github.com/coreos/clair/ext/vulnsrc/rhel.parseRHSA(0x7fcc0f4a24b0, 0xc00038c0f0, 0xc00038c0f0, 0x7fcc0f4a24b0, 0xc00038c0f0, 0x8e2708, 0x4) /go/src/github.com/coreos/clair/ext/vulnsrc/rhel/rhel.go:182 +0x1c8 
</code></pre>
<p>As per <a href="https://bugs.launchpad.net/ubuntu-cve-tracker/+bug/1925337" rel="nofollow noreferrer">https://bugs.launchpad.net/ubuntu-cve-tracker/+bug/1925337</a> this is a bug from the git server, and in that post, they are suggesting to get Clair to pull data from other sources instead which means an offline approach. So apart from the offline approach, is there any other way to decrease the number of hits to the git server for Vulnerability checks?</p>
<p>I have tried to control the number of hits to the git server, but nowhere have I found the configuration in Clair.</p>
<p>Does anyone have any idea how we can control the hits for Vulnerability checks or avoid restarts of my pod?</p>
<p>Also, I found schedule a scan(hourly, daily, or weekly) on my harbor UI, But how does scheduling the scan to say daily help?<br />
Is it only at that point it will try to do the git clone to get the latest CVEs?</p>

Anvesh Muppeda
<p>Check first if this is linked to <a href="https://github.com/goharbor/harbor/issues/14720" rel="nofollow noreferrer"><code>goharbor/harbor</code> issue 14720</a>: &quot;clair restarts repeatedly when there is some issue with vulnerability repos&quot;, with logs like</p>
<pre class="lang-golang prettyprint-override"><code>{&quot;Event&quot;:&quot;Start fetching vulnerabilities&quot;,&quot;Level&quot;:&quot;info&quot;,&quot;Location&quot;:&quot;ubuntu.go:85&quot;,&quot;Time&quot;:&quot;2021-04-21 19:18:24.446743&quot;,&quot;package&quot;:&quot;Ubuntu&quot;}
...
{&quot;Event&quot;:&quot;could not pull ubuntu-cve-tracker repository&quot;,&quot;Level&quot;:&quot;error&quot;,&quot;Location&quot;:&quot;ubuntu.go:174&quot;,&quot;Time&quot;:&quot;2021-04-21 19:18:25.147515&quot;,&quot;error&quot;:&quot;exit status 128&quot;,&quot;output&quot;:&quot;Cloning into '.'...\nfatal: unable to access 'https://git.launchpad.net/ubuntu-cve-tracker/': The requested URL returned error: 503\n&quot;}
{&quot;Event&quot;:&quot;an error occured when fetching update&quot;,&quot;Level&quot;:&quot;error&quot;,&quot;Location&quot;:&quot;updater.go:246&quot;,&quot;Time&quot;:&quot;2021-04-21 19:18:25.147607&quot;,&quot;error&quot;:&quot;could not download requested resource&quot;,&quot;updater name&quot;:&quot;ubuntu&quot;}
...
panic: runtime error: slice bounds out of range [25:24]

goroutine 327 [running]:
github.com/quay/clair/v2/ext/vulnsrc/rhel.toFeatureVersions(0xc0065215a8, 0x2, 0xc0000b4f08, 0x1, 0x1, 0xc006ef7aa0, 0x1, 0x1, 0x2, 0xc0000b4ef0, ...)
    /go/src/github.com/quay/clair/ext/vulnsrc/rhel/rhel.go:276 +0xbf8
</code></pre>
<p>It refers to <a href="https://github.com/quay/clair/issues/1249#L278" rel="nofollow noreferrer"><code>quay/clair</code> issue 1249</a>, but the harbor case is closed with <a href="https://github.com/goharbor/harbor/pull/15032" rel="nofollow noreferrer">PR 15032</a>, using <code>CLAIRVERSION=v2.1.7</code></p>
