Extremely high cpu/slow cloning

[zingybrett]

The Clair project is used for scanning container images based on various CVE trackers for projects like Alpine, Debian, RHEL, and Ubuntu. Ubuntu's CVE causes the Clair process to consume extraordinary amounts of CPU/Disk resources during the bzr clone stage.

More information can be seen at the Clair bugtracker

https://github.com/coreos/clair/issues/548

[zingybrett (zingybrett)]

Something that could help the Clair project as well: Is there a mirror of the CVE list that is hosted on something like Git/hg?

[Steve Beattie (sbeattie)]

Hi, thanks for you interest in the ubuntu-cve-tracker. The tracker has been converted to git and is available from https://code.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/+git/ubuntu-cve-tracker .

I'm not quite sure why the high CPU load was seen during the bzr clone stage; however, during the conversion I did discover the cve tracker bazaar branch on launchpad was in an old v1 format which may have been part of the cause.

The layout/format of the tree has not changed. Please report bugs if yo find anything weird with the conversion. Thanks again!

[Steve Beattie (sbeattie)]

Given that the Clair project has switched to consuming the git tree, I'm closing this bug report. Thanks!