Grype "failed to catalog" image in CI

Grype uses Syft to catalog packages before matching CVEs. "failed to catalog" means that cataloging step could not read the image: the reference did not resolve, the daemon was unreachable, or the source scheme was wrong. No packages means no scan.

What this error means

Grype exits early with "failed to catalog" or "could not fetch image", often naming a scheme like docker: or registry:, before any vulnerability results.

[0000] ERROR failed to catalog: could not fetch image "myimage:latest":
unable to use docker daemon: Cannot connect to the Docker daemon at unix:///var/run/docker.sock

Common causes

The Docker daemon is unreachable in the job

The default docker: source needs the daemon. On a runner without Docker (or without socket access), cataloging cannot pull the image.

The image reference or source scheme is wrong

A tag that does not exist, or forcing registry: when the image is only local, leaves Syft nothing to catalog.

How to fix it

Use a source scheme that matches where the image lives

1. For a registry image, pull it directly with the registry: scheme.
2. For a local tarball, use docker-archive: on the saved file.
3. Confirm the reference resolves, then re-run.

# pull straight from the registry, no local daemon needed
grype registry:ghcr.io/org/myimage:${{ github.sha }} --fail-on high

Scan a saved image archive

Save the built image to a tar and point Grype at the archive so no daemon is required.

docker save myimage:latest -o image.tar
grype docker-archive:image.tar --fail-on high

How to prevent it

• Choose the source scheme that matches the image location.
• Ensure the daemon is available if you use the docker: scheme.
• Pass the exact tag the build produced.

Related guides