Project: Trivy (Provisioning / Security & Compliance)
File: air-gap.md

Trivy can be used in air-gapped environments. Note that an allowlist is . At first, you need to download the vulnerability database for use in air-gapped environments. === "Trivy" ``` TRIVYTEMPDIR=$(mktemp -d) trivy --cache-dir $TRIVYTEMPDIR image --download-db-only tar -cf ./db.tar.gz -C $TRIVYTEMPDIR/db metadata.json trivy.db rm -rf $TRIVYTEMPDIR ``` === "oras >= v0.13.0" Please follow . Download `db.tar.gz`: ``` $ oras pull ghcr.io/aquasecurity/trivy-db:2 ``` === "oras < v0.13.0" Please follow . Download `db.tar.gz`: ``` $ oras pull -a ghcr.io/aquasecurity/trivy-db:2 ``` Java users also need to download the Java index database for use in air-gapped environments. !!! note You container image may contain JAR files even though you don't use Java directly. In that case, you also need to download the Java index database. === "Trivy" ``` TRIVYTEMPDIR=$(mktemp -d) trivy --cache-dir $TRIVYTEMPDIR image --download-java-db-only tar -cf ./javadb.tar.gz -C $TRIVYTEMPDIR/java-db metadata.json trivy-java.db rm -rf $TRIVYTEMPDIR ``` === "oras >= v0.13.0" Please follow . Download `javadb.tar.gz`: ``` $ oras pull ghcr.io/aquasecurity/trivy-java-db:1 ``` === "oras < v0.13.0" Please follow . Download `javadb.tar.gz`: ``` $ oras pull -a ghcr.io/aquasecurity/trivy-java-db:1 ``` The way of transfer depends on the environment. === "Vulnerability db" ``` $ rsync -av -e ssh /path/to/db.tar.gz [user]@[host]:dst ``` === "Java index db[^1]" ``` $ rsync -av -e ssh /path/to/javadb.tar.gz [user]@[host]:dst ``` You have to know where to put the DB files. The following command shows the default cache directory. ``` $ ssh user@host $ trivy -h | grep cache --cache-dir value cache directory (default: "/home/myuser/.cache/trivy") [$TRIVYCACHEDIR] ``` === "Vulnerability db" Put the DB file in the cache directory + `/db`. ``` $ mkdir -p /home/myuser/.cache/trivy/db $ cd /home/myuser/.cache/trivy/db $ tar xvf /path/to/db.tar.gz -C /home/myuser/.cache/trivy/db x trivy.db x metadata.json $ rm /path/to/db.tar.gz ``` === "Java index db[^1]" Put the DB file in the cache directory + `/java-db`. ``` $ mkdir -p /home/myuser/.cache/trivy/java-db $ cd /home/myuser/.cache/trivy/java-db $ tar xvf /path/to/javadb.tar.gz -C /home/myuser/.cache/trivy/java-db x trivy-java.db x metadata.json $ rm /path/to/javadb.tar.gz ``` In an air-gapped environment it is your responsibility to update the Trivy databases on a regular basis, so that the scanner can detect recently-identified vulnerabilities. In an air-gapped environment, you have to specify `--skip-db-update` and `--skip-java-db-update`[^1] so that Trivy doesn't attempt to download the latest database files. In addition, if you want to scan `pom.xml` dependencies, you need to specify `--offline-scan` since Trivy tries to issue API requests for scanning Java applications by default. ``` $ trivy image --skip-db-update --skip-java-db-update --offline-scan alpine:3.12 ``` No special measures are required to detect misconfigurations in an air-gapped environment. In an air-gapped environment, specify `--skip-check-update` so that Trivy doesn't attempt to download the latest misconfiguration checks. ``` $ trivy conf --skip-policy-update /path/to/conf ```