Using Redis cache as a cache for Java Index DB

[KMikkey]

Question

Hi guys!

I have an issue - very often we receive timeout during downloading db for vulnerabilities and Java Index from GHCR.
So there is option to use Trivy as a server and with Redis as a cache it works very impressive but only for vulnerabilities, whenever Trivy encounter Java application it is downloaded from the scratch.

Did you figure out how to use Trivy as a server with Redis and cache there trivy-db and trivy-java-db?

Many thanks for your support on this :)

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Client/Server

Operating System

CentOS7

Version

Version: 0.49.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-02-21 12:10:50.677545486 +0000 UTC
  NextUpdate: 2024-02-21 18:10:50.677545146 +0000 UTC
  DownloadedAt: 2024-02-21 13:07:04.638160228 +0000 UTC

[DmitriyLewen]

Hello @KMikkey
Thanks for your interest to Trivy!

Do you mean using trivy-java-db in the Trivy server mode?

[KMikkey]

Hi @DmitriyLewen,
Yes, I would like to use trivy-java-db with Trivy in server mode with cache in Redis. I didn't find a way to do this in documentation for current version. I tested a few solution but it looks like client always want to pull the trivy-java-db to runner so for 50 jobs in running in parallel Trivy execute download trivy-java-db for each job.

[DmitriyLewen]

Unfortunately, there is currently no way to move trivy-java-db from client to server.- #3560 (comment)

[KMikkey]

Many thanks for the answer @DmitriyLewen!
So when I use the server-client mode I should be able to implement:

• Hosted trivy-java-db in self hosted registry to avoid timeouts
• Setup trivy-server to use redis as cache
• In CI pipeline for trivy-client use different cache directory using --cache-dir (?)

From my understanding if I use server-client mode then I can't use cache on client side for trivy-java-db.

[DmitriyLewen]

In CI pipeline for trivy-client use different cache directory using --cache-dir (?)

e.g. GitHub CI/CD supports cache persistence. You can change Trivy cache directory (--cache-dir flag) and save this directory to GitHub cache -https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#using-the-cache-action

From my understanding if I use server-client mode then I can't use cache on client side for trivy-java-db.

Right.

[sastorsl]

Re #7528