{"id":20725202,"url":"https://github.com/sighupio/trivy-offline","last_synced_at":"2025-03-11T08:44:11.366Z","repository":{"id":44660797,"uuid":"298591258","full_name":"sighupio/trivy-offline","owner":"sighupio","description":"Trivy offline builder. Fits perfectly in your CI System","archived":false,"fork":false,"pushed_at":"2023-10-30T09:32:08.000Z","size":28,"stargazers_count":17,"open_issues_count":1,"forks_count":9,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-01-17T23:28:50.156Z","etag":null,"topics":["cicd","drone","hacktoberfest","quay","sdlc","security","trivy"],"latest_commit_sha":null,"homepage":"https://sighup.io","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sighupio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-09-25T14:09:40.000Z","updated_at":"2024-11-09T06:26:54.000Z","dependencies_parsed_at":"2023-02-15T07:46:30.476Z","dependency_job_id":"72a70a8c-f7f6-43f1-9a09-3af0fa338750","html_url":"https://github.com/sighupio/trivy-offline","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sighupio%2Ftrivy-offline","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sighupio%2Ftrivy-offline/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sighupio%2Ftrivy-offline/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sighupio%2Ftrivy-offline/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sighupio","download_url":"https://codeload.github.com/sighupio/trivy-offline/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243004080,"owners_count":20220235,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cicd","drone","hacktoberfest","quay","sdlc","security","trivy"],"created_at":"2024-11-17T04:17:54.311Z","updated_at":"2025-03-11T08:44:11.341Z","avatar_url":"https://github.com/sighupio.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Trivy Offline\n\n[![Build Status](https://ci.sighup.io/api/badges/sighupio/trivy-offline/status.svg)](https://ci.sighup.io/sighupio/trivy-offline)\n\nThis project aims to solve an issue while using [trivy] at scale.\nIn an environment where you need to scan hundreds or even thousands of container images with [trivy], you can hit a\nGitHub limit while downloading the vulnerability database.\n\n## Inspiration\n\nThis project was inspired by the [`arminc/clair-db`](https://hub.docker.com/r/arminc/clair-db) container image,\nand [github.com/arminc/clair-local-scan](https://github.com/arminc/clair-local-scan) project witch speeds up\n[clair](https://github.com/quay/clair) vulnerability scans.\n\n## What we do\n\nWe build and publish a new container image every day following\n[trivy documentation to download and use the vulnerability database just once](https://github.com/aquasecurity/trivy/blob/main/docs/docs/advanced/air-gap.md).\nThe process was designed to be used in the air-gapped environment. Still, it fits perfectly while running this software on CI\nsystems like `drone`, `gitlab`, `github-actions`, `circle-ci`, or `travis`.\n\nWe publish two different tags every day:\n\n- *[quay.io/sighup/trivy-offline]*:`latest`: It is overridden every day. If you choose this tag, be sure to pull the image before running your scan.\n- *[quay.io/sighup/trivy-offline]*:`YYYY-MM-DD`: It is just one every day. We recommend you to use this tag. It is published at 01:00 UTC Time.\n\n## Quick Start\n\n```bash\n# Don't forget to pull before running\n$ docker pull quay.io/sighup/trivy-offline\n$ docker run --rm quay.io/sighup/trivy-offline [YOUR_IMAGE_NAME]\n# or\n$ docker run --rm quay.io/sighup/trivy-offline:$(date +%Y-%m-%d) [YOUR_IMAGE_NAME]\n```\n\nIf you would like to scan the image on your host machine, you need to mount `docker.sock`.\n\n```bash\n# Don't forget to pull before run\n$ docker pull quay.io/sighup/trivy-offline\n$ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\\n    quay.io/sighup/trivy-offline python:3.4-alpine\n# or\n$ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\\n    quay.io/sighup/trivy-offline:$(date +%Y-%m-%d) python:3.4-alpine\n\n```\n\nPlease re-pull latest [`quay.io/sighup/trivy-offline`] if an error occurred.\n\n### CI Example - drone ci\n\nYou can scan your container images *(or anyone public available)* on drone ci. [See an example below](.drone.yml):\n\n```yaml\n---\nkind: pipeline\nname: example\n\nsteps:\n  - name: scan\n    image: quay.io/sighup/trivy-offline:latest\n    pull: always\n    commands:\n      - trivy image --skip-update python:3.4-alpine\n```\n\n### CI Example - gitlab ci\n\nYou can include [gitlab.yml](gitlab.yml) in your .gitlab-ci.yml.\n\nHere trivy is defined as a hidden job so it can be extended in any job in any stage any number of times in the same pipeline.\n\nYou can scan your own public/private container images *(or anyone public available)* on gitlab ci.\n\nBy default *CI_REGISTRY, CI_REGISTRY_USER \u0026 CI_REGISTRY_PASSWORD* are used to fetch private docker image if *TRIVY_AUTH_URL, TRIVY_USERNAME \u0026 TRIVY_PASSWORD* variables are not defined.\n\nIn this example, by default trivy will scan the docker image *(${CI_REGISTRY_IMAGE}/${CI_COMMIT_REF_NAME})* in the container registry of the repo for the branch pipeline is running for,\n\n```yaml\ninclude:\n  - remote: 'https://raw.githubusercontent.com/sighupio/trivy-offline/main/gitlab.yml'\n\ntrivy:\n  extends: .trivy\n  stage: scan\n```\n\nAnd, in this example we are passing the docker image manually.\n\n```yaml\ntrivy:\n  extends: .trivy\n  stage: scan\n  script:\n    - |\n      # node:alpine...\n      trivy image --skip-update node:alpine\n```\n### CI Example - circle ci\n\nYou can scan your container images *(or anyone public available)* on circle ci. [See an example below](.circleci/config.yml):\n\n```yaml\n  test:\n    docker:\n      - image: quay.io/sighup/trivy-offline:latest\n    steps:\n      - run:\n          name: Run Aquasec trivy scanner\n          command: trivy image --exit-code 0 --format json --output trivy-container-scanning-report.json --no-progress --skip-update python:3.4-alpine\n      - store_artifacts:\n          path: trivy-container-scanning-report.json\n          destination: trivy-container-scanning-report\n```\n\n[trivy]: https://github.com/aquasecurity/trivy\n[quay.io/sighup/trivy-offline]: https://quay.io/sighup/trivy-offline\n[`quay.io/sighup/trivy-offline`]: https://quay.io/sighup/trivy-offline\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsighupio%2Ftrivy-offline","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsighupio%2Ftrivy-offline","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsighupio%2Ftrivy-offline/lists"}