Trivy in client-server mode for scanning runtime fs

[tschroeder13]

Hey community,
pls let me brielfy describe my idea:
I'd like to scan the filesystem on multiple servers with a trivy client server setup. The server shall run from a docker compose and the client binary is distributed via network filesystem.

This is the docker-compose.yml

version: "2"
services:
  trivy:
    image: docker.io/aquasec/trivy:latest
    command: server --listen 0.0.0.0:8082 --debug --insecure
    ports:
      - "8082:8082"
    volumes:
      - $HOME/Library/Caches:/root/.cache/
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - HTTP_PROXY=<some proxy>
      - HTTPS_PROXY=<some proxy>
      - NO_PROXY="localhost,127.0.0.1"
      - TRIVY_INSECURE=true

When starting as root it logs:

# docker compose up
[+] Running 1/0
 ⠿ Container trivy-trivy-1  Created                                                                                                                                                                         0.0s
Attaching to trivy-trivy-1
trivy-trivy-1  | 2024-07-02T15:36:28Z   DEBUG   Cache dir       dir="/root/.cache/trivy"
trivy-trivy-1  | 2024-07-02T15:36:28Z   DEBUG   Initializing scan cache...      type="fs"
trivy-trivy-1  | 2024-07-02T15:36:28Z   DEBUG   DB update was skipped because the local DB is the latest
trivy-trivy-1  | 2024-07-02T15:36:28Z   DEBUG   DB info schema=2 updated_at=2024-07-02T12:12:03.508479273Z next_update=2024-07-02T18:12:03.508478902Z downloaded_at=2024-07-02T15:04:53.474322832Z
trivy-trivy-1  | 2024-07-02T15:36:28Z   INFO    Listening 0.0.0.0:8082...

Now I run the client with:

trivy fs --server  <server above>:8082 --format cyclonedx --output <out path>.cdx.json /<scan path>

and the server logs:

trivy-trivy-1  | 2024-07-02T15:20:32Z   DEBUG   Failed to get Java DB metadata  err="unable to open a file: open /root/.cache/trivy/java-db/metadata.json: no such file or directory"
trivy-trivy-1  | 2024-07-02T15:20:32Z   DEBUG   Failed to open the check metadata       err="open /root/.cache/trivy/policy/metadata.json: no such file or directory"
trivy-trivy-1  | 2024-07-02T15:20:32Z   DEBUG   Failed to get policy metadata   err="open /root/.cache/trivy/policy/metadata.json: no such file or directory"
trivy-trivy-1  | 2024-07-02T15:20:43Z   DEBUG   OS is not detected.
trivy-trivy-1  | 2024-07-02T15:20:43Z   DEBUG   Detected OS: unknown
trivy-trivy-1  | 2024-07-02T15:20:43Z   INFO    Number of language-specific files       num=0

What do I miss?

Thanks for any hints and best regards
Tobias

[simar7]

This looks to me like a disk permission issue with your server not being able to download the required assets for it to function. Do you have the full logs for the server that can shed more light?

[tschroeder13]

hey @simar7 ,
you were right I'd suppose. I modified the cache volume and it works now

...
    volumes:
      - /var/lib/docker/volumes/Library/Caches:/root/.cache/
...

thx