You must manually download the vulnerability database for use in air-gapped environments. Go to trivy-db and download trivy-offline.db.tgz
in the latest release. If you download trivy-light-offline.db.tgz
, you have to run Trivy with --light
option.
wget https://github.com/aquasecurity/trivy-db/releases/latest/download/trivy-offline.db.tgz
bosh -d <HARBOR_SERVICE_INSTANCE> scp ~/Downloads/trivy-offline.db.tgz harbor-app/<UUID>:/tmp/trivy-offline.db.tgz
Issue commands similar to the following:
bosh -d <HARBOR_SERVICE_INSTANCE> ssh harbor-app/<UUID>
sudo -i
mkdir -p /var/vcap/store/harbor/trivy-adapter/trivy/db/
mv /tmp/trivy-offline.db.tgz
/var/vcap/store/harbor/trivy-adapter/trivy/db/trivy-offline.db.tgz
cd /var/vcap/store/harbor/trivy-adapter/trivy/db/
tar xvf trivy-offline.db.tgz
rm trivy-offline.db.tgz
chown 10000:10000 -R /data/trivy-adapter/trivy/db
chmod 700 /data/trivy-adapter/trivy/db $ chmod 644 /data/trivy-adapter/trivy/db/*
Note: In an air-gapped environment it is your responsibility to update the Trivy database on a regular basis, so that the scanner can detect recently-identified vulnerabilities.
In an air-gapped environment, specify --skip-update so that Trivy doesn't attempt to download the latest database file:
trivy image --skip-update alpine:3.12