Trivy: Server / Client: localhost should accept remote connexions

[kalioz]

Description
When using the feature server / client, it works perfectly when both are on the same host. when the server is on another host (in my case, a kubernetes Pod behind a service) you cannot set the server to listen on localhost:8080 as then the client will be received with a connexion refused.

server command : trivy server --listen localhost:8080 (behind a k8s service trivy-server:8080)
client command : trivy client --remote http://trivy-server:8080 alpine

To test it simply I used a simple curl on trivy-server (expect a 404 page if it works, but get connexion refused).
With some testing (localhost, 127.0.0.1, serviceName...) I found out the only way to have it accept remote connexions was to set the server to listen to :8080

this works :
server command : trivy server --listen :8080 (behind a k8s service trivy-server:8080)
client command : trivy client --remote http://trivy-server:8080 alpine

From looking at the code this is expected behaviour for http.ListenAndServe (see also https://stackoverflow.com/a/40063258).

As this is not something to expect when setting up a server on 'localhost', could there either be a warning in the code so that the user knows which syntax to use ? alternatively it could be possible to replace the localhost / 127.0.0.1 so that it actually listen to the port on all interfaces.

If this is something that interest you I can make the relative changes in a PR, I just don't know which solution would be best security and UX-wise.

In all cases I think this should be mentionned in the README, as users without a background in go will take some time to understand why the server only works on localhost :)

Output of trivy -v:

trivy version 0.3.1

[knqyf263]

localhost means it rejects the connection from outside.

How about 0.0.0.0:8080?

$ trivy server --listen 0.0.0.0:8080