Trivy: Scan alpine image in air-gapped environments

[knqyf263]

It doesn't work in the case of scanning an alpine image.
https://github.com/aquasecurity/trivy/blob/master/docs/air-gap.md

[dmpe]

Jop, I saw it as well on my end. Among the possibilities would be to bundle offline DB with docker image, including alpine archive db. Probably sizing and licensing will play a role.

[andrebreves]

I'm running the containerized version of trivy using --network none to make sure it's air-gaped, and I'm getting this message in the logs:

2020/11/12 19:21:51 failed to fetch APKINDEX archive: Get "https://raw.githubusercontent.com/knqyf263/apkIndex-archive/master/alpine/v3.10/main/x86_64/history.json": dial tcp: lookup raw.githubusercontent.com on 192.168.65.1:53: dial udp 192.168.65.1:53: connect: network is unreachable

Is it related to this issue? I could't find the source of the message in the source code. Do you have any direction?

The scanning does't fail and some vulnerabilities are detected, but I guess I can assume that not all vulnerabilities are being detected, right?

Please let me know if there is anything I could do to help fixing this issue.

[andrebreves]

I finally found the module that was trying to download the apkIndex by using the github search.

I tried to workaround this issue by downloading the apkIndex and passing FANAL_APK_INDEX_ARCHIVE_URL=file://... to the trivy container, but it seems this fix has not arrived to trivy:0.12.0 yet.

I finally was able to workaround this issue by:

• Building a image with both trivy-db and apkindex-archive downloaded content
• Installing nginx inside the image to serve the apkIndex content to fanal
• Pointing fanal to nginx by setting the environment variable FANAL_APK_INDEX_ARCHIVE_URL=http://127.0.0.1:8080/alpine/v%s/main/x86_64/history.json
• Running the container with --network none to make sure it's really air-gapped

Here's my Dockerfile to the air-gap trivy image:

FROM aquasec/trivy:0.12.0

ADD https://github.com/aquasecurity/trivy-db/releases/latest/download/trivy-offline.db.tgz \
    https://github.com/knqyf263/apkindex-archive/archive/master.zip \
    /root/

RUN mkdir -p /root/.cache/trivy/db && \
    tar xvzf /root/trivy-offline.db.tgz -C /root/.cache/trivy/db && \
    unzip /root/master.zip -d /root && \
    rm /root/trivy-offline.db.tgz /root/master.zip && \
    apk add --no-cache nginx && \
    chmod a+r+x /root && \
    printf 'pid /tmp/nginx.pid;\n\
            events {}\n\
            http {server {listen 8080; location / {root /root/apkindex-archive-master;}}}' \
            > /etc/nginx/nginx.conf && \
    printf '#!/usr/bin/env sh\n\
            nginx && exec trivy "$@"'\
            > /root/entrypoint.sh && \
    chmod a+x /root/entrypoint.sh

ENV FANAL_APK_INDEX_ARCHIVE_URL=http://127.0.0.1:8080/alpine/v%s/main/x86_64/history.json \
    TRIVY_SKIP_UPDATE=TRUE

ENTRYPOINT ["/root/entrypoint.sh"]

When the version of fanal supporting file://... arrives to trivy, I will be able to remove the nginx part.