ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-04 02:04:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(image): honour TRIVY_CACHE_DIR when it is set (#12773)

Browse Source 
Co-authored-by: pedrooot <pedromarting3@gmail.com>
This commit is contained in:
César Arroba
2026-09-09 17:00:50 +02:00
committed by GitHub
co-authored by pedrooot
parent bbf5e1fa9f
commit c71f226e5c
4 changed files with 66 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/user-guide/providers/image/getting-started-image.mdx
+23
View File
@@ -96,6 +96,29 @@ Install Trivy using one of the following methods:
For additional installation methods, see the [Trivy installation guide](https://trivy.dev/latest/getting-started/installation/).
### Vulnerability Database Cache
<VersionBadge version="5.42.0" />
Trivy keeps its vulnerability database in a cache directory. By default Prowler gives it a temporary one and removes it when the scan ends, so the database is downloaded again for every scan.
Set `TRIVY_CACHE_DIR` to a directory that persists and the database is downloaded once and reused:
```bash
export TRIVY_CACHE_DIR="$HOME/.cache/trivy"
prowler image --image <image>
```
Prowler never deletes a directory you supply. Trivy still creates and updates its cache and database files inside it.
<Note>
A host with no internet access needs a pre-populated vulnerability database in a persistent directory, with `TRIVY_CACHE_DIR` pointing at it. Populate the directory on a machine that does have access and copy it across.
Trivy tries to refresh the database when it considers it stale, and that download fails without network access. Set `TRIVY_SKIP_DB_UPDATE=true` (and `TRIVY_SKIP_JAVA_DB_UPDATE=true` if Java scanning is enabled) so it uses the supplied database as is.
The database ages. A scan run against an old one reports only the vulnerabilities known when it was built, and nothing in the output says so, so keep track of when it was last refreshed.
</Note>
### Supported Scanners