GitLab CI

    To scan a previously built image that has already been pushed into the GitLab container registry the following CI job manifest can be used. Note that needs to be unset for the script section to work. In case of a non-public GitLab project Trivy additionally needs to authenticate to the registry to be able to pull your application image. Finally, it is not necessary to clone the project repo as we only work with the container image.

    1. container_scanning:
    2.   image:
    3.     name: docker.io/aquasec/trivy:latest
    4.     entrypoint: [""]
    5.   variables:
    6.     # No need to clone the repo, we exclusively work on artifacts.  See
    7.     # https://docs.gitlab.com/ee/ci/runners/README.html#git-strategy
    8.     GIT_STRATEGY: none
    9.     TRIVY_USERNAME: "$CI_REGISTRY_USER"
    10.     TRIVY_PASSWORD: "$CI_REGISTRY_PASSWORD"
    11.     FULL_IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
    12.   script:
    13.     - trivy --version
    14.     # cache cleanup is needed when scanning images with the same tags, it does not remove the database
    15.     - time trivy image --clear-cache
    16.     # update vulnerabilities db
    17.     - time trivy --download-db-only --no-progress --cache-dir .trivycache/
    18.     # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there
    19.     - time trivy --exit-code 0 --cache-dir .trivycache/ --no-progress --format template --template "@/contrib/gitlab.tpl"
    20.         --output "$CI_PROJECT_DIR/gl-container-scanning-report.json" "$FULL_IMAGE_NAME"
    21.     # Prints full report
    22.     # Fails on high and critical vulnerabilities
    23.     - time trivy --exit-code 1 --cache-dir .trivycache/ --severity CRITICAL --no-progress "$FULL_IMAGE_NAME"
    24.   cache:
    25.     paths:
    26.       - .trivycache/
    27.   # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold)
    28.   artifacts:
    29.     when:                          always
    30.     reports:
    31.       container_scanning:          gl-container-scanning-report.json
    32.   tags: