Harbor Scanner Adapter for Trivy

The Harbor Scanner Adapter for Trivy is a service that translates the Harbor scanning API into Trivy commands and allows Harbor to use Trivy for providing vulnerability reports on images stored in Harbor registry as part of its vulnerability scan feature.

Harbor Scanner Adapter for Trivy is the default static vulnerability scanner in Harbor >= 2.2.

For compliance with core components Harbor builds the adapter service binaries into Docker images based on Photos OS (goharbor/trivy-adapter-photon), whereas in this repository we build Docker images based on Alpine (aquasec/harbor-scanner-trivy). There is no difference in functionality though.

TOC

• Version Matrix
• Deployment
• Configuration
• Documentation
• Troubleshooting
• Contributing

Version Matrix

The following matrix indicates the version of Trivy and Trivy adapter installed in each Harbor release.

Note: The version matrix is not exhaustive. For older versions please refer to https://github.com/aquasecurity/harbor-scanner-trivy

Deployment

In Harbor >= 2.0 Trivy can be configured as the default vulnerability scanner, therefore you can install it with the official Harbor Helm chart, where HARBOR_CHART_VERSION >= 1.4:

helm repo add harbor https://helm.goharbor.io

helm install harbor harbor/harbor \
  --create-namespace \
  --namespace harbor

The adapter service is automatically registered under the Interrogation Service in the Harbor interface and designated as the default scanner.

Configuration

Configuration of the adapter is done via environment variables at startup.

Documentation

• Architecture - architectural decisions behind designing harbor-scanner-trivy.
• Releases - how to release a new version of harbor-scanner-trivy.

Troubleshooting

Error: database error: --skip-db-update cannot be specified on the first run

If you set the value of the SCANNER_TRIVY_SKIP_UPDATE to true, make sure that you download the Trivy DB and mount it in the /home/scanner/.cache/trivy/db/trivy.db path.

Error: failed to list releases: Get https://api.github.com/repos/aquasecurity/trivy-db/releases: dial tcp: lookup api.github.com on 127.0.0.11:53: read udp 127.0.0.1:39070->127.0.0.11:53: i/o timeout

Most likely it's a Docker DNS server or network firewall configuration issue. Trivy requires internet connection to periodically download vulnerability database from GitHub to show up-to-date risks.

Try adding a DNS server to docker-compose.yml created by Harbor installer.

version: 2
services:
  trivy-adapter:
    # NOTE Adjust IPs to your environment.
    dns:
      - 8.8.8.8
      - 192.168.1.1

Alternatively, configure Docker daemon to use the same DNS server as host operating system. See DNS services section in the Docker container networking documentation for more details.

Error: failed to list releases: GET https://api.github.com/repos/aquasecurity/trivy-db/releases: 403 API rate limit exceeded

Trivy DB downloads from GitHub are subject to rate limiting. Make sure that the Trivy DB is mounted and cached in the /home/scanner/.cache/trivy/db/trivy.db path. If, for any reason, it's not enough you can set the value of the SCANNER_TRIVY_GITHUB_TOKEN environment variable (authenticated requests get a higher rate limit).

Contributing

Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests.

---

Harbor Scanner Adapter for Trivy is an Aqua Security open source project. Learn about our open source work and portfolio here.