homelab/stack
1
0
Fork 0
Code Issues 262 Pull Requests 2 Actions Packages Projects 1 Releases Wiki Activity

fix trivy: scan from registry with --image-src remote --insecure
Some checks failed
ci/woodpecker/push/infra-ci Pipeline was successful
Details
coverage 99% coverage
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/deploy Pipeline failed
Details

Browse Source 
Buildx DinD pushes images to the registry but doesn't load them
into the host Docker daemon. Trivy must pull from the registry
directly. Use --image-src remote to skip local Docker lookup and
--insecure to accept the self-signed Traefik TLS cert.
This commit is contained in:
kert
2026-03-22 12:58:51 -04:00
parent 4e195ec9e6
commit b834a88fb2
2 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.woodpecker/deploy.yml
View File

@@ -27,8 +27,6 @@ variables:
from_secret: registry_pass
- &trivy_scan
image: aquasec/trivy:latest
volumes:
- /run/user/1000/docker.sock:/var/run/docker.sock
- &diag_env
UV_PYTHON_PREFERENCE: only-system
UV_LINK_MODE: copy
@@ -73,7 +71,7 @@ steps:
- name: scan-notebooks
<<: *trivy_scan
commands:
- trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
-o notebooks-scan.json
"gitea.homelab.fhirworx.io/homelab/notebooks:sha-${CI_COMMIT_SHA:0:8}"
depends_on:
@@ -94,7 +92,7 @@ steps:
- name: scan-zotero
<<: *trivy_scan
commands:
- trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
-o zotero-scan.json
"gitea.homelab.fhirworx.io/homelab/zotero:sha-${CI_COMMIT_SHA:0:8}"
depends_on:
@@ -125,7 +123,7 @@ steps:
- name: scan-docs
<<: *trivy_scan
commands:
- trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
-o docs-scan.json
"gitea.homelab.fhirworx.io/homelab/docs:sha-${CI_COMMIT_SHA:0:8}"
depends_on:
@@ -146,7 +144,7 @@ steps:
- name: scan-api
<<: *trivy_scan
commands:
- trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
-o api-scan.json
"gitea.homelab.fhirworx.io/homelab/api:sha-${CI_COMMIT_SHA:0:8}"
depends_on:

8
.woodpecker/rebuild-all.yml
View File

@@ -14,8 +14,6 @@ variables:
from_secret: registry_pass
- &trivy_scan
image: aquasec/trivy:latest
volumes:
- /run/user/1000/docker.sock:/var/run/docker.sock
- &diag_env
UV_PYTHON_PREFERENCE: only-system
UV_LINK_MODE: copy
@@ -92,7 +90,7 @@ steps:
- name: scan-notebooks
<<: *trivy_scan
commands:
- trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
-o notebooks-scan.json
"gitea.homelab.fhirworx.io/homelab/notebooks:sha-${CI_COMMIT_SHA:0:8}"
depends_on:
@@ -101,7 +99,7 @@ steps:
- name: scan-zotero
<<: *trivy_scan
commands:
- trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
-o zotero-scan.json
"gitea.homelab.fhirworx.io/homelab/zotero:sha-${CI_COMMIT_SHA:0:8}"
depends_on:
@@ -110,7 +108,7 @@ steps:
- name: scan-api
<<: *trivy_scan
commands:
- trivy image --severity HIGH,CRITICAL --exit-code 0 --format json
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
-o api-scan.json
"gitea.homelab.fhirworx.io/homelab/api:sha-${CI_COMMIT_SHA:0:8}"
depends_on: