fix scan: trivy scans local Docker images, not registry

Root cause analysis (5 whys):
1. Trivy scan fails → can't pull image from gitea:3000
2. Can't resolve gitea → docker run trivy creates a sibling
   container that inherits host DNS, not Docker network DNS
3. Host DNS can't resolve gitea → host is not on any Docker network
4. Why use the registry at all? → we already have the image locally
5. Why not scan local images? → no reason not to

Fix: install trivy as a native binary in the job container,
scan local/NAME:build which exists in the host daemon's image
store (accessible via the mounted Docker socket). No registry
pull, no DNS resolution, no Docker-in-Docker.

Complete daemonless registry architecture:
- docker build: host socket (local build, no registry)
- crane push: job container DNS (daemonless push to gitea:3000)
- trivy scan: local Docker images (no registry pull)

.gitea/workflows/deploy.yml

@@ -79,44 +79,20 @@ jobs:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
-      - name: Compute short SHA
+      - name: Install trivy
-        run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
 
       - name: Scan notebooks
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}
 
       - name: Scan zotero
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}
 
       - name: Scan docs
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}
 
       - name: Scan api
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}
 
       - name: Upload scan results
         uses: https://github.com/actions/upload-artifact@v4

.gitea/workflows/harden.yml

@@ -77,41 +77,20 @@ jobs:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
+      - name: Install trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
       - name: Scan notebooks
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/notebooks:hardened
 
       - name: Scan zotero
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/zotero:hardened
 
       - name: Scan docs
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/docs:hardened
 
       - name: Scan api
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/api:hardened
 
       - name: Upload scan results
         uses: https://github.com/actions/upload-artifact@v4

.gitea/workflows/rebuild-all.yml

@@ -78,44 +78,20 @@ jobs:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
-      - name: Compute short SHA
+      - name: Install trivy
-        run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
 
       - name: Scan notebooks
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}
 
       - name: Scan zotero
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}
 
       - name: Scan docs
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}
 
       - name: Scan api
-        run: >-
+        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity HIGH,CRITICAL --exit-code 0
-          --format json -o /dev/null
-          gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}
 
       - name: Upload scan results
         uses: https://github.com/actions/upload-artifact@v4

dev/scripts/backends/gitea.py

@@ -75,24 +75,27 @@ def _build_push_step(
     return lines
 
 
+def _install_trivy_step() -> str:
+    """Install trivy as a native binary — no Docker-in-Docker needed."""
+    return """\
+      - name: Install trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin"""
+
+
 def _trivy_step(
     img: dict,
     tag: str,
     registry: str,
     owner_repo: str,
 ) -> str:
+    """Scan local Docker image — no registry pull, no DNS resolution."""
     name = img["name"]
+    local_tag = f"local/{name}:build"
     sev = img.get("trivy_severity", "HIGH,CRITICAL")
     ec = img.get("trivy_exit_code", 0)
     return f"""\
       - name: Scan {name}
-        run: >-
+        run: trivy image --severity {sev} --exit-code {ec} --format json -o {name}-scan.json {local_tag}"""
-          docker run --rm
-          -v /var/run/docker.sock:/var/run/docker.sock
-          ghcr.io/aquasecurity/trivy:latest image
-          --severity {sev} --exit-code {ec}
-          --format json -o /dev/null
-          {registry}/{owner_repo}/{name}:{tag}"""
 
 
 def _upload_artifact_step(name: str, path: str) -> str:
@@ -223,8 +226,7 @@ jobs:
     steps:
 {_checkout_step()}
 
-      - name: Compute short SHA
+{_install_trivy_step()}
-        run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
 {scan_block}
 
@@ -313,6 +315,8 @@ jobs:
     steps:
 {_checkout_step()}
 
+{_install_trivy_step()}
+
 {scan_block}
 
       - name: Upload scan results
@@ -404,8 +408,7 @@ jobs:
     steps:
 {_checkout_step()}
 
-      - name: Compute short SHA
+{_install_trivy_step()}
-        run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
 {scan_block}