Root cause analysis (5 whys):
1. Trivy scan fails → can't pull image from gitea:3000
2. Can't resolve gitea → docker run trivy creates a sibling
container that inherits host DNS, not Docker network DNS
3. Host DNS can't resolve gitea → host is not on any Docker network
4. Why use the registry at all? → we already have the image locally
5. Why not scan local images? → no reason not to
Fix: install trivy as a native binary in the job container,
scan local/NAME:build which exists in the host daemon's image
store (accessible via the mounted Docker socket). No registry
pull, no DNS resolution, no Docker-in-Docker.
Complete daemonless registry architecture:
- docker build: host socket (local build, no registry)
- crane push: job container DNS (daemonless push to gitea:3000)
- trivy scan: local Docker images (no registry pull)
bbc1c5431f
