trivy-offline-vulnerability-scanning

Trivy Offline Vulnerability Scanning

This skill provides guidance on using Trivy, an open-source security scanner, to discover vulnerabilities in software dependencies using offline mode.

Overview

Trivy is a comprehensive vulnerability scanner that can analyze various targets including container images, filesystems, and dependency lock files. Offline scanning is crucial for:

• Air-gapped environments without internet access
• Reproducible security audits with fixed vulnerability databases
• Faster CI/CD pipelines avoiding network latency
• Compliance requirements for controlled environments

Why Offline Mode?

Challenges with Online Scanning

• Network dependency introduces failure points
• Database updates can cause inconsistent results across runs
• Slower execution due to download times
• Security policies may restrict external connections

Benefits of Offline Scanning

• Reproducibility: Same database = same results
• Speed: No network overhead
• Reliability: No external dependencies
• Compliance: Works in restricted environments

Trivy Database Structure

Trivy's vulnerability database consists of:

• trivy.db: SQLite database containing CVE information
• metadata.json: Database version and update timestamp

Database location: <cache-dir>/db/trivy.db

Offline Scanning Workflow

Step 1: Verify Database Existence

Before scanning, ensure the offline database is available:

import os
import sys

TRIVY_CACHE_PATH = './trivy-cache'

# Check for database file
db_path = os.path.join(TRIVY_CACHE_PATH, "db", "trivy.db")
if not os.path.exists(db_path):
    print(f"[!] Error: Trivy database not found at {db_path}")
    print("    Download database first with:")
    print(f"    trivy image --download-db-only --cache-dir {TRIVY_CACHE_PATH}")
    sys.exit(1)

Step 2: Construct Trivy Command

Key flags for offline scanning:

Flag	Purpose
fs <target>	Scan filesystem/file (e.g., package-lock.json)
--format json	Output in JSON format for parsing
--output <file>	Save results to file
--scanners vuln	Scan only for vulnerabilities (not misconfigs)
--skip-db-update	Critical: Do not update database
--offline-scan	Enable offline mode
--cache-dir <path>	Path to pre-downloaded database