Repository files navigation

The HarborScanner Adapter forTrivy is a service that translates theHarbor scanningAPI into Trivy commands and allows Harbor to use Trivy for providing vulnerability reports on images stored in Harborregistry as part of its vulnerability scan feature.

Harbor Scanner Adapter for Trivy is the default static vulnerability scanner in Harbor >= 2.2.

For compliance with core components Harbor builds the adapter service binaries into Docker images based on Photos OS(goharbor/trivy-adapter-photon), whereas in this repository we build Docker images based on Alpine(aquasec/harbor-scanner-trivy). There is no difference in functionality though.

• Version Matrix
• Deployment
  • Harbor >= 2.0 on Kubernetes
  • Harbor 1.10 on Kubernetes
• Configuration
• Documentation
• Troubleshooting
• Contributing

The following matrix indicates the version of Trivy and Trivy adapter installed in each Harborrelease.

In Harbor >= 2.0 Trivy can be configured as the default vulnerability scanner, therefore you can install it with theofficialHarbor Helm chart, whereHARBOR_CHART_VERSION >= 1.4:

helm repo add harbor https://helm.goharbor.io

helm install harbor harbor/harbor \  --create-namespace \  --namespace harbor

The adapter service is automatically registered under theInterrogation Service in the Harbor interface anddesignated as the default scanner.

1. Install theharbor-scanner-trivy chart:

   helm repo add aqua https://aquasecurity.github.io/helm-charts

   helm install harbor-scanner-trivy aqua/harbor-scanner-trivy \  --namespace harbor --create-namespace

2. Configure the scanner adapter in the Harbor interface.

   1. Navigate toInterrogation Services and click+ NEW SCANNER.
   2. Enterhttp://harbor-scanner-trivy.harbor:8080 as theEndpoint URL and clickTEST CONNECTION.
   3. If everything is fine clickADD to save the configuration.

3. Select theTrivy scanner and set it as default by clickingSET AS DEFAULT.Make sure theDefault label is displayed next to theTrivy scanner's name.

Configuration of the adapter is done via environment variables at startup.

• Architecture - architectural decisions behind designing harbor-scanner-trivy.
• Releases - how to release a new version of harbor-scanner-trivy.

If you set the value of theSCANNER_TRIVY_SKIP_UPDATE totrue, make sure that you download theTrivy DBand mount it in the/home/scanner/.cache/trivy/db/trivy.db path.

Most likely it's a Docker DNS server or network firewall configuration issue. Trivy requires internet connection toperiodically download vulnerability database from GitHub to show up-to-date risks.

Try adding a DNS server todocker-compose.yml created by Harbor installer.

version:2services:trivy-adapter:# NOTE Adjust IPs to your environment.dns:      -8.8.8.8      -192.168.1.1

Alternatively, configure Docker daemon to use the same DNS server as host operating system. SeeDNS servicessection in the Docker container networking documentation for more details.

Trivy DB downloads from GitHub are subject torate limiting. Make sure that the Trivy DB is mountedand cached in the/home/scanner/.cache/trivy/db/trivy.db path. If, for any reason, it's not enough you can set thevalue of theSCANNER_TRIVY_GITHUB_TOKEN environment variable (authenticated requests get a higher rate limit).

Please readCONTRIBUTING.md for details on our code of conduct, and the process for submitting pullrequests.

Harbor Scanner Adapter for Trivy is anAqua Security open source project.
Learn about our open source work and portfoliohere.