Skip to content
This repository has been archived by the owner on Sep 20, 2024. It is now read-only.

Allow image layer cache (fanal.db) to be stored in Redis #405

Open
twhiteman opened this issue Nov 17, 2023 · 2 comments
Open

Allow image layer cache (fanal.db) to be stored in Redis #405

twhiteman opened this issue Nov 17, 2023 · 2 comments

Comments

@twhiteman
Copy link

The trivy adapter instance will cache image layer metadata (OS, packages, libraries, etc...) by the image layer id, storing that data in the fanal.db on the local filesystem.

I'd like to store that image layer cache in Redis, so that this information can be shared between all trivy adapter instances.

The reasoning is that for scaling of the trivy adapter, it is counter-productive to have each trivy instance perform it's own caching of image layers (as this image layer scan can be both CPU and network intensive - as it has to download the image layer, uncompress and process the files in the image layer). Once an image layer is scanned, that image layer scan should not need to occur again.

@twhiteman
Copy link
Author

It looks like the Trivy server supports this, as the trivy CLI shows:

$ /usr/local/bin/trivy --help

Cache Flags
      --cache-backend string   cache backend (e.g. redis://localhost:6379) (default "fs")
      --cache-ttl duration     cache TTL when using redis as cache backend
      --clear-cache            clear image caches without scanning
      --redis-ca string        redis ca file location, if using redis as cache backend
      --redis-cert string      redis certificate file location, if using redis as cache backend
      --redis-key string       redis key file location, if using redis as cache backend

@Ais8Ooz8
Copy link

@twhiteman It seems that --cache-backend is a flag for the trivy server command, but does not work for the trivy scan command. But it would be really useful in the context of the adapter:

The Redis backend is particularly useful when you need to share the cache across multiple Trivy instances.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants