trivy scan local filesystem not supported in client mode

[genknife]

trivy should support scan local filesystem using client mode
THX

[knqyf263]

What is your use case?

[nayroben]

Hello,
This would indeed be useful to us as well.
Our use case actually follows from the db download rate's limitation... The scanner is used inside pipelines building docker images and we were thinking about hosting the db into a remote server and use the client/server approach to scan the image while creating it (filesystem mode).
Many Thanks

[knqyf263]

@nayroben In that case, can't you use trivy client? After building a docker image, you can scan the image with trivy client.

[nayroben]

In our case, we are actually interested in not building the image (for various reasons...) if trivy scans (among other checks) fail. Building the image, pushing it to a registry, scanning it afterwards and then deleting it/throwing errors if scan failed would be in theory possible, but being able to use filesystem + client/server approach directly in trivy would make our life much easier and would be a much smoother process.
Thanks

[strowi]

Same here. I think it would be very useful to allow the "--remote" option for all scan options repo, fs, etc. to reduce dependency on github/external sources.
Currently we run a trivy server and scan the resulting container image, but until then the container as been built, and other checks run in the same stage. Stopping the pipeline as early as possibe will save resources.

[github-actions]

This issue is stale because it has been labeled with inactivity.

[Johannestegner]

I use trivy as a "scan all the things!" tool in my CI scripts. So I as well use the filesystem scan alot. Now, my ci scripts caches the database, and its quite small, but it would ofc be preferable to use a remote instance (which I have and use for my container images).

I do understand why this might be a bit more of an issue than just toggling a switch, but it would be a very nice feature if implemented :)

[JafarAkhondali]

any updates on this? It really is a great feature to support a local server for all scan types

[malexmave]

Agreed - it would also be extremely helpful for a project of mine, where I want to scan a large number of repos for vulnerabilities on a regular basis, and don't want to download the ruleset a couple hundred times every time I go through them. Scheduling a server as a k8s service and then having all the trivy instances retrieve the rulesets from it would be the most elegant solution for this issue (everything else requires downloading the rules and mounting them as a kubernetes secret, which is really annoying to keep up to date).