aquasecurity
feat: Update registry fallbacks
Description
Adds public ECR registry as a fallback for both vuln-db and java-db.
Related PRs
- [x] https://github.com/aquasecurity/trivy/pull/7605/
Checklist
- [x] I've read the guidelines for contributing to this repository.
- [x] I've followed the conventions in the PR title.
- [x] I've added tests that prove my fix is effective or that my feature works.
- [x] I've updated the documentation with the relevant information (if needed).
- [ ] I've added usage information (if the PR introduces new options)
- [ ] I've included a "before" and "after" example to the description (if the PR is a user interface change).
We should document how to authenticate with ECR. Otherwise, ECR Public has only 500 GB free tier for anonymous users. Also, it's calculated by IP address. I suppose we'll run out of the free tier on CI service as it shares IP addresses.
I'm worried about adding ecr as the default registry.
I think most users will ignore the authentication recommendation, and some users just don't read the docs.
Instead of adding ecr - I suggest adding warning if downloading db from ghcr returns error.
We will show information about using ecr (with authentication information) + link to the docs.
We read the docs but... having to authenticate to aws would be a breaking change 🥹
hello @nvuillam Authentication is necessary to preserve aws limits for unauthenticated users as much as possible. But we don't require it. We just ask users to do it if possible - it will help avoid rate limiting errors like ghcr.io.
We should document how to authenticate with ECR. Otherwise, ECR Public has only 500 GB free tier for anonymous users. Also, it's calculated by IP address. I suppose we'll run out of the free tier on CI service as it shares IP addresses.
Yes - I wanted to add more info on this topic. Added https://github.com/aquasecurity/trivy/pull/7679/commits/fa031898ebd2d39009e6bace47b288595793a6d7
We will show information about using ecr (with authentication information) + link to the docs.
I'm also leaning toward this approach. I'm afraid that users downloading container images from ECR Public (e.g., Kubernetes cluster) may suddenly reach rate limits due to Trivy DB and be unable to deploy, etc.
Of course, it is best if users can continue to use DBs as before without being aware of it, but the implicit use of ECR Public may have other negative effects. We should be careful about the use of ECR Public. If users explicitly set this up, they will understand these trade-offs.
We will show information about using ecr (with authentication information) + link to the docs.
I'm also leaning toward this approach. I'm afraid that users downloading container images from ECR Public (e.g., Kubernetes cluster) may suddenly reach rate limits due to Trivy DB and be unable to deploy, etc.
Yes but the same can be said for GHCR today.
Of course, it is best if users can continue to use DBs as before without being aware of it, but the implicit use of ECR Public may have other negative effects. We should be careful about the use of ECR Public. If users explicitly set this up, they will understand these trade-offs.
I added some docs here.
Ultimately we can reach rate limits even with authenticated use of container registries. The fallback to using a secondary registry only mitigates the risk up to an extent.
Yes but the same can be said for GHCR today.
The rate limits in GHCR are on the organization, not the user, unlike ECR Public. In other words, heavy use of GHCR may make aquasecurity images unavailable, but not other images. Users may not be able to use Trivy, but they will be able to pull any other images except aquasecurity.
checks bundle also needs ecr.
env:
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
TRIVY_CHECKS_BUNDLE_REPOSITORY: public.ecr.aws/aquasecurity/trivy-checks
The trivy.dbRepository parameter in the helm/trivy/values.yaml file also needs to be updated.
The
trivy.dbRepositoryparameter in thehelm/trivy/values.yamlfile also needs to be updated.
thanks for the good idea. it should be add after the PR is merged and released.
@simar7 Now trivy-db pushes the database to Docker Hub: https://github.com/aquasecurity/trivy-db/pull/448 maybe it makes sense to add Docker Hub as a default repository too? just idea. thanks!
mirror.gcr.io seems the best for our use case. Please let us know if anyone knows about rate limits on that.
https://github.com/aquasecurity/trivy/discussions/7538#discussioncomment-11258881
I see 8 incorrect mentions of public.ecr.aws/aquasecurity/trivy-db:1 which should be trivy-java-db !
