What is the principle of trivy?

[fighterhit]

What is the principle of trivy? For example, why can it detect the latest log4j2 vulnerability in the container image? Will it download the image, decompress and scan all the jar packages in the image?

[AndreyLevchenko]

Hi @fighterhit
Thank you for your interest and yes, you are correct

[fighterhit]

if image is found locally it will be scanned, otherwise Trivy works directly with remote docker registry.

Thanks @AndreyLevchenko ,I am curious about how the image is analyzed when it is in the remote registry. Is it downloaded layer by layer to the local and then analyzed after decompression?

[knqyf263]

Is it downloaded layer by layer to the local and then analyzed after decompression?

Yes

[fighterhit]

Is it downloaded layer by layer to the local and then analyzed after decompression?

Yes

Thanks @knqyf263 , since it has been downloaded, why can't I see it when I use docker images? Was it deleted after the scan was completed?

[knqyf263]

Trivy downloads layers directly without Docker Engine. Each layer is processed in memory.

[fighterhit]

Trivy downloads layers directly without Docker Engine. Each layer is processed in memory.

Got it @knqyf263 , thanks!