How to package trivy vulnerability database to docker image

[nistal97]

Hello team, we would like to use trivy to scan image in CI/CD pipeline, and seems in a clean env trivy will download vuln database for the first time.
To reduce time cost, is it possible to package database file into docker image so it runs everytime without downloading db?
Thanks.

[itaysk]

it seems that you are looking for this? https://aquasecurity.github.io/trivy/v0.36/docs/advanced/air-gap/

[lchunleo]

i am trying to scan the image with trivy with docker. refers to the link, i understand i need to download the trivy db and do the scan. however i am lost where to mount the db to. can advise with the full docker run command as an example?

[itaysk]

we're in the process of improving the docs around this, the PR still hasn't merged but you can see the gist of it here: https://github.com/aquasecurity/trivy/pull/7732/files