From 8aa4c175aea6b2127febd38fe624ebb0277b70c7 Mon Sep 17 00:00:00 2001
From: librelad <librelad@digitalangels.vip>
Date: Thu, 16 Jul 2026 16:51:49 +0100
Subject: [PATCH] fix(trivy): scan in client mode against the running server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Standalone `docker exec trivy-service trivy image ...` opens the vuln-DB cache
the long-lived server already holds, failing with "cache may be in use by
another process: timeout" — so every scan silently returned [] (apps: 0 even on
vulnerable images). Point the exec'd client at the server (--server
http://localhost:4954, the container's fixed --listen port); the server owns the
DB, the client just submits the image. Verified against alpine:3.10.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 containers/trivy/scripts/trivy_scan.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/containers/trivy/scripts/trivy_scan.sh b/containers/trivy/scripts/trivy_scan.sh
index e7ee58c..c1ab637 100644
--- a/containers/trivy/scripts/trivy_scan.sh
+++ b/containers/trivy/scripts/trivy_scan.sh
@@ -54,10 +54,13 @@ trivyScanImageCves() {
     [ -n "$image" ] || { echo '[]'; return; }
     command -v jq >/dev/null 2>&1 || { echo '[]'; return; }
 
-    # Scan runs inside the server container, reusing its cached DB. --quiet keeps
-    # the progress spinner out of stdout; we only want CRITICAL..LOW findings.
+    # Scan in CLIENT mode against the running server (--server localhost:4954,
+    # the container's fixed --listen port). Standalone `trivy image` would try to
+    # open the vuln-DB cache the server already holds and fail with a cache-lock
+    # timeout; client mode leaves the DB to the server. --quiet keeps the
+    # progress spinner out of stdout; we only want CRITICAL..LOW findings.
     local raw
-    raw="$(dockerCommandRun "docker exec trivy-service trivy image --quiet --scanners vuln --format json --severity CRITICAL,HIGH,MEDIUM,LOW '$image'" 2>/dev/null)"
+    raw="$(dockerCommandRun "docker exec trivy-service trivy image --server http://localhost:4954 --quiet --scanners vuln --format json --severity CRITICAL,HIGH,MEDIUM,LOW '$image'" 2>/dev/null)"
     [ -n "$raw" ] || { echo '[]'; return; }
 
     printf '%s' "$raw" | jq -c '