containers/trivy/scripts/trivy_scan.sh

@@ -54,13 +54,10 @@ trivyScanImageCves() {
     [ -n "$image" ] || { echo '[]'; return; }
     command -v jq >/dev/null 2>&1 || { echo '[]'; return; }
 
-    # Scan in CLIENT mode against the running server (--server localhost:4954,
-    # the container's fixed --listen port). Standalone `trivy image` would try to
-    # open the vuln-DB cache the server already holds and fail with a cache-lock
-    # timeout; client mode leaves the DB to the server. --quiet keeps the
-    # progress spinner out of stdout; we only want CRITICAL..LOW findings.
+    # Scan runs inside the server container, reusing its cached DB. --quiet keeps
+    # the progress spinner out of stdout; we only want CRITICAL..LOW findings.
     local raw
-    raw="$(dockerCommandRun "docker exec trivy-service trivy image --server http://localhost:4954 --quiet --scanners vuln --format json --severity CRITICAL,HIGH,MEDIUM,LOW '$image'" 2>/dev/null)"
+    raw="$(dockerCommandRun "docker exec trivy-service trivy image --quiet --scanners vuln --format json --severity CRITICAL,HIGH,MEDIUM,LOW '$image'" 2>/dev/null)"
     [ -n "$raw" ] || { echo '[]'; return; }
 
     printf '%s' "$raw" | jq -c '