Download vulnerability DB from a mirror?

[chrisnielsen-MS]

Question

My team is working on running Trivy at a relatively large scale and we have starting seeing this error:

2024-10-15T10:21:05Z  FATAL  Fatal error  init error: DB error: failed to download vulnerability DB: database download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:8dcb18f131bc5d8d17159f7682ebd49b2ea9c784edbb03aa87fe92927ff1d851: TOOMANYREQUESTS: retry-after: 1.146525ms, allowed: 44000/minute

Is there a way we could host an updated database in a mirror somewhere for these downloads so they don't get throttled like this?

Target

Filesystem

Scanner

Vulnerability

Output Format

SARIF

Mode

Standalone

Operating System

No response

Version

Version: 0.55.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-09-26 18:14:56.167559258 +0000 UTC
  NextUpdate: 2024-09-27 00:14:56.167559118 +0000 UTC
  DownloadedAt: 2024-09-26 19:56:59.5102756 +0000 UTC

[simar7]

hi @chrisnielsen-MS yes you can pass the --db-repository option. See here for more details #7699