Fix container scan policy mount

2026-07-18 04:38:46 +02:00
parent 6a22fcd1f8
commit 84cfe0d339
2 changed files with 5 additions and 1 deletions
@@ -8,6 +8,7 @@ TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462
 CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
 PYTHON_CMD="${PYTHON_BIN:-python3}"
 IGNORE_FILE="$(mktemp)"
+CONTAINER_IGNORE_FILE="/tmp/geointel-trivy-ignore.txt"
 trap 'rm -f "$IGNORE_FILE"' EXIT

 case "$OUTPUT" in
@@ -42,13 +43,14 @@ docker run --rm \
 docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "$CACHE_DIR:/root/.cache/trivy" \
+  -v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro" \
  "$TRIVY_IMAGE" \
  image \
  --scanners vuln \
  --timeout 20m \
  --skip-version-check \
  --ignore-unfixed \
-  --ignorefile "$IGNORE_FILE" \
+  --ignorefile "$CONTAINER_IGNORE_FILE" \
  --severity HIGH,CRITICAL \
  --exit-code 1 \
  "$TARGET_IMAGE"