Reduce internet traffic

[AvdeevArtem]

Hello. I use trivy-operator and it uses a lot of outbound traffic to internet because every time when scan job runs it ALWAYS updating vulnerability database. I read Readme in https://github.com/aquasecurity/trivy-db repo and I saw that it automatically update vulnerability database in trivy-db image(this workflow does it).
trivy-operator in my configuration is in a standalone mode. For reducing outbound traffic I've already cached image public.ecr.aws/aquasecurity/trivy-db:2 on my nodes and use VPC Endpoint to ECR(This is AWS feature to reduces internet traffic)
Is it possible not to update vulnerability db every time?(I can't override it there

trivy-operator version - [v0.26.1](https://github.com/aquasecurity/trivy-operator/releases/tag/v0.26.1)
kubernetes version - 1.32
trivy version - 0.62.1
command for scanning - filesystem (it's reduce outbound traffic neither, because scan job run exactly where it detected new image and use node images local cache)

This is scan job init container logs.

scan-vulnerabilityreport-58cd6b6f75-s7s4c 2025-05-28T05:29:01.286214913Z 2025-05-28T05:29:01Z	INFO	[vulndb] Need to update DB
scan-vulnerabilityreport-58cd6b6f75-s7s4c 2025-05-28T05:29:01.286272324Z 2025-05-28T05:29:01Z	INFO	[vulndb] Downloading vulnerability DB...
scan-vulnerabilityreport-58cd6b6f75-s7s4c 2025-05-28T05:29:01.286279414Z 2025-05-28T05:29:01Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
scan-vulnerabilityreport-58cd6b6f75-s7s4c 2025-05-28T05:29:13.264834920Z 13.02 MiB / 64.37 MiB [------------>________________________________________________] 20.23% ? p/s ?25.73 MiB / 64.37 MiB [------------------------>____________________________________] 39.97% ? p/s ?37.17 MiB / 64.37 MiB [----------------------------------->_________________________] 57.75% ? p/s ?48.42 MiB / 64.37 MiB [------------------------------------>___________] 75.23% 60.10 MiB p/s ETA 0s57.42 MiB / 64.37 MiB [------------------------------------------>_____] 89.21% 60.10 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 60.10 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 57.93 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 57.93 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 57.93 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 54.19 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 54.19 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 54.19 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 50.70 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 50.70 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 50.70 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 47.43 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 47.43 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 47.43 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 44.37 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 44.37 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 44.37 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 41.50 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 41.50 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 41.50 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 38.83 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 38.83 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 38.83 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 36.32 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 36.32 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 36.32 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 33.98 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 33.98 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 33.98 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 31.79 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 31.79 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 31.79 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 29.73 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 29.73 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 29.73 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 27.82 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 27.82 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 27.82 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 26.02 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 26.02 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 26.02 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 24.34 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 24.34 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 24.34 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 22.77 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 22.77 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 22.77 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 21.30 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 21.30 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 21.30 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------->] 100.00% 19.93 MiB p/s ETA 0s64.37 MiB / 64.37 MiB [---------------------------------------------------] 100.00% 5.93 MiB p/s 11s2025-05-28T05:29:13Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"

Can you give me advice how to reduce outbound traffic for that?
if it updates trivy-db every 6 hours why we should download db every time?
Thank you!

[simar7]

hi @AvdeevArtem - thanks for the question. I think we need to rethink the strategy of how the db is used today. As you mentioned it's redownloaded each time, which is quite wasteful as the DB doesn't update more than every 6 hours.

@afdesk and I will think about potential ways to solve this. We can keep this discussion open to discuss that.

[afdesk]

right, initContainer updates trivy-db, and a container doesn't do it:

[AvdeevArtem]

wait, this --skip-db-update not for init container, this is for container who run scanner
but init container use --download-db-only and this is update database

[afdesk]

exactly! so if we add --skip-db-update for init container, how will we deliver the db?

[AvdeevArtem]

I can explain how it's works, correct me if i'm not right
First of all this job create empty dir volume

mount it

First step it is a run init container which use trivy-db:2 and --download-db-only args. It collect updated database to volume which was connect early --cache-dir /var/trivyoperator/trivy-db to put updated database
Then run container(not init container) with args --skip-db-update(because it already updated) and --cache-dir /var/trivyoperator/trivy-db(which is our updated database which we updated earlier)

And my main question why do we use --download-db-only in init container if our image already has updated database inside of trivy-db:2?

[AvdeevArtem]

mmm, maybe I get your point