chore: sync stdout before container is stopped #2825
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The container is otherwise stopped before the result of the scan is outputted to stdout, resulting in errored scan jobs.
PT-GD
reviewed
Jan 23, 2026
PT-GD
left a comment
PT-GD
left a comment
There was a problem hiding this comment.
Minor refactoring to remove duplication. I wonder if there's an opportunity to have the trivy CLI format the output based on the result condition and sync, saving the alternate redirection logic?
| Args: []string{ | ||
| "-c", | ||
| "trivy image nginx:1.16 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --scanners vuln,secret --skip-db-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log; else cat /tmp/scan/result_nginx.json; fi; exit $rc", | ||
| "trivy image nginx:1.16 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --scanners vuln,secret --skip-db-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log && sync; else cat /tmp/scan/result_nginx.json && sync; fi; exit $rc", |
There was a problem hiding this comment.
No need to have sync in both branches when you can just put it next in the pipeline.
Suggested change
| "trivy image nginx:1.16 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --scanners vuln,secret --skip-db-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log && sync; else cat /tmp/scan/result_nginx.json && sync; fi; exit $rc", | |
| "trivy image nginx:1.16 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --scanners vuln,secret --skip-db-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log; else cat /tmp/scan/result_nginx.json; fi; sync; exit $rc", |
| Args: []string{ | ||
| "-c", | ||
| "trivy image nginx:1.16 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --scanners vuln,secret --skip-db-update --slow --config /etc/trivy/trivy-config.yaml --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log; else bzip2 -c /tmp/scan/result_nginx.json | base64; fi; exit $rc", | ||
| "trivy image nginx:1.16 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --scanners vuln,secret --skip-db-update --slow --config /etc/trivy/trivy-config.yaml --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log && sync; else bzip2 -c /tmp/scan/result_nginx.json | base64 && sync; fi; exit $rc", |
There was a problem hiding this comment.
As above:
Suggested change
| "trivy image nginx:1.16 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --scanners vuln,secret --skip-db-update --slow --config /etc/trivy/trivy-config.yaml --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log && sync; else bzip2 -c /tmp/scan/result_nginx.json | base64 && sync; fi; exit $rc", | |
| "trivy image nginx:1.16 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --scanners vuln,secret --skip-db-update --slow --config /etc/trivy/trivy-config.yaml --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log; else bzip2 -c /tmp/scan/result_nginx.json | base64; fi; sync; exit $rc", |
| - args: | ||
| - -c | ||
| - trivy image busybox:1.28 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_hello.json 2>/tmp/scan/result_hello.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_hello.json.log; else bzip2 -c /tmp/scan/result_hello.json | base64; fi; exit $rc | ||
| - trivy image busybox:1.28 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_hello.json 2>/tmp/scan/result_hello.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_hello.json.log && sync; else bzip2 -c /tmp/scan/result_hello.json | base64 && sync; fi; exit $rc |
There was a problem hiding this comment.
As above:
Suggested change
| - trivy image busybox:1.28 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_hello.json 2>/tmp/scan/result_hello.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_hello.json.log && sync; else bzip2 -c /tmp/scan/result_hello.json | base64 && sync; fi; exit $rc | |
| - trivy image busybox:1.28 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_hello.json 2>/tmp/scan/result_hello.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_hello.json.log; else bzip2 -c /tmp/scan/result_hello.json | base64; fi; sync; exit $rc |
| - args: | ||
| - -c | ||
| - trivy image quay.io/fluentd_elasticsearch/fluentd:v2.5.2 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_fluentd-elasticsearch.json 2>/tmp/scan/result_fluentd-elasticsearch.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_fluentd-elasticsearch.json.log; else bzip2 -c /tmp/scan/result_fluentd-elasticsearch.json | base64; fi; exit $rc | ||
| - trivy image quay.io/fluentd_elasticsearch/fluentd:v2.5.2 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_fluentd-elasticsearch.json 2>/tmp/scan/result_fluentd-elasticsearch.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_fluentd-elasticsearch.json.log && sync; else bzip2 -c /tmp/scan/result_fluentd-elasticsearch.json | base64 && sync; fi; exit $rc |
There was a problem hiding this comment.
As above:
Suggested change
| - trivy image quay.io/fluentd_elasticsearch/fluentd:v2.5.2 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_fluentd-elasticsearch.json 2>/tmp/scan/result_fluentd-elasticsearch.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_fluentd-elasticsearch.json.log && sync; else bzip2 -c /tmp/scan/result_fluentd-elasticsearch.json | base64 && sync; fi; exit $rc | |
| - trivy image quay.io/fluentd_elasticsearch/fluentd:v2.5.2 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_fluentd-elasticsearch.json 2>/tmp/scan/result_fluentd-elasticsearch.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_fluentd-elasticsearch.json.log; else bzip2 -c /tmp/scan/result_fluentd-elasticsearch.json | base64; fi; sync; exit $rc |
| - args: | ||
| - -c | ||
| - trivy image perl:5.34 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_pi.json 2>/tmp/scan/result_pi.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_pi.json.log; else bzip2 -c /tmp/scan/result_pi.json | base64; fi; exit $rc | ||
| - trivy image perl:5.34 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_pi.json 2>/tmp/scan/result_pi.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_pi.json.log && sync; else bzip2 -c /tmp/scan/result_pi.json | base64 && sync; fi; exit $rc |
There was a problem hiding this comment.
As above:
Suggested change
| - trivy image perl:5.34 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_pi.json 2>/tmp/scan/result_pi.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_pi.json.log && sync; else bzip2 -c /tmp/scan/result_pi.json | base64 && sync; fi; exit $rc | |
| - trivy image perl:5.34 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_pi.json 2>/tmp/scan/result_pi.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_pi.json.log; else bzip2 -c /tmp/scan/result_pi.json | base64; fi; sync; exit $rc |
| - args: | ||
| - -c | ||
| - trivy image app-image:app-image-tag --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_app.json 2>/tmp/scan/result_app.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_app.json.log; else bzip2 -c /tmp/scan/result_app.json | base64; fi; exit $rc | ||
| - trivy image app-image:app-image-tag --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_app.json 2>/tmp/scan/result_app.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_app.json.log && sync; else bzip2 -c /tmp/scan/result_app.json | base64 && sync; fi; exit $rc |
There was a problem hiding this comment.
As above:
Suggested change
| - trivy image app-image:app-image-tag --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_app.json 2>/tmp/scan/result_app.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_app.json.log && sync; else bzip2 -c /tmp/scan/result_app.json | base64 && sync; fi; exit $rc | |
| - trivy image app-image:app-image-tag --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_app.json 2>/tmp/scan/result_app.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_app.json.log; else bzip2 -c /tmp/scan/result_app.json | base64; fi; sync; exit $rc |
| - args: | ||
| - -c | ||
| - trivy image wordpress:4.9 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_wordpress.json 2>/tmp/scan/result_wordpress.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_wordpress.json.log; else bzip2 -c /tmp/scan/result_wordpress.json | base64; fi; exit $rc | ||
| - trivy image wordpress:4.9 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_wordpress.json 2>/tmp/scan/result_wordpress.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_wordpress.json.log && sync; else bzip2 -c /tmp/scan/result_wordpress.json | base64 && sync; fi; exit $rc |
There was a problem hiding this comment.
Suggested change
| - trivy image wordpress:4.9 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_wordpress.json 2>/tmp/scan/result_wordpress.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_wordpress.json.log && sync; else bzip2 -c /tmp/scan/result_wordpress.json | base64 && sync; fi; exit $rc | |
| - trivy image wordpress:4.9 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_wordpress.json 2>/tmp/scan/result_wordpress.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_wordpress.json.log; else bzip2 -c /tmp/scan/result_wordpress.json | base64; fi; sync; exit $rc |
| - args: | ||
| - -c | ||
| - trivy image nginx --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log; else bzip2 -c /tmp/scan/result_nginx.json | base64; fi; exit $rc | ||
| - trivy image nginx --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log && sync; else bzip2 -c /tmp/scan/result_nginx.json | base64 && sync; fi; exit $rc |
There was a problem hiding this comment.
Suggested change
| - trivy image nginx --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log && sync; else bzip2 -c /tmp/scan/result_nginx.json | base64 && sync; fi; exit $rc | |
| - trivy image nginx --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log; else bzip2 -c /tmp/scan/result_nginx.json | base64; fi; sync; exit $rc |
| - args: | ||
| - -c | ||
| - trivy image k8s.gcr.io/nginx-slim:0.8 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log; else bzip2 -c /tmp/scan/result_nginx.json | base64; fi; exit $rc | ||
| - trivy image k8s.gcr.io/nginx-slim:0.8 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log && sync; else bzip2 -c /tmp/scan/result_nginx.json | base64 && sync; fi; exit $rc |
There was a problem hiding this comment.
Suggested change
| - trivy image k8s.gcr.io/nginx-slim:0.8 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log && sync; else bzip2 -c /tmp/scan/result_nginx.json | base64 && sync; fi; exit $rc | |
| - trivy image k8s.gcr.io/nginx-slim:0.8 --cache-dir /tmp/trivy/.cache --format json --image-config-scanners secret --security-checks vuln,secret --skip-update --slow --output /tmp/scan/result_nginx.json 2>/tmp/scan/result_nginx.json.log ; rc=$?; if [ $rc -eq 1 ]; then cat /tmp/scan/result_nginx.json.log; else bzip2 -c /tmp/scan/result_nginx.json | base64; fi; sync; exit $rc |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The container is otherwise stopped before the result of the scan is outputted to stdout, resulting in errored scan jobs.
With #2591 the
syncwas removed, however, the command is needed to ensure the output of the scan jobs are outputted in full to stdout. Without the command the result of the job can be 'cut off' halfway as the container is already stopped, resulting in errored scan jobs without any message: