Image does not contain trivy-db

[maxkandzia]

The layer file is only 1kb in size. This file should contain the trivy DB, right?
The image on Docker Hub is updated regularly, but does not seem to contain a Trivy DB. Is there a bug here or is this intentional?

[afdesk]

@maxkandzia how did you pull this tar file?

$ oras pull ghcr.io/aquasecurity/trivy-db:2 -a

[maxkandzia]

Hello @afdesk, I did the pull from docker-hub (https://hub.docker.com/r/aquasec/trivy-db)

docker pull aquasec/trivy-db:v1-2022070400

is the pull only possible from ghcr.io? On the project we only have access to dockerhub. Therefore I would like to pull from dockerhub.

[afdesk]

Hello @maxkandzia!
no, this database version is deprecated now: aquasecurity/trivy#1653
you can read more about air-gapped mode here: https://aquasecurity.github.io/trivy/v0.29.2/docs/advanced/air-gap/
also there is a way to download the database via Trivy directly:

$ trivy image --download-db-only