Need a way to always prefer registry over local Docker when scanning an image

[luhring]

What would you like to be added:

It'd be great to have an easy way to avoid ever accidentally scanning a stale version of a container image, specifically because Grype retrieved the image from Docker instead of directly from the registry. Scanning stale images results in wasted time, pointless escalations/firedrills, etc.

Short of changing the default behavior in the tool itself, it'd be great to have a persistent fix available to the user, like setting a value in a config file on disk.

Why is this needed:

Today's behavior is a common footgun for folks. They intuitively type a command like grype alpine:3.16, or grype my-registry.io/my-company/my-image, and they don't realize until much later that what they've scanned is not reflective of the latest state of the image.

This happens primarily when scanning images that the user didn't build themselves. So any time you scan an official Docker Hub image, or an open source project's image, this is a mistake waiting to happen. Even for an organization's own image, it's increasingly common that images are built by CI instead of locally — in which case, defaulting to retrieving the image from Docker just means introducing the risk that you're scanning a stale image.

Additional context:

IIRC, there's no strong reason why today Grype prefers Docker over the registry — I believe it was simply that the developers (myself included) added support for Docker first, and for the registry second.

This might be implicit — but it'd probably be a good UX for whatever solution is applied to Grype for this ticket to also be applied to Syft.

cc: @spiffcs — link to community Slack discussion