Using --config-data with trivy image

[JC-19891989]

Hi, doing some work with Trivy.

I find --config-data to be a very useful feature when working with Trivy config as I can use it to load in variables to be used in OPA policies. This string does not seem to work in trivy image like it does with trivy config, even though it's in the rego flags part when you run trivy image --help

Is this right/expected or am I doing something wrong?

It seems to not even parse the command, i.e trivy image --config-data ./nofileatall alpine runs a successful command.

Thanks

[itaysk]

thanks for reporting, since this is a potential bug report I've created an issue #3690

[knqyf263]

Hi @JC-19891989 , would you tell us your use case? Does your container image have IaC files like Terraform?

[JC-19891989]

Hi

I cannot remember the use case around it tbh so I obviously worked around it. If a bug has been opened then feel free to close

[knqyf263]

I'll leave this discussion open in case someone else wants this feature and clarifies the use case.

[davidecavestro]

I'll leave this discussion open in case someone else wants this feature and clarifies the use case.

Hi, I'd like to use a statically defined Rego ignore policy that uses injected data to suppress vulnerabilities.
The data could be obtained dynamically from other systems; for example, rules could be defined in SecObserve.

[nikpivkin]

Hi @davidecavestro !

For now, as a workaround, you can extend a statically defined policy with dynamic data—for example, by using cat to append the data—and then pass the resulting policy to Trivy.

[davidecavestro]

Hi @davidecavestro !

For now, as a workaround, you can extend a statically defined policy with dynamic data—for example, by using cat to append the data—and then pass the resulting policy to Trivy.

OK, I'll do it this way. It was just a matter of separating concerns.
Thanks for the quick response!

[nikpivkin]

--config-data is used to pass custom data to checks and is only relevant when misconfiguration scanning is enabled, either for user-defined checks or for built-in checks that support data overriding (for example, KSV0125).

When running trivy image <ref> --config-data ./wrong-path, no warning is produced. This is expected, because misconfiguration scanning is disabled by default, so the provided data is not consumed by any checks. To use --config-data with trivy image, misconfiguration scanning must be enabled, for example by selecting the misconf scanner:
trivy image --scanners misconf --config-data <path> <ref>.