How to run Trivy K8S scan on a read-only filesystem? (failed to mkdir "/lib/systemd")

[mpas]

Question

I am using a readonly filesystem and when trying to run Trivy on that system with for example: /tmp/trivy/trivy k8s cluster --compliance=k8s-cis --report all the result is an error on the Node Collector.

spec: failed to generate spec: failed to mkdir "/lib/systemd": mkdir /lib/systemd: read-only file system

Is there a way to run Trivy K8S scan on a read-only filesystem?

Target

Kubernetes

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Operating System

Suse Linux Micro

Version

Version: 0.49.1

[itaysk]

we are going to include in the next release a flag that disables the node collector. having said that the node collector should suffice with read only access to files. @chen-keinan can you investigate?

[chen-keinan]

its suffice read only .
could be folder do not exist and it tries to create it. maybe trivy should be able to configure volumeMounts
@mpas you can disable node-collector with the current trivy version by using this flag --component workload if needed.

[itaysk]

@chen-keinan nit sure is understand you say it's read only and then it could be the we try to create a directory

[chen-keinan]

based on the error its look like it tries to create a folder on container (mount fails). the volumeMount is set to readOnly this is could be because /lib/systemd is on a different location or not exist on host.
@mpas can you share the k8s deployment type you used?