Running concurrent trivy image scans seems to block

[archoversight]

Description

I am running scans across many images in parallel on a single machine that has 32 cores. When I spin up 20 trivy image scans against multiple different containers at once, it seems that only one makes progress and all others sit idle.

What did you expect to happen?

I expect that each of the trivy processes uses up as much CPU as it can to scan the images as fast as it can.

What happened instead?

A single slow image that timed out seemed to be holding up all other scans.

Output of run with -debug:

(paste your output here)

Output of trivy -v:

trivy -v
Version: 0.33.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2022-11-07 18:07:31.473970035 +0000 UTC
  NextUpdate: 2022-11-08 00:07:31.473969535 +0000 UTC
  DownloadedAt: 2022-11-07 21:20:41.291209481 +0000 UTC

Additional details (base image name, container registry info...):

[NitroCao]

It's not a bug, a "feature" instead because Trivy uses boltdb as the vulnerability database, which doesn't support concurrent access. Related issues are #1529, #650, #660.
The workaround is to use client/server mode (https://aquasecurity.github.io/trivy/v0.34/docs/references/modes/client-server/).

[archoversight]

Work-around deployed. It means there is an additional process that needs to be managed if one wants to quickly scan multiple containers.