72 lines
2.3 KiB
Bash
72 lines
2.3 KiB
Bash
# Copy to .env and adjust. Do not commit real credentials.
|
|
|
|
# Images to scan, space separated (quote the value).
|
|
# Leave empty/unset to scan the images used by running containers.
|
|
# IMAGES=nginx:1.27-alpine redis:7-alpine
|
|
|
|
# Optional: file with one image per line ('#' comments allowed).
|
|
# IMAGES_FILE=images.txt
|
|
|
|
# Host path of the Docker socket to mount. Needed for auto-discovery and for
|
|
# scanning images that exist only in the local daemon. Rootless Docker uses
|
|
# /run/user/<uid>/docker.sock.
|
|
# DOCKER_SOCK=/var/run/docker.sock
|
|
|
|
# Also scan the scanner's own image when auto-discovering (default: false).
|
|
# INCLUDE_SELF=false
|
|
|
|
# Containers that face the internet. Each one gets its own notification with
|
|
# every CVE at/above NOTIFY_MIN_SEVERITY, split into fixable and unfixable.
|
|
# All other containers are summarised in one notification. Space or comma
|
|
# separated. Leave empty to keep the single aggregated notification.
|
|
# IMPORTANT_CONTAINERS=traefik web-frontend
|
|
|
|
# One or more Apprise URLs, space separated. Quote the value.
|
|
# Examples:
|
|
# mailto://user:app-password@gmail.com
|
|
# discord://webhook_id/webhook_token
|
|
# slack://token_a/token_b/token_c
|
|
# tgram://bot_token/chat_id
|
|
# gotify://hostname/token
|
|
APPRISE_URLS=
|
|
|
|
# Optional: Apprise YAML config (mount it into the container).
|
|
# APPRISE_CONFIG=/config/apprise.yml
|
|
|
|
APPRISE_TITLE_PREFIX=Vulnerability scan
|
|
|
|
# Lowest severity that sends an alert (NONE disables notifications).
|
|
NOTIFY_MIN_SEVERITY=HIGH
|
|
|
|
# Lowest severity that makes the scan exit with code 1 (NONE never fails).
|
|
FAIL_ON=HIGH
|
|
|
|
# Skip vulnerabilities that have no fixed version available.
|
|
IGNORE_UNFIXED=false
|
|
|
|
# Optional: restrict which severities Trivy reports (empty = all).
|
|
TRIVY_SEVERITIES=
|
|
|
|
# Optional: VEX sources passed to `trivy image --vex`, space separated.
|
|
# Use "repo", "oci", "sbom-ref", local file paths, or a combination.
|
|
# Mount local files into the container first (e.g. ./vex:/vex:ro).
|
|
# TRIVY_VEX=repo
|
|
# TRIVY_VEX=/vex/app.json
|
|
|
|
# How many findings to list in the notification body.
|
|
MAX_FINDINGS_IN_BODY=15
|
|
|
|
# Send an Apprise alert when Trivy itself fails (default: true).
|
|
NOTIFY_ON_SCAN_ERROR=true
|
|
|
|
# Timeout for each image scan.
|
|
TRIVY_TIMEOUT=15m
|
|
|
|
# Log verbosity: DEBUG, INFO, WARN or ERROR.
|
|
LOG_LEVEL=INFO
|
|
|
|
# Optional: credentials for private registries.
|
|
# TRIVY_USERNAME=
|
|
# TRIVY_PASSWORD=
|
|
# TRIVY_INSECURE=false
|