docker/trivy-image
Scans every image a Compose file names for known vulnerabilities in its packages.
Part of the docker configuration, at the recommended level. It runs only when gspot check --only docker/trivy-image names it, once per scope. It runs trivy. It needs Docker, running.
A base image carries hundreds of packages, and new advisories keep arriving after you pick it.
What to do
Section titled “What to do”Move to a newer tag of the image. Accept one advisory with gspot ignore docker/trivy-image --rule <id> --reason "...".
Example
Section titled “Example”An image with a vulnerable package reports the advisory. Move to an image version with the fixed package.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore docker/trivy-image --paths "<glob>" --reason "<why>"