| name | ocean-trivy-verify |
| description | Verify CVE/image-vulnerability fixes for ocean (Nx Cloud / Polygraph) docker images by building the real image locally and scanning it with the exact trivy version our trivy-operator deploys. Covers finding where a flagged package actually lives (base-image npm bundle vs app node_modules vs inlined esbuild code), the scoped rego ignorePolicy escape hatch in cloud-infrastructure, and the disk/JSON gotchas. Triggers on "trivy", "verify CVE fix", "scan the image", "image vulnerability", "trivy alert", "is the CVE gone", "check the docker image for vulns".
|
Ocean Trivy Verify (CVE fixes in docker images)
Worked example: CLOUD-4926 (node-tar CVE-2026-59873), ocean PR #12614, 2026-07-29.
0. Pin the scanner version
Match what prod runs, not latest. Deployed version lives in
cloud-infrastructure/kubernetes/kustomize/overlays/*/nx-cloud/trivy-operator/values.yaml
under trivy.image.tag (0.63.0 as of 2026-07). Run it via docker, no install:
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
mirror.gcr.io/aquasec/trivy:<TAG> image --scanners vuln <IMAGE>
1. Locate the vulnerable copy FIRST
A package can exist in 4 places; the fix differs per place:
- Base image npm bundle (
usr/local/lib/node_modules/npm/node_modules/...):
comes from node:XX-alpine, not from our lockfile. Check what base ships:
docker run --rm node:22-alpine3.23 sh -c 'npm -v' and read the dep's
package.json inside. Fix = pin newer npm in runtime stage
(RUN npm install -g npm@<exact>) or wait for base bump. npm publishes with
BUNDLED deps, so npm view npm@X dependencies.<pkg> gives the range but the
installed version is whatever the tarball vendored - verify in a container.
- App node_modules in image (
/app/node_modules/...): from
+ lockfile via builder .
Fix = bump workspace dep/override in ocean root.
