bug(misconf): Trivy does not skip AVD-DS-0016 when scanning docker image history

[nikpivkin]

Discussed in #8892

[nikpivkin]

@simar7 We recently started initializing the Rego scanner only once before starting a scan to improve performance. However, this change made it harder to disable specific checks dynamically, since it would now require explicitly passing a list of checks to each scanner instance.

As an alternative, what if we exported the file_type to Rego and used it to control which checks should run? This approach would allow us to conditionally disable checks based on the file type, without requiring any further changes to Trivy’s scanning logic.

Here’s how it might look in Rego:

import data.file_type

deny contains res if {
  file_type != "dockerfile-history"
  ...
}

I found a discussion where this would come in handy: #8865.

[simar7]

As an alternative, what if we exported the file_type to Rego and used it to control which checks should run? This approach would allow us to conditionally disable checks based on the file type, without requiring any further changes to Trivy’s scanning logic.

You mean the check itself would host such logic where it can be selectively disabled if the field is set to a certain value? Yeah I think that's a reasonable idea

I found a discussion where this would come in handy: #8865.

How would knowing file type help in this case? The variable is still not populated/known at evaluation time.

[nikpivkin]

How would knowing file type help in this case? The variable is still not populated/known at evaluation time.

See #8865 (reply in thread)