Fatal error init error: DB error: failed to download vulnerability DB

[JWebDev]

Description

Trivy cannot download the database on the first run.

trivy clean --all => Does not works

Desired Behavior

I can run the scan.

Actual Behavior

Trivy cannot download the database on the first run.

Reproduction Steps

Just run some command
trivy image python:3.4-alpine
or
sudo trivy kubernetes --scanners vuln --report summary --skip-images --disable-node-collector --kubeconfig ~/.kube/config --debug infra

Target

Kubernetes

Scanner

Vulnerability

Output Format

None

Mode

None

Debug Output

/d/tmp » trivy image python:3.4-alpine
2024-07-14T08:01:36+02:00       INFO    Need to update DB
2024-07-14T08:01:36+02:00       INFO    Downloading DB...       repository="ghcr.io/aquasecurity/trivy-db:2"
2024-07-14T08:01:36+02:00       FATAL   Fatal error     init error: DB error: failed to download vulnerability DB: database download error: OCI repository error: 1 error occurred:
        * Get "https://ghcr.io/v2/": dial tcp: lookup ghcr.io on [::1]:53: read udp [::1]:48245->[::1]:53: read: connection refused


/d/tmp » sudo trivy kubernetes --scanners vuln --report summary --skip-images --disable-node-collector --kubeconfig ~/.kube/config --debug infra
2024-07-14T08:02:13+02:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-07-14T08:02:13+02:00       DEBUG   Ignore statuses statuses=[]
2024-07-14T08:02:21+02:00       DEBUG   Cache dir       dir="/root/snap/trivy/276/.cache/trivy"
2024-07-14T08:02:21+02:00       DEBUG   There is no valid metadata file err="unable to open a file: open /root/snap/trivy/276/.cache/trivy/db/metadata.json: no such file or directory"
2024-07-14T08:02:21+02:00       INFO    Need to update DB
2024-07-14T08:02:21+02:00       INFO    Downloading DB...       repository="ghcr.io/aquasecurity/trivy-db:2"
2024-07-14T08:02:21+02:00       DEBUG   No metadata file
2024-07-14T08:02:22+02:00       FATAL   Fatal error     init error: DB error: failed to download vulnerability DB: database download error: OCI repository error: 1 error occurred:
        * Get "https://ghcr.io/v2/": dial tcp: lookup ghcr.io on [::1]:53: read udp [::1]:42444->[::1]:53: read: connection refused

Operating System

Ubuntu 24.04

Version

Version: 0.52.2

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

It's a DNS error. Your network seems unstable.

[JWebDev]

@knqyf263 Thanks for the answer, but I cannot confirm this.
Years long it works perfect. A lot of other similar tools. For example "kubescape, grype" which are working with the same principle.

It is WSL for Windows. Maybe this is a problem?
ping google.com is fine also

[JWebDev]

@knqyf263 Are you really a developer? The answer, "it works in my environment" is not the answer. It should work on all presented envs.
I can go to the stackoverflow and ask, if something doesn't work. But I think, this is the Bug case, because it will not work immediately after installation, what should be not the case.

I have no idea.

No comments. Are you really maintainer?

"GitHub doesn't report any problems."

=> What does this have to do with GitHub?

[simar7]

@JWebDev what @knqyf263 mentioned is a plausible reason as to why this error occurred. If Trivy isn't able to fetch the required artifacts it needs to function, the behavior is undefined.

As for what you can try next, you could look at this air-gap guide and eliminate the network piece from the problem. If an air-gapped Trivy setup works for you, then we know it is the network to blame.

[JWebDev]

@simar7 That is logical. Okay, I'll try "air-gaps". Don't close the ticket yet. Thank you

[emremerson226]

@JWebDev did you manage to solve it? I had to disable it in all my Azure Devops pipelines. I upgraded the version from 52 to 55 and even then there were times when I could download it, other times I couldn't with the same error.

I'm running on ubuntu-latest

[JWebDev]

@emremerson226 Unfortunately, no

[sarah-oloumi]

+1 for seeing this issue: I've seen this occur on both fedora and centos

[ashwath-garugula]

+1 , we are also facing similar issue , it worked flawless until last week and started seeing this error : ERROR [vulndb] Failed to download artifact repo="ghcr.io/aquasecurity/trivy-db:2" err="OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 668.644µs, allowed: 44000/minute\n\n"
2024-11-07T09:00:19Z FATAL Fatal error init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source

[yitzhaktal]

Also getting:
2024-11-11T11:52:37+02:00 ERROR [vulndb] Failed to download artifact repo="ghcr.io/aquasecurity/trivy-db:2" err="OCI reposito││ │
ry error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 794.708µs, allo││ │
wed: 44000/minute\n\n" ││ │
2024-11-11T11:52:37+02:00 FATAL Fatal error init error: DB error: failed to download vulnerability DB: OCI artifact error: f││ │
ailed to download vulnerability DB: failed to download artifact from any source: 1 error occurred: ││ │
* OCI repository error: 1 error occurred: ││ │
* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 794.708µs, allowed: 44000/minute ││ │
││ │
││ │

[K1kc4]

Workaround is adding --db-repository public.ecr.aws/aquasecurity/trivy-db --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db to your command.

[MatshiSE]

Also been experiencing this issue randomly on alpine images.
Running trivy clean --scan-cache used to work but that is no longer the case.

[cuongtnh]

it works for me. Thanks