Skip to main content

Vulnerability Scanning Configuration

This page covers self-hosted scanner operation. To see what developers can scan and how to review CVEs in RepoFlow, start with the Vulnerability Scanning feature guide.

How it works​

RepoFlow uses Grype for vulnerability scanning. The scanner is bundled in the RepoFlow Docker image, so it does not require a separate scanner service.

Scanning is enabled by default, but scans on upload and scheduled scans are opt-in. Configure them with the vulnerability scanning environment variables.

Resource usage​

Package scanning uses additional CPU and memory. Start with the default single parallel scan and increase VULNERABILITY_SCANNING_MAX_PARALLEL_SCANS only after observing your deployment under load.

Choose when scans run​

  • Set VULNERABILITY_SCANNING_ON_UPLOAD_ENABLED=true to scan packages as they are uploaded.
  • Set VULNERABILITY_SCANNING_SCHEDULED_ENABLED=true to scan on the configured cron schedule.
  • Enable scheduled rescans when previously scanned artifacts should be checked against newer vulnerability data.
  • Use the minimum rescan age to avoid repeatedly scanning recently processed artifacts.

Vulnerability database updates​

GRYPE_AUTO_UPDATE is enabled by default and checks for database updates on the configured cron schedule. The Helm chart can provision persistent storage for scanner data so the database does not need to be downloaded after every restart.

Air-gapped deployments​

Use the RepoFlow image tagged airgapped. It includes the vulnerability database available when that RepoFlow version was released. Set GRYPE_AUTO_UPDATE=false when the deployment cannot reach the update service.

Plan how you will refresh the image or database so vulnerability data does not become permanently stale.