Skip to content

Conversation

@knqyf263
Copy link
Collaborator

@knqyf263 knqyf263 commented Aug 4, 2025

Description

This PR adds timeout handling to the cache database operations to prevent Trivy from hanging indefinitely when another process has locked the database.

Changes:

  • Add 5-second timeout for BoltDB cache operations
  • Return clearer error messages:
    • Timeout errors: "cache may be in use by another process"
    • Other errors: "unable to open cache DB"
  • Update troubleshooting documentation with lock error guidance

Before:

When another process locks the cache database, Trivy hangs indefinitely with no output.

After:

$ trivy image alpine:latest
2025-08-04T12:00:00.000+0000    FATAL   cache may be in use by another process: timeout

Related issues

  • Fixes cases where Trivy hangs indefinitely when another process has locked the cache database

Related PRs

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

- Add 5-second timeout for BoltDB cache operations to prevent indefinite hangs
- Return clearer error messages to help users identify lock conflicts
- Update troubleshooting documentation with lock error guidance
- Clarify that running multiple Trivy processes is not recommended
@knqyf263 knqyf263 force-pushed the feat/db-timeout-handling branch from ff34eeb to ecb796c Compare August 4, 2025 09:42
@knqyf263 knqyf263 changed the title feat(cache): add timeout handling for cache database operations feat: add timeout handling for cache database operations Aug 4, 2025
@knqyf263 knqyf263 requested a review from Copilot August 4, 2025 09:44
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds timeout handling to cache database operations to prevent Trivy from hanging indefinitely when the cache database is locked by another process.

  • Adds a 5-second timeout to BoltDB cache operations with clearer error messages
  • Updates error messages to distinguish between timeout and other database errors
  • Enhances troubleshooting documentation with comprehensive guidance on database lock issues

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File Description
pkg/cache/fs.go Adds timeout configuration and improved error handling for cache database operations
go.mod Updates trivy-db dependency version
docs/docs/references/troubleshooting.md Replaces brief parallel execution note with comprehensive database lock troubleshooting guide
Comments suppressed due to low confidence (1)

pkg/cache/fs.go:17

  • [nitpick] The constant name 'defaultFSCacheTimeout' could be more descriptive. Consider renaming it to 'defaultCacheDBTimeout' or 'defaultBoltDBTimeout' to better reflect that it's specifically for database operations.
const defaultFSCacheTimeout = 5 * time.Second

@knqyf263 knqyf263 marked this pull request as ready for review August 4, 2025 11:09
@knqyf263 knqyf263 requested a review from DmitriyLewen August 4, 2025 11:09
@knqyf263 knqyf263 self-assigned this Aug 4, 2025
Copy link
Contributor

@DmitriyLewen DmitriyLewen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@DmitriyLewen DmitriyLewen added this pull request to the merge queue Aug 18, 2025
Merged via the queue into aquasecurity:main with commit 235c24e Aug 18, 2025
18 of 19 checks passed
yutatokoi pushed a commit to yutatokoi/trivy that referenced this pull request Aug 24, 2025
@knqyf263 knqyf263 deleted the feat/db-timeout-handling branch August 25, 2025 00:28
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Sep 3, 2025
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.65.0` -> `0.66.0` |

---

### Release Notes

<details>
<summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary>

### [`v0.66.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0660-2025-09-02)

[Compare Source](aquasecurity/trivy@v0.65.0...v0.66.0)

##### Features

- add timeout handling for cache database operations ([#&#8203;9307](aquasecurity/trivy#9307)) ([235c24e](aquasecurity/trivy@235c24e))
- **misconf:** added audit config attribute ([#&#8203;9249](aquasecurity/trivy#9249)) ([4d4a244](aquasecurity/trivy@4d4a244))
- **secret:** implement streaming secret scanner with byte offset tracking ([#&#8203;9264](aquasecurity/trivy#9264)) ([5a5e097](aquasecurity/trivy@5a5e097))
- **terraform:** use .terraform cache for remote modules in plan scanning ([#&#8203;9277](aquasecurity/trivy#9277)) ([298a994](aquasecurity/trivy@298a994))

##### Bug Fixes

- **conda:** memory leak by adding closure method for `package.json` file ([#&#8203;9349](aquasecurity/trivy#9349)) ([03d039f](aquasecurity/trivy@03d039f))
- create temp file under composite fs dir ([#&#8203;9387](aquasecurity/trivy#9387)) ([ce22f54](aquasecurity/trivy@ce22f54))
- **cyclonedx:** handle multiple license types ([#&#8203;9378](aquasecurity/trivy#9378)) ([46ab76a](aquasecurity/trivy@46ab76a))
- **fs:** avoid shadowing errors in file.glob ([#&#8203;9286](aquasecurity/trivy#9286)) ([b51c789](aquasecurity/trivy@b51c789))
- **image:** use standardized HTTP client for ECR authentication ([#&#8203;9322](aquasecurity/trivy#9322)) ([84fbf86](aquasecurity/trivy@84fbf86))
- **misconf:** ensure ignore rules respect subdirectory chart paths ([#&#8203;9324](aquasecurity/trivy#9324)) ([d3cd101](aquasecurity/trivy@d3cd101))
- **misconf:** ensure module source is known ([#&#8203;9404](aquasecurity/trivy#9404)) ([81d9425](aquasecurity/trivy@81d9425))
- **misconf:** preserve original paths of remote submodules from .terraform ([#&#8203;9294](aquasecurity/trivy#9294)) ([1319d8d](aquasecurity/trivy@1319d8d))
- **misconf:** use correct field log\_bucket instead of target\_bucket in gcp bucket ([#&#8203;9296](aquasecurity/trivy#9296)) ([04ad0c4](aquasecurity/trivy@04ad0c4))
- persistent flag option typo ([#&#8203;9374](aquasecurity/trivy#9374)) ([6e99dd3](aquasecurity/trivy@6e99dd3))
- **plugin:** don't remove plugins when updating index.yaml file ([#&#8203;9358](aquasecurity/trivy#9358)) ([5f067ac](aquasecurity/trivy@5f067ac))
- **python:** impove package name normalization  ([#&#8203;9290](aquasecurity/trivy#9290)) ([1473e88](aquasecurity/trivy@1473e88))
- **repo:** preserve RepoMetadata on FS cache hit ([#&#8203;9389](aquasecurity/trivy#9389)) ([4f2a44e](aquasecurity/trivy@4f2a44e))
- **repo:** sanitize git repo URL before inserting into report metadata ([#&#8203;9391](aquasecurity/trivy#9391)) ([1ac9b1f](aquasecurity/trivy@1ac9b1f))
- **sbom:** add support for `file` component type of `CycloneDX` ([#&#8203;9372](aquasecurity/trivy#9372)) ([aa7cf43](aquasecurity/trivy@aa7cf43))
- suppress debug log for context cancellation errors ([#&#8203;9298](aquasecurity/trivy#9298)) ([2458d5e](aquasecurity/trivy@2458d5e))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4zNS4xIiwidXBkYXRlZEluVmVyIjoiNDEuMzUuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1367
Co-authored-by: Renovate Bot <[email protected]>
Co-committed-by: Renovate Bot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants