This is unreleased documentation for SBOM Scanner 0.13-dev.

Air Gap Support

You can use SBOM Scanner in air-gapped environments.

To run the scans, SBOM Scanner currently needs the following external sources:

Vulnerability Database
Java Vulnerability Database
VEX Hub (optional)

These external sources can be self-hosted in your private infrastructure to make the whole environment air-gapped.

Self-Hosting Vulnerability Databases

The following Vulnerability Databases are OCI images. You can host them in your registry:

After you mirror the databases in your OCI registry, install SBOM Scanner with these values:

helm install sbomscanner ./chart \
    --set worker.trivyDBRepository="yourlocalregistry.example/sbomscanner/trivy-db" \
    --set worker.trivyJavaDBRepository="yourlocalregistry.example/sbomscanner/trivy-java-db"

Self-Hosting VEX Hub

To configure a VEX Hub repository, see this guide.

Change repository_url in each applicable VEX file to point to an internal registry.

Configure an HTTP server that provides the VEX files.

By default, SBOM Scanner seeds two VEXHub resources pointing to the public github.com/rancher/vexhub and github.com/aquasecurity/vexhub repositories, which are unreachable in an air-gapped environment. Disable this seeding at install time by setting controller.defaultVEXHubResources to false:

helm install sbomscanner ./chart \
    --set controller.defaultVEXHubResources=false

To configure a VEX Hub in SBOM Scanner, create a VEXHub resource with your local repository URL and apply it:

apiVersion: sbomscanner.kubewarden.io/v1alpha1
kind: VEXHub
metadata:
  name: local_vexhub
spec:
  url: "https://yourlocalrepo.example/"
  enabled: true