Enhance documentation regarding trivy server and redis cache use in the server and client

[sastorsl]

Description

With regards to client, server and redis cache it would be good to enhance the documentation to explain better what is handled where.

I.e. the Java DB cache is now client side only, re #3560, and with many builds it is of assistanse to have a redis cache backend.

But it is not crystal clear what then is the benefit of having a trivy server in addition.

Link

• Client/Server: https://aquasecurity.github.io/trivy/v0.55/docs/references/modes/client-server/
• Cache / Redis: https://aquasecurity.github.io/trivy/v0.55/docs/configuration/cache/#redis
• Databases: https://aquasecurity.github.io/trivy/v0.55/docs/configuration/db/#vulnerability-database

Suggestions

Document use cases:

• Where trivy server helps
• With regards to various cache backends
• Document what is server side and client side
• Highlight that the Java DB is client side only perhaps also on the trivy server documentation.

[sastorsl]

I can help with the writing, but would need some insights from the team and other users.

[knqyf263]

• Where trivy server helps
  • To share:
    • the vulnerability database
    • the scan cache (analysis results)
• With regards to various cache backends
  • FS cache has a limitation.
  • Redis cache fits in that case.
• Document what is server side and client side
  • The overview is written here.
  • Trivy consists of two phases: analysis and detection, as described in the architecture diagram. The analysis phase is performed on the client side. The Java DB is used in this phase, and that's why it's done at the client end.

[sastorsl]

Perhaps a short enhancement note on both the client/server, redis and DB pages regarding the java DB. I see that the Java DB note mentions a little bit how the workload is distributed - https://aquasecurity.github.io/trivy/v0.55/docs/configuration/db/#java-index-database

[sastorsl]

https://aquasecurity.github.io/trivy/v0.55/docs/references/modes/client-server/ have a section on which scans runs server side, and which scans runs client side.

This could also be a good place to outline where a redis / external cache fits in with a client/server setup.

[sastorsl]

The trivy-java-db is not cached in the redis server either.
Ref #6177

[sastorsl]

trivy-db (vulnerability database) is downloaded to the local, file based, cache directory even with cache-backend redis://hostname:6379 defined, also for trivy server.

1. Start a redis server
2. Start trivy server
3. Observe that the local file system cache is filled
4. Observe that no keys have been added to redis

Redis:

rm -rf ~/tmp/redis &&
mkdir -p ~/tmp/redis &&
(docker stop trivy-backend ; docker rm trivy-backend) >/dev/null 2>&1 ;
docker run --publish 6379:6379 --name trivy-backend --detach redis:7-alpine

Trivy server:

rm -rf ~/tmp/trivy &&
mkdir -p ~/tmp/trivy &&
trivy server --listen 127.0.0.1:8080 --token foobar --cache-dir $HOME/tmp/trivy --cache-backend redis://localhost:6379 --cache-ttl 10m --debug

In another shell

# Observe that we have 500Mb + downloaded
ls -l ~/tmp/trivy/db
du -hs ~/tmp/trivy/db

# ...and no new keys in the redis backend
redis-cli keys "*"