Trivy image scan authentification with tokens

[hutomosaleh]

Question

Is it possible to run trivy scan with tokens? It says that GITLAB_TOKEN & GITHUB_TOKEN works for repository. I tried it with image scan, but it doesn't work. It only works with username & password authentification.

Is it possible to use tokens for scanning private repositories?

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Operating System

Ubuntu 24

Version

Version: 0.56.2

[knqyf263]

Here is the doc
https://trivy.dev/v0.57/docs/advanced/private-registries/

You can use the github token for GHCR.
https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry

[hutomosaleh]

Since I need to use Trivy against Gitlab container registry, I tried using the GITLAB_TOKEN evironment, which should be possible to authenticate for their container registries. But it didn't work.
https://docs.gitlab.com/ee/user/packages/container_registry/authenticate_with_container_registry.html

You can use the github token for GHCR.

From this, do I understand correctly that it is possible to use github token using the GITHUB_TOKEN environment? But it's not possible using gitlab token?

[knqyf263]

No, the document says you can log in the registry with the token.