Trivy IaC scanner crashed when run in container or github actions - 137 exit code

[obounaim]

Description

Trivy was OOM killed while scanning for Misconfiguration / IaC in Github Action or in Docker. Exit code 137.

trivy config terraform/ --debug

Tested with other commands, gave same behavior:
trivy fs --scanners misconfig terraform/ --debug
trivy repo --scanners misconfig terraform/ --debug

du -sch terraform 12M terraform 12M total

The scan works just fine on local system.

Desired Behavior

Trivy misconfiguration complete successfully

Actual Behavior

Trivy crashes with 137 exit code

Reproduction Steps

A scan of an private Terraform repository for misconfiguration with Trivy

Target

Filesystem

Scanner

Misconfiguration

Output Format

Table

Mode

None

Debug Output

2024-04-18T06:42:38.759Z        DEBUG   [misconf] 42:38.759982301 terraform.executor               Adapting modules...
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157767052 terraform.executor               Adapted 1 module(s) into defsec state data.
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157833385 terraform.executor               Using max routines of 11
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157841177 terraform.executor               Applying state modifier functions...
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157924468 terraform.executor               Initialized 486 rule(s).
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157943385 terraform.executor               Created pool with 11 worker(s) to apply rules.
2024-04-18T06:42:50.806Z        DEBUG   [misconf] 42:50.806293543 terraform.scanner.rego           Scanning 1 inputs...
Killed
4b401429f47a:/# echo $?
137
4b401429f47a:/#

Operating System

Github Action

Version

4b401429f47a:/# trivy --version
Version: 0.50.1
Policy Bundle:
  Digest: sha256:aa1640957b796d93a0ffc5d91237ee6b7ed9467b8f1825279384d29f91b9e590
  DownloadedAt: 2024-04-18 06:20:56.551859171 +0000 UTC
4b401429f47a:/#

Checklist

• Run trivy image --reset
• Read the troubleshooting

[nikpivkin]

Hi @obounaim !

How did you run Trivy in the docker?

[obounaim]

@nikpivkin do you need any more input from me ?

[simar7]

@obounaim Nikita is off this week. Once he's back he can assist you.

[simar7]

@obounaim Looks like this issue is reproducible in #6549 so I've made #6557 to track it.

[nikpivkin]

@obounaim Yes, would you be able to send me the heap.prof and mem.prof files for investigation?

[obounaim]

@nikpivkin, I would like to share the full files. But because it was a scan of an internal project I would like to avoid any leak of internal code/information.