Trivy IaC scanner crashed when run in container or github actions - 137 exit code

[obounaim]

Description

Trivy was OOM killed while scanning for Misconfiguration / IaC in Github Action or in Docker. Exit code 137.

trivy config terraform/ --debug

Tested with other commands, gave same behavior:
trivy fs --scanners misconfig terraform/ --debug
trivy repo --scanners misconfig terraform/ --debug

du -sch terraform 12M terraform 12M total

The scan works just fine on local system.

Desired Behavior

Trivy misconfiguration complete successfully

Actual Behavior

Trivy crashes with 137 exit code

Reproduction Steps

A scan of an private Terraform repository for misconfiguration with Trivy

Target

Filesystem

Scanner

Misconfiguration

Output Format

Table

Mode

None

Debug Output

2024-04-18T06:42:38.759Z        DEBUG   [misconf] 42:38.759982301 terraform.executor               Adapting modules...
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157767052 terraform.executor               Adapted 1 module(s) into defsec state data.
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157833385 terraform.executor               Using max routines of 11
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157841177 terraform.executor               Applying state modifier functions...
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157924468 terraform.executor               Initialized 486 rule(s).
2024-04-18T06:42:39.157Z        DEBUG   [misconf] 42:39.157943385 terraform.executor               Created pool with 11 worker(s) to apply rules.
2024-04-18T06:42:50.806Z        DEBUG   [misconf] 42:50.806293543 terraform.scanner.rego           Scanning 1 inputs...
Killed
4b401429f47a:/# echo $?
137
4b401429f47a:/#

Operating System

Github Action

Version

4b401429f47a:/# trivy --version
Version: 0.50.1
Policy Bundle:
  Digest: sha256:aa1640957b796d93a0ffc5d91237ee6b7ed9467b8f1825279384d29f91b9e590
  DownloadedAt: 2024-04-18 06:20:56.551859171 +0000 UTC
4b401429f47a:/#

Checklist

• Run trivy image --reset
• Read the troubleshooting

[nikpivkin]

Hi @obounaim !

How did you run Trivy in the docker?

[obounaim]

I would love to, but the repository I am scanning contains a lot of files. I am not sure what input to give you.

[obounaim]

The issue seems to be related to GCP resources in terraform code.

[simar7]

I am not sure what input to give you.

Input that can help us reproduce this behavior as we have been unable to do so.

[obounaim]

Hi, I may have some new information on this topic. The high memory usage is caused by a main.tf file that manages 46 google_compute_firewall resource. Reducing the number of resources in the file reduces the memory usage proportionally.

[nikpivkin]

@obounaim Thanks, that helped find the problem.

[nikpivkin]

Track #7548