# trivy on an exam host (TRIVY_CONFIG points here).
#
# Images are fetched through the simulator's Docker Hub cache, like the kubelet's and podman's
# pulls, so a task that scans a handful of images does not eat into Docker Hub's anonymous pull
# limit. The cache speaks plain HTTP on the simulator's own network, hence `insecure`.
#
# One cache directory for every user of the host: the vulnerability database is 1.6 GB, and a
# task's grader (root) must read the same copy as the candidate, with or without sudo.
registry:
  mirrors:
    index.docker.io:
      - ksim-registry:5000
insecure: true
cache:
  dir: /var/lib/trivy