Helm chart trivy the java-db is missing no update like normal DB

[marinhio75]

Question

Hi,
I deployed the helm chart Trivy to our Kubernetes Cluster (no, not the trivy-operator, need scans for images outside of kubernetes). So far, so good, but I was surprised that the Java database wasn't there.

Okay, I can still install it with trivy image --download-java-db-only --java-db-repository $TRIVY_JAVA_DB_REPOSITORY.
Setting up a simple cron job is a huge hassle involving a role and role bindings, etc.
It would be great to integrate the Java database with an automated download like the regular database.

Does someone has an suggestion? Or a solution how to get it?

Load balancer knows the DNS adress, but inside the pod its missing, so if i start trivy with server ... the dns is unkown, but with IP Adress it works hmm
Any ideas why? Thank you!

Best regards
Marinhio

Target

Kubernetes

Scanner

Vulnerability

Output Format

JSON

Mode

Client/Server

Operating System

kubectl 1.32

Version

~ $ trivy -v
Version: 0.69.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-02-12 06:48:08.083436615 +0000 UTC
  NextUpdate: 2026-02-13 06:48:08.083436255 +0000 UTC
  DownloadedAt: 2026-02-12 07:18:02.658677362 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2026-02-08 01:35:35.381861997 +0000 UTC
  NextUpdate: 2026-02-11 01:35:35.381861736 +0000 UTC
  DownloadedAt: 2026-02-12 08:02:01.44516072 +0000 UTC

[DmitriyLewen]

Hello @marinhio75
Thanks for your interest to Trivy!

The size of the trivy-java-db database is quite large and downloading it for every user would significantly slow down Trivy's performance.

Therefore for trivy-java-db we use different logic:
the database is downloaded/updated only when a jar file is found during scanning.
If there are no jar files in the image, the database won't be downloaded.

If you want the database to be downloaded in advance, then as you correctly wrote, you can use the --download-java-db-only flag.

Regards, Dmitriy

[marinhio75]

Hi @DmitriyLewen

Thanks for your quick reply. I understand the logic, but it doesn't make Trivy any faster if I have to download the Java database beforehand. Ideally, once downloaded, it would update automatically like the other database. That would be perfect.
Simple logic, Java DB was downloaded and set automatic update 💯

Right now, if I want to automate this, I have to create a role with role binding to set up a simple cron job just to update the database every day.
Best regards
Marinhio

[DmitriyLewen]

Currently, trivy-db is checked (and updated if necessary) at the start of every Trivy run.
For trivy-java-db, the check and update process only occurs if a JAR file is found within the image.

Unless you have a specific requirement, you do not need to set up additional cron jobs. Trivy will handle everything automatically, but only if it detects a JAR file.

How does this behavior limit you?

[marinhio75]

If i run
trivy image -d --skip-db-update --server http://1x.xxx:4954 --ignorefile .trivyignore --checks-bundle-repository artefakt.xxx/aquasecurity/trivy-checks --scanners vuln,misconfig,license --timeout 10m --format json --output trivy-result.json artefakt.xxx/bitnamilegacy/kafka:4.0.0-debian-12-r10

INFO [javadb] Downloading Java DB...
INFO [javadb] Downloading artifact... repo="mirror.gcr.io/aquasec/trivy-java-db:1"
But we use an own Artefaktserver, so mirror.gcr.io is not allowed
I can do a cronjob in any VM
trivy image --download-java-db-only --java-db-repository artefaktXXX/aquasecurity/trivy-java-db
but thats not the clean way
Java-DB should be ready when the pipeline starts
So IF the Java-DB is downloaded Trivy should simply keep it up to date too
It doesn't affect non-java users

[DmitriyLewen]

But we use an own Artefaktserver, so mirror.gcr.io is not allowed

You can add --java-db-repository to your run command.

So IF the Java-DB is downloaded Trivy should simply keep it up to date too
It doesn't affect non-java users

This affects non-Java users as well.
e.g., if you scan a Java image once, Trivy downloads the trivy-java-db.
Subsequent scans of non-Java images will still trigger a DB update check, causing unnecessary delays even when the target image contains no JAR files.

[marinhio75]

Today i started a scan
~ $ trivy -v
Version: 0.69.1
Vulnerability DB:
Version: 2
UpdatedAt: 2026-03-01 18:33:27.514686433 +0000 UTC
NextUpdate: 2026-03-02 18:33:27.514686173 +0000 UTC
DownloadedAt: 2026-03-01 18:46:27.676491821 +0000 UTC
Java DB:
Version: 1
UpdatedAt: 2026-02-25 01:25:29.365818249 +0000 UTC
NextUpdate: 2026-02-28 01:25:29.365818129 +0000 UTC
DownloadedAt: 2026-02-25 11:13:18.409780715 +0000 UTC

Java DB was updated but not inside the Kubernetes Pod, instead the DB was downloaded to the Jenkins Client

[DmitriyLewen]

Hello @marinhio75
IIUC you use client/server mode.

trivy-java-db is part of client part - #3560