Improvement in Documentation Regarding the --input Parameter

[rulas]

Description

It is unclear whether the --input parameter means that the specified image.tar will be scanned with a container view (squashed representation). Using this option is very helpful in environments where podman/docker might not be available and tar file could be the only option.

Link

https://aquasecurity.github.io/trivy/v0.50/docs/target/container_image/#tar-files

Suggestions

Specify that the given image in tar format will be scanned with a container view (squashed representation).

[knqyf263]

The tar file is analyzed layer by layer in the same way as container images are scanned. Does this answer your question? If so, please feel free to create a PR.

[rulas]

That's very interesting. My understanding was that in the case of containers, only the resulting image would be scanned and not each of the layers. If what you're saying is true, then vulnerabilities in earlier layers would be shown, which hasn't been the case as vulnerabilities disappear once we update the base OS.

I was expecting to understand if the same behavior should be expected if we pass the tar file, but it was not clear from the documentation.

[knqyf263]

Analysis results of each layer are merged and will be scanned for vulnerabilities.