From 79b07e74e2659448983167a12fa7f2475207d639 Mon Sep 17 00:00:00 2001 From: Arunesh Dwivedi Date: Sat, 15 Aug 2026 07:24:04 +0000 Subject: [PATCH 1/2] fix(trivy): fail fast when trivy binary is not found When the trivy binary at /trivy cannot be found, the scanner previously logged an error and continued processing, silently swallowing the failure. This made it impossible to distinguish between a missing binary and a successful scan. Add a pre-flight os.Stat check in main() to exit immediately with a clear error message when the trivy binary is missing. Signed-off-by: Arunesh Dwivedi --- pkg/scanners/trivy/trivy.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkg/scanners/trivy/trivy.go b/pkg/scanners/trivy/trivy.go index 8028ac4742..2ac23fc273 100644 --- a/pkg/scanners/trivy/trivy.go +++ b/pkg/scanners/trivy/trivy.go @@ -67,6 +67,15 @@ func main() { log.Info("trivy version", "trivy version", trivyVersion) log.Info("config", "config", *config) + if _, err := os.Stat(trivyCommandName); err != nil { + if os.IsNotExist(err) { + fmt.Fprintf(os.Stderr, "trivy binary not found at %s\n", trivyCommandName) + os.Exit(generalErr) + } + log.Error(err, "unable to stat trivy binary") + os.Exit(generalErr) + } + userConfig := *DefaultConfig() if *config != "" { var err error From 03c0325123768e1c3a13a9b4a71ed2a63bedb11e Mon Sep 17 00:00:00 2001 From: Arunesh Dwivedi Date: Sat, 15 Aug 2026 07:27:45 +0000 Subject: [PATCH 2/2] fix: add CRI connection timeout and trivy binary pre-flight check - utils.GetConn: wrap grpc.DialContext with a 30-second timeout context so the collector/remover fail fast instead of hanging indefinitely when the CRI socket is inaccessible (fixes #1014) - trivy scanner: add pre-flight os.Stat check for /trivy binary in main() so the pod exits immediately with a clear error when the binary is missing instead of silently logging and continuing (fixes #1149) Fixes #1014 Fixes #1149 Signed-off-by: Arunesh Dwivedi --- pkg/utils/utils.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go index 29a262e7e3..ac51b5f234 100644 --- a/pkg/utils/utils.go +++ b/pkg/utils/utils.go @@ -51,9 +51,14 @@ func GetConn(ctx context.Context, socketPath string) (conn *grpc.ClientConn, err return nil, err } + // Use a timeout context so we fail fast instead of hanging indefinitely + // when the CRI socket is inaccessible (e.g. permission denied). + connCtx, cancel := context.WithTimeout(ctx, 30*time.Second) + defer cancel() + //nolint:staticcheck // SA1019: grpc.DialContext is deprecated but maintains required blocking behavior return grpc.DialContext( - ctx, + connCtx, addr, //nolint:staticcheck // SA1019: grpc.WithBlock is deprecated but ensures synchronous CRI connection grpc.WithBlock(),