Security scans can now run on this node
v0.33.0-beta
- Security scans can now run on this node. The agent accepts a new scan command and knows how to run Trivy on an image or Semgrep on a repository's code, at the hub's request. Until now these analyses all ran on the server that serves your pages: moving them off frees processor at the precise moment they consumed the most. The report is returned as-is, without interpretation: the hub decides what counts as a vulnerability, never the machine running the scan.
- The agent announces whether it can scan. On connection it tells the hub whether Trivy and Semgrep are present, just as it does for Docker and buildx. A node without the tool is simply never picked for that scan; install it and it will be taken into account on the next reconnection, without restarting the agent.
- A large report arrives whole, or not at all. Vulnerability reports regularly exceed several megabytes, beyond what a frame accepts. The agent compresses them automatically above 256 KB, which typically divides them by ten. If a report is still too large, the agent says so explicitly instead of truncating it: a security report missing half its findings reads like a clean one, which is worse than a missing scan.
- Nothing is left on the machine after a scan. The repository cloned for Semgrep is erased when the analysis ends, whether it succeeded or failed, including when the clone itself failed. The registry credential, when the image to analyse is private, is confined to a temporary folder erased right after, and never goes through the command line where the machine's process list would expose it. The repository access token appears in no log and no error message.
- Scans honour the same ceilings as builds. A scan is cleanly refused when it would take the machine below its disk reserve, exactly as a build is: the hub then hands the analysis to another machine. Code analysis also applies the node's memory and core limits, and image analysis bounds its memory the same way. Without this, a large repository could exhaust the memory of a NAS or a shared PC and take down whatever was running beside it.
- An interrupted scan says so. If the agent stops mid-analysis, the reported message states that this is a platform restart, not a defect in the code analysed.