Trivy: scan images from the local containerd store before the registry

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/config.rs

@@ -13,6 +13,8 @@ pub struct Config {
     pub kubeconfig: Option<String>,
     /// kubectl invocation for backups, e.g. ["/snap/bin/microk8s", "kubectl"].
     pub kubectl: Vec<String>,
+    /// containerd socket for local image scans (default: microk8s socket if present).
+    pub containerd_socket: Option<String>,
     /// Scratch directory for backup archives.
     pub work_dir: std::path::PathBuf,
     pub bind: SocketAddr,
@@ -47,6 +49,12 @@ impl Config {
                         vec!["kubectl".into()]
                     }
                 }),
+            containerd_socket: env("CONTAINERD_ADDRESS").or_else(|| {
+                let microk8s = "/var/snap/microk8s/common/run/containerd.sock";
+                std::path::Path::new(microk8s)
+                    .exists()
+                    .then(|| microk8s.to_string())
+            }),
             work_dir: env("WORK_DIR")
                 .map(Into::into)
                 .unwrap_or_else(|| "data/work".into()),

backend/crates/api/src/lib.rs

@@ -89,7 +89,10 @@ impl AppState {
                 inspector: Arc::new(DebianInspector::new(runner.clone())),
                 updater: Arc::new(DebianUpdater::new(runner.clone())),
                 cluster: Arc::new(KubeGateway::new(cfg.kubeconfig.clone())),
-                scanner: Arc::new(TrivyScanner::new(runner.clone())),
+                scanner: Arc::new(match &cfg.containerd_socket {
+                    Some(sock) => TrivyScanner::new(runner.clone()).with_containerd(sock),
+                    None => TrivyScanner::new(runner.clone()),
+                }),
                 storage: Arc::new(CommandBackupStorage::new(runner.clone())),
                 collector: Arc::new(KubeBackupCollector::new(
                     runner.clone(),

backend/crates/api/src/test_support.rs

@@ -18,6 +18,7 @@ pub fn test_config() -> Config {
         fake_host: true,
         kubeconfig: None,
         kubectl: vec!["kubectl".into()],
+        containerd_socket: None,
         work_dir: std::env::temp_dir().join(format!("monitoring-test-{}", uuid::Uuid::new_v4())),
         bind: "127.0.0.1:0".parse().unwrap(),
         bootstrap_admin: None,