Update trivy version and run as non-root by default

Dockerfile

@@ -10,7 +10,7 @@ RUN apk add --no-cache $deps
 
 ENV CGO_ENABLED 0
 
-ENV TRIVY_VERSION 0.12.0
+ENV TRIVY_VERSION 0.15.0
 
 RUN curl -sSL https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz | tar -zx -C /tmp
 
@@ -25,11 +25,14 @@ COPY cmd /build/cmd
 COPY pkg /build/pkg
 RUN --mount=type=cache,target=/root/.cache/go-build go build -trimpath -o /usr/local/bin/main -ldflags="-s -w" /build/cmd/main.go
 
-FROM alpine:3.9
+FROM alpine:3.13
 COPY --from=builder /usr/local/bin/main /usr/local/bin/main
 COPY --from=builder /tmp/trivy /usr/local/bin/trivy
 
-RUN apk add --no-cache git
+RUN apk add --no-cache git && \
+    addgroup -S -g 10001 kube-trivy-exporter && \
+    adduser -S -u 10001 kube-trivy-exporter -G kube-trivy-exporter
 
+USER 10001:10001
 ENTRYPOINT ["/usr/local/bin/main"]
 CMD ["server"]

manifests/stateful_set.yaml

@@ -28,6 +28,7 @@ spec:
           #  value: "65535"
           - name: net.ipv4.ip_local_port_range
             value: "10000 65535"
+        fsGroup: 10001
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -42,13 +43,19 @@ spec:
               weight: 100
       containers:
         - name: kube-trivy-exporter
-          image: docker.pkg.github.com/kaidotdev/kube-trivy-exporter/kube-trivy-exporter:v1.1.0
+          image: ghcr.io/chgl/kube-trivy-exporter:update-trivy-run-as-non-root
           imagePullPolicy: Always
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            runAsUser: 10001
+            runAsGroup: 10001
           args:
             - server
             - --api-address=0.0.0.0:8000
             - --monitor-address=0.0.0.0:9090
-            - --enable-tracing
+            # - --enable-tracing
             - --trivy-concurrency=30
             - --collector-loop-interval=3600
           env:
@@ -69,7 +76,7 @@ spec:
             timeoutSeconds: 1
           volumeMounts:
             - name: cache
-              mountPath: /root/.cache/trivy
+              mountPath: /home/kube-trivy-exporter/.cache/trivy
   volumeClaimTemplates:
     - metadata:
         name: cache