add docs

aquasecurity · Oct 10, 2024 · c4d3c8d · c4d3c8d
1 parent 74c53f8
commit c4d3c8d
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/docs/docs/configuration/db.md b/docs/docs/configuration/db.md
@@ -92,6 +92,21 @@ You can reference the OCI manifest of [trivy-db].
  `trivy-db-registry:latest` => `trivy-db-registry:latest`, but `trivy-db-registry` => `trivy-db-registry:2`.
 
 
+### Rate limits
+
+Trivy hosts its databases on public OCI registries that are subject to their respective rate limits. While we strive to make the databases available to every
+Trivy user, there are certain recommendations that one can make in order to ensure rate limits are not hit.
+
+#### Authenticated use of Registries
+By authenticating with the registries that Trivy hosts its DBs on can significantly increase the limit for users. For Amazon ECR the details for rate limits can be found [here](https://docs.aws.amazon.com/AmazonECR/latest/public/public-service-quotas.html).
+For GitHub GHCR, the rate limits can be found [here](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28)
+
+Please see more info on how to authenticate with ECR [here](https://aws.amazon.com/blogs/compute/authenticating-amazon-ecr-repositories-for-docker-cli-with-credential-helper/) and GHCR [here](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry)
+
+#### Caching DBs
+Trivy DB and Trivy Java DB are published every 24 hours. If you are running Trivy scans more often than this, you can significantly benefit from caching the DBs on each run and updating them as needed.
+Once example of this can be seen in Trivy Action, where with caching multiple CI invocations can be performed with a single download of the DBs. More on info Trivy Action caching can be found [here](https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#cache)
+
 ## Java Index Database
 The same options are also available for the Java index DB, which is used for scanning Java applications.
 Skipping an update can be done by using the `--skip-java-db-update` option, while `--download-java-db-only` can be used to only download the Java index DB.