fix(sbom-scanner): confine grype scratch so /tmp stops filling up #38

Merged

jonas merged 1 commit from fix/sbom-scanner-tmp-accumulation into main

2026-07-03 10:00:27 +02:00

jonas commented

2026-07-03 09:59:51 +02:00

Owner

Problem

The sbom-scanner was failing with no space left on device when writing the downloaded SBOM to /tmp:

scan failed sbom_id=…: download sbom: write /tmp/sbom-scan-…/sbom.json: no space left on device

The Go code cleans up its own per-scan dir reliably (defer os.RemoveAll(tmpDir)), so this looked confusing — but the cleanup only covered our dir. grype was invoked without TMPDIR set, so it inherited the pod's TMPDIR=/tmp and wrote its cataloging / DB-extraction temp files directly into /tmp, outside the per-scan dir. Those leftovers accumulated across every job for the pod's whole lifetime until /tmp filled — the failure just happened to surface on our own small SBOM download.

Fix

Point grype's TMPDIR at the per-scan dir so its scratch is deleted with the scan, and at the disk-backed grype cache dir for db update so the DB tarball extraction never touches /tmp.
Sweep sbom-scan-* orphans at startup — left behind when a container is OOM-killed mid-scan, since the emptyDir survives container restarts and the defer never ran.
Fix the home volume mount (/home/runner → /home/scanner) so $HOME is writable rather than sitting on the read-only root fs.

The /tmp tmpfs stays at 256Mi: it only holds one scan's artifacts (SBOM + grype result, which the codebase documents can exceed 50 MB for EOL distros), and cross-job accumulation is now prevented at the source rather than by growing the volume.

🤖 Generated with Claude Code

## Problem The sbom-scanner was failing with `no space left on device` when writing the downloaded SBOM to `/tmp`: ``` scan failed sbom_id=…: download sbom: write /tmp/sbom-scan-…/sbom.json: no space left on device ``` The Go code cleans up its own per-scan dir reliably (`defer os.RemoveAll(tmpDir)`), so this looked confusing — but the cleanup only covered *our* dir. `grype` was invoked without `TMPDIR` set, so it inherited the pod's `TMPDIR=/tmp` and wrote its cataloging / DB-extraction temp files **directly into `/tmp`**, outside the per-scan dir. Those leftovers accumulated across every job for the pod's whole lifetime until `/tmp` filled — the failure just happened to surface on our own small SBOM download. ## Fix - Point grype's `TMPDIR` at the per-scan dir so its scratch is deleted with the scan, and at the disk-backed grype cache dir for `db update` so the DB tarball extraction never touches `/tmp`. - Sweep `sbom-scan-*` orphans at startup — left behind when a container is OOM-killed mid-scan, since the emptyDir survives container restarts and the `defer` never ran. - Fix the `home` volume mount (`/home/runner` → `/home/scanner`) so `$HOME` is writable rather than sitting on the read-only root fs. The `/tmp` tmpfs stays at 256Mi: it only holds one scan's artifacts (SBOM + grype result, which the codebase documents can exceed 50 MB for EOL distros), and cross-job accumulation is now prevented at the source rather than by growing the volume. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jonas added 1 commit

2026-07-03 09:59:51 +02:00

fix(sbom-scanner): confine grype scratch so /tmp stops filling up

Build and Deploy / build-image-scanner (push) Successful in 1m3s

Details

Build and Deploy / build-sbom-scanner (push) Successful in 1m29s

Details

Build and Deploy / build-repo-runner (push) Successful in 1m29s

Details

Build and Deploy / build-app (push) Successful in 3m30s

Details

Build and Deploy / deploy-helm (push) Successful in 19s

Details

02d742152b

grype inherited the pod's TMPDIR=/tmp and wrote its cataloging and
DB-extraction temp files directly there, outside the per-scan dir the
scanner cleans with defer os.RemoveAll. Its leftovers accumulated in
/tmp across every job for the pod's lifetime until writes failed with
"no space left on device" — surfacing on our own small SBOM download.

- Point grype's TMPDIR at the per-scan dir so its scratch dies with the
  scan, and at the disk-backed grype cache dir for db update so the DB
  tarball extraction never touches /tmp.
- Sweep sbom-scan-* orphans at startup, left behind when a container is
  OOM-killed mid-scan (emptyDir survives container restarts).
- Fix the home volume mount (/home/runner -> /home/scanner) so $HOME is
  writable rather than on the read-only root fs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

jonas merged commit 08ee0d47c1 into main

2026-07-03 10:00:27 +02:00

jonas referenced this pull request from a commit

2026-07-03 10:00:27 +02:00

fix(sbom-scanner): confine grype scratch so /tmp stops filling up (#38)

jonas deleted branch fix/sbom-scanner-tmp-accumulation

2026-07-03 10:00:27 +02:00