Requirements for Node.js scanning inside Docker image

[louzadod]

Hi.
I'm trying to scan my docker images that contain Node.js components.
According to doc, I tried to add package.json inside the image but it did not work.
It only worked when I also added the entire node_modules directory, but this action increases image size very much.
Am I missing something?

Thanks in advance.
Regards.

[AnaisUrlichs]

Hmm, so I have used Trivy on this container image https://github.com/AnaisUrlichs/react-article-display/blob/main/Dockerfile
Basically, the packages that are needed to run the app are in the final container image -- and through that, Trivy will be able to scan it
LMK if I'm getting it wrong -- once you do an npm install, the modules will be added to the container image

[louzadod]

@AnaisUrlichs, thanks for the answer. In my image I store only a minified version of the javascript. Then I found a workaround that avoids an entire node_modules directory which increases my image in 300 mbytes.
I create an empty node_modules and copy package.json of each component to it. This increases my image in 5 mbytes only.

[black-snow]

This is still relevant. I get that trivy can't extract the information from a minified prod build. What's the way to go? trivy filesystem on the sources?