Base layer cache hit, but no scan-time improvement across runs

[10salman10]

Question

Following up on #9414

Observation

• Even when the Docker base layer is consistently cached across pipeline runs, rescanning the same Dockerfile shows little to no improvement in total scan time (~5 minutes).
• Trivy logs indicate the base layer is detected and cached, yet overall duration remains roughly unchanged.

Example Dockerfile

FROM nvcr.io/nvidia/tritonserver:25.06-py3

RUN apt-get update && apt-get install -y curl \
    && rm -rf /var/lib/apt/lists/

Details

• The base image layer hash remains stable between runs.
• The base image is large (~19 GiB), so we expected noticeable speed-ups from cache reuse.
• However, even with cache hits reported, end-to-end scan time is effectively identical.

Question

• Is this expected behavior? Which parts of the scan are (or are not) accelerated by layer caching (e.g., DB update, unpack/index, SBOM generation, secrets/misconfig scanners)?
• Are there recommended flags or setups to realize cache benefits in CI (e.g., persistent cache volume, registry/remote cache, trivy server, offline DB updates)?

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Operating System

No response

Version

No response