TL;DR: Add the registry and database hosts to the proxy allowlist and make sure trivy inherits the proxy settings. Trivy makes direct HTTPS connections for the image registry and the vulnerability database, so an allowlist proxy blocks both unless the hosts are permitted. As a fallback, pre-download the database and scan fully offline.

```text
failed to fetch ghcr.io
```

1. Confirm the proxy is the blocker: fetch the registry host with a plain HTTPS client from the same environment. Expected: it fails the same way, proving the problem is environmental, not trivy-specific.
2. Get the registry host and the vulnerability database host added to the proxy allowlist. Expected: the network team confirms both hosts are permitted.
3. Make the proxy settings visible to the trivy process: export them in the shell or CI job that runs the scan. Expected: trivy picks up the proxy and the fetch succeeds.
4. Re-run the scan and watch for the database download and the registry fetch. Expected: both complete and the scan proceeds.
5. If the allowlist cannot be changed, download the database on an allowed host, copy it in, and run the scan with the offline-scan flag. Expected: the scan completes with zero egress.

## Use this when
- trivy cannot reach ghcr.io or the database host
- egress requires an allowlist proxy
- fetch errors appear before scanning starts
- the same scan works outside the restricted network

## Not for this skill when
- the proxy allows the host but credentials are wrong (a 407 problem)
- DNS fails for everything (a DNS problem)
- the registry itself is down
- the database downloads but the scan fails later

## Variant phrasings
- trivy failed to fetch behind proxy
- trivy ghcr.io blocked
- trivy egress proxy allowlist
- trivy cannot reach registry through proxy

## Why it happens
Trivy needs HTTPS access to the image registry and to its vulnerability database host. An allowlist-only egress proxy denies any host not on the list, so both fetches fail before scanning starts - even when the proxy itself is working fine.

## Edge cases
- the database host and the registry host are different - allowlisting only ghcr.io still breaks the database download
- some proxies require authentication that CI runners lack - rule out 407s separately
- offline mode needs the database refreshed on a schedule or findings go stale
- proxy environment variables set for the shell may not reach containerized trivy - pass them into the container explicitly

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_EtPsczuTka1mK_BrklJCTg