What steps did you take and what happened:

I added scanJob.customVolumes and scanJob.customVolumesMount to trivy-operator cm.

% kubectl get cm trivy-operator -n trivy-system -o yaml |grep scanJob.customVolumes
  scanJob.customVolumes: '[{"hostPath":{"path":"/run/containerd/containerd.sock","type":"Socket"},"name":"containerd-sock"}]'
  scanJob.customVolumesMount: '[{"mountPath":"/opt/run/containerd/containerd.sock","name":"containerd-sock"}]'

After creating scan-vulnerabilityreport job I inspected container's volumeMounts and volumes, then I got the results that customVolumes were appended to volumes but customVolumesMount were not appended to container's volumeMounts.

...snip...
  // not appended custom volumeMounts.
          volumeMounts:
          - mountPath: /tmp
            name: tmp
...snip...
        volumes:
...snip...
  // appended custom volumes.
        - hostPath:
            path: /run/containerd/containerd.sock
            type: Socket
          name: containerd-sock

What did you expect to happen:

customVolumesMount will be appended to container's volumeMounts.

Anything else you would like to add:

It caused by below. container is a pass-by-value and this change doesn't affect the original array.
https://github.com/aquasecurity/trivy-operator/blob/v0.22.0/pkg/vulnerabilityreport/builder.go#L168-L175

I will fix it and make PR.

Environment:

• Trivy-Operator version (use trivy-operator version): v0.22.0
• Kubernetes version (use kubectl version): v1.29.6
• OS (macOS 10.15, Windows 10, Ubuntu 19.10 etc): Ubuntu 22.04.4 LTS