Trivy: scan images, code, IaC and Kubernetes for vulnerabilities, misconfigurations and secrets

A Docker image that "runs fine" may carry a base OS with dozens of known vulnerabilities, npm or pip libraries with CVEs, Terraform files exposing ports to the Internet, and forgotten secrets. Each of those usually needs a separate tool. Trivy from Aqua Security brings them into one CLI: it scans for vulnerabilities, misconfigurations and secrets and generates SBOMs for container images, code directories, git repos, infrastructure-as-code (IaC) files and even Kubernetes clusters.

GitHub: https://github.com/aquasecurity/trivy · about 39k stars · Go · Apache-2.0

Installation

brew install trivy
# Or run with Docker
docker run --rm aquasec/trivy image python:3.12-alpine

On first run, Trivy downloads its vulnerability database; later runs only update it.

Scan targets

Filtering results to what matters

A typical image may report hundreds of vulnerabilities, mostly low severity or without a fix. Filter to focus:

# HIGH and CRITICAL only, skip vulnerabilities without a fix
trivy image --severity HIGH,CRITICAL --ignore-unfixed myapp:1.4

# In CI: fail if critical vulnerabilities remain
trivy image --severity CRITICAL --ignore-unfixed --exit-code 1 myapp:1.4

# Ignore CVEs assessed as not applicable: list them in .trivyignore
echo "CVE-2023-12345" >> .trivyignore

Output formats

• --format table (default): readable in the terminal.
• --format json: for scripts and jq.
• --format sarif: upload to GitHub's Security tab (code scanning).
• --format cyclonedx or spdx-json: generate an SBOM (software bill of materials), e.g. trivy image --format cyclonedx -o sbom.json myapp:1.4.

Caveats

• Not every CVE is exploitable in your context; use .trivyignore with a note explaining why, and review it periodically.
• The most effective way to cut vulnerabilities is usually a smaller base image (slim, distroless) and regular updates, not fixing CVEs one by one.
• In CI, cache the vulnerability database to avoid downloading it on every run.
• Results are only valid at scan time; new CVEs appear daily, so rescan running images on a schedule.

How to apply it

• Dev: Run trivy fs . before opening a PR to spot vulnerable libraries and leftover secrets.
• Tech Lead/DevOps: Add trivy image --exit-code 1 --severity CRITICAL after image builds in CI, run trivy config on Terraform/Kubernetes folders, and store an SBOM for each release.
• PM: SBOMs and scan reports are increasingly required by enterprise customers and regulations; Trivy provides them without tooling costs.