Trivy

trivy

Container / code / IaC vulnerability scanner — CVEs, misconfigs, secrets.

Quick Start

# Scan Docker image
trivy image nginx:latest

# Scan filesystem
trivy fs /path/to/code

# Scan Git repo
trivy repo https://github.com/org/project

Scan Types

Core Flags

Common Workflows

# Container image scan (high/critical only)
trivy image --severity HIGH,CRITICAL nginx:latest

# Image scan with JSON output
trivy image --format json --output nginx_scan.json nginx:latest

# Show only fixable vulnerabilities
trivy image --ignore-unfixed nginx:latest

# Scan image with secrets detection
trivy image --scanners vuln,secret nginx:latest

# Scan private registry image
trivy image --username admin --password secret registry.company.com/app:v1.0

# Filesystem scan (source code + dependencies)
trivy fs --scanners vuln,secret,misconfig /path/to/project

# Git repository scan
trivy repo --scanners vuln,secret https://github.com/target/repo

# IaC/config scan (Terraform, k8s, Dockerfile)
trivy config ./infrastructure/
trivy config --severity HIGH,CRITICAL k8s/

# SBOM generation
trivy image --format cyclonedx --output sbom.json nginx:latest
trivy image --format spdx-json --output sbom.spdx.json nginx:latest

# Analyze existing SBOM
trivy sbom sbom.json

# Kubernetes cluster scan
trivy k8s --severity HIGH,CRITICAL --report summary cluster

# AWS account misconfiguration scan
trivy aws --severity HIGH,CRITICAL --region us-east-1
trivy aws --service s3,iam,ec2 --severity CRITICAL  # specific services

# Compliance benchmarks (CIS, etc.)
trivy image --compliance docker-cis-1.6.0 nginx:latest
trivy k8s --compliance k8s-cis-1.23 cluster

# VM image scan
trivy vm --severity HIGH,CRITICAL machine.vmdk

# Dependency tree (show package relationships)
trivy image --dependency-tree nginx:latest

# Scan with exit code for CI (fail if HIGH+ found)
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest
echo $?  # non-zero = findings found

Scanners

# Vulnerability scanning (default)
trivy image --scanners vuln nginx:latest

# Secret scanning
trivy fs --scanners secret .

# Misconfiguration scanning
trivy config --scanners misconfig ./k8s/

# All scanners combined
trivy fs --scanners vuln,secret,misconfig,license .

Secret Detection

# Secrets trivy finds:
# - AWS access keys / secret keys
# - GitHub tokens
# - Slack tokens
# - Private keys (RSA/DSA/EC)
# - Database URLs with credentials
# - Docker registry credentials
# - Generic API keys and passwords

# Scan filesystem for secrets:
trivy fs --scanners secret --format json -o secrets.json /path/to/project

# Scan image filesystem for secrets:
trivy image --scanners secret --format json myapp:latest

# Custom secret config:
cat > custom-secret-config.yaml << 'EOF'
rules:
  - id: custom-api-key
    category: general
    title: Custom API Key
    severity: HIGH
    regex: 'MYAPI_[A-Z0-9]{32}'
EOF
trivy fs --secret-config custom-secret-config.yaml --scanners secret .

Misconfiguration Detection

# What trivy checks for misconfigs:
# - Dockerfile: root user, ADD vs COPY, insecure curl-pipe-bash
# - Terraform: public S3 buckets, unrestricted SGs, no encryption
# - Kubernetes: privileged containers, missing resource limits, host PID/network
# - Helm: default values, insecure settings
# - Docker Compose: privileged mode, bind mounts to sensitive paths

trivy config --severity HIGH,CRITICAL ./terraform/
trivy config ./k8s/
trivy config Dockerfile

Output Parsing

# JSON output structure
trivy image --format json -o scan.json nginx:latest

# Extract CVE list:
cat scan.json | jq '.Results[] | .Vulnerabilities[]? | {cve: .VulnerabilityID, pkg: .PkgName, severity: .Severity, fixed: .FixedVersion}'

# Critical vulns only:
cat scan.json | jq '.Results[] | .Vulnerabilities[]? | select(.Severity == "CRITICAL") | {cve: .VulnerabilityID, pkg: .PkgName}'

# Count by severity:
cat scan.json | jq '[.Results[] | .Vulnerabilities[]? | .Severity] | group_by(.) | map({severity: .[0], count: length})'

# Find vulns with fixes available:
cat scan.json | jq '.Results[] | .Vulnerabilities[]? | select(.FixedVersion != null and .FixedVersion != "") | {cve: .VulnerabilityID, current: .InstalledVersion, fixed: .FixedVersion}'

# SARIF output for GitHub Advanced Security:
trivy image --format sarif -o trivy.sarif myapp:latest

.trivyignore File

# .trivyignore — suppress specific findings
cat > .trivyignore << 'EOF'
# CVE to ignore (add comment with expiry date)
CVE-2022-1234  # false positive - not exploitable in our config, review 2025-01-01
CVE-2021-5678  # dependency locked by framework, no fix available
EOF

trivy image --trivyignore .trivyignore nginx:latest

CI Integration

# GitHub Actions:
# - uses: aquasecurity/trivy-action@master
#   with:
#     image-ref: 'myapp:latest'
#     format: 'sarif'
#     output: 'trivy-results.sarif'
#     severity: 'CRITICAL,HIGH'
#     exit-code: '1'
#     ignore-unfixed: true

# GitLab CI:
# container_scan:
#   image: aquasec/trivy:latest
#   script:
#     - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG

# Pre-commit hook:
trivy fs --exit-code 1 --severity CRITICAL --scanners secret .

Resources