Scanning Docker Images With Trivy

agentic-workflows-blueprint.workflow.scanning-docker-images-with-trivy

Goal

Perform comprehensive Docker image security assessment with Trivy, including vulnerabilities, misconfigurations, secrets, and SBOM generation, with clear remediation gates.

Scope

• Applies to: local or CI-driven Docker image scans before distribution or deployment.
• Does not cover: orchestrator runtime detection and response.

Triggers

• "Scan Docker image with Trivy"
• "Generate security report/SBOM for image"
• "Check private registry image before release"
• "Enforce critical/high CVE gate"

Inputs

• imageRef: local image, tarball input, or registry image reference
• scannerSet (optional): vuln, misconfig, secret, license
• severityPolicy: severity levels considered blocking
• outputFormat: table, JSON, SARIF, CycloneDX, SPDX
• registryAuthContext (optional): credentials and target registry
• ignorePolicy (optional): approved ignore file/entries

Invariants

• Scans must clearly identify scanned image digest/tag and DB timestamp.
• Blocking policy must be deterministic and explicit.
• Ignore entries must be reviewed and justified.
• Outputs must remain auditable and machine-consumable when used in gates.

Procedure

1. Prepare scan environment

   • Validate Trivy installation/version and DB update strategy.
   • Ensure image is available locally or accessible from registry.

2. Run baseline vulnerability scan

   • Scan image with selected severities and fail policy.
   • Capture artifact in configured format.

3. Expand scan dimensions as needed

   • Run additional scanner sets (misconfig, secret, license) where required.
   • Scan Dockerfile/config paths when build-time posture must be validated.

4. Generate SBOM

   • Emit SBOM in CycloneDX or SPDX.
   • Link SBOM to scanned image identity.

5. Apply policy exceptions safely

   • Apply ignore list only through approved and traceable mechanism.
   • Re-run scan to verify resulting gate behavior.

6. Assess private registry images

   • Authenticate and scan protected images.
   • Ensure no credential leakage in logs/artifacts.

7. Finalize remediation report

   • Summarize critical/high findings, affected packages, and fixed versions.
   • Mark pass/fail according to severityPolicy.

Outputs

• Trivy vulnerability report for target image.
• Extended scan report (misconfig/secret/license when enabled).
• SBOM artifact for image.
• Gate summary with blocking findings and remediation priorities.

Review gate

• Scan identifies image reference and supports reproducibility.
• Blocking vulnerabilities are surfaced with remediation context.
• SBOM is generated and attached when required.
• Exception handling is traceable and policy-compliant.
• Final pass/fail decision matches configured severity policy.

References

• ../../SKILL.md
• ../scanning-containers-with-trivy-in-cicd/SKILL.md
• ../implementing-devsecops-security-scanning/SKILL.md
• Interactive HTML View