Trivy: Stop Shipping Vulnerable Containers to Production

Introduction #

Every container image shipped to production is a potential attack surface. Trivy scans container images, filesystems, Kubernetes clusters, and Infrastructure-as-Code for vulnerabilities, misconfigurations, secrets, and license issues — all in a single tool. With 600,000+ CVEs in its database and support for over 20 package formats, it has become one of the most widely adopted open-source security scanning tools in the cloud-native ecosystem.

What Is Trivy? #

Trivy (Japanese for “clear eyes,” from the phrase “clear eyes, full hearts, can’t lose”) is a comprehensive security scanner by Aqua Security that covers the entire software supply chain. Unlike traditional scanners that only check CVE databases, Trivy also detects misconfigured files, exposed secrets, and software licenses — making it a one-stop solution for application security teams.

┌─────────────────────────────────────────────┐
│              Trivy Scanner                   │
├─────────────────────────────────────────────┤
│  Scanners Available:                         │
│  • Vulnerabilities (CVE, GHSA, OSV)         │
│  • Secrets (API keys, tokens, passwords)     │
│  • Misconfigurations (Terraform, K8s, etc)  │
│  • Licenses (GPL, Apache, MIT)              │
│  • SAST (Sarif, CodeQL)                     │
│  • IaC (Terraform, CloudFormation)          │
├─────────────────────────────────────────────┤
│  Targets Supported:                          │
│  • Container images, tar archives           │
│  • Filesystem directories                   │
│  • Kubernetes clusters                       │
│  • Git repositories                          │
│  • Remote URLs                               │
│  • Virtual packages (Alpine, RHEL, etc)    │
└─────────────────────────────────────────────┘

How Trivy Works #

Trivy uses a layered scanning approach. For container images, it pulls the image layers, identifies the base OS and installed packages, then queries its vulnerability database. The scanning pipeline looks up each package against multiple vulnerability databases including the GitHub Advisory Database, OSV, and NVD (National Vulnerability Database).

Container Image → Layer Extraction → Package Detection
                            ↓
              Vulnerability DB Query (600K+ CVEs)
                            ↓
              Secret Detection (regex + ML rules)
                            ↓
              Misconfiguration Detection (policy engine)
                            ↓
              Score & Export (JSON, SARIF, Table)

For filesystem and Git repository scans, Trivy walks the directory tree, detects package managers (go.mod, package-lock.json, requirements.txt, etc.), and runs the same scanning pipeline. Kubernetes scans connect directly to the cluster API, collecting pod specs, deployments, and config maps for misconfiguration analysis.

Installation & Setup #

Trivy supports multiple installation methods. Choose the one that fits your workflow:

Option 1: Homebrew (macOS / Linux)

brew install trivy
trivy --version
# Expected: trivy version 0.65.x

Option 2: Docker (recommended for CI/CD)

docker run -v /tmp/trivy:/root/.trivy aquasec/trivy image python:3.11-alpine

Option 3: Download Binary

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

Option 4: GitHub Actions

- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: my-app:latest
    format: 'sarif'
    output: 'trivy-results.sarif'

Trivy’s vulnerability database auto-updates on first use and every 6 hours after that. You can also update manually:

trivy image --download-db-only

Integration with Docker, GitHub Actions, and Kubernetes #

Trivy integrates seamlessly into existing CI/CD pipelines. Here’s how to set it up with the most common tools.

Docker Buildx Integration

# Scan after building your image
docker build -t my-app:latest .
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image --severity HIGH,CRITICAL my-app:latest

GitHub Actions Workflow

name: Security Scan
on: [push, pull_request]
jobs:
  trivy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy on filesystem
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'table'
          severity: 'HIGH,CRITICAL'

Kubernetes Cluster Scan

# Scan an entire cluster for misconfigurations
trivy k8s --report summary cluster

# Export as JSON for further processing
trivy k8s --format json --output k8s-report.json cluster

Terraform Infrastructure Scanning

# Scan Terraform configs for misconfigurations
trivy conf ./infrastructure/

# Output SARIF for GitHub code scanning integration
trivy conf --format sarif --output terraform-results.sarif ./infrastructure/

Benchmarks / Real-World Use Cases #

Trivy’s performance depends on scan target and database size. In benchmarked tests against comparable tools:

| Scenario | Scan Time | Database Size | Accuracy | |