Trivy

Comprehensive security scanner for containers, filesystems, and IaC. Find vulnerabilities, misconfigurations, and secrets.

30 commands

Browse by Topic

Getting Started

Quick setup and installation

3commands

Image Scanning

Scan container images

6commands

Filesystem

Scan project files

4commands

Repository

Scan Git repos

4commands

IaC Scanning

Scan Terraform, K8s

4commands

SBOM

Software bill of materials

4commands

Kubernetes

Scan running clusters

5commands

Install Trivy (macOS)

$ brew install trivy

Install Trivy security scanner using Homebrew on macOS

Install Trivy (Linux)

$ sudo apt install trivy -y

Install Trivy security scanner on Debian/Ubuntu Linux

Check Trivy version

$ trivy --version

Verify Trivy installation and display version info

Scan image

$ trivy image nginx:latest

Scan a container image for vulnerabilities.

Scan with severity filter

$ trivy image --severity HIGH,CRITICAL nginx:latest

Show only high and critical vulnerabilities.

Ignore unfixed

$ trivy image --ignore-unfixed nginx:latest

Hide vulnerabilities without fixes.

JSON output

$ trivy image -f json -o results.json nginx:latest

Output results as JSON.

Scan for secrets

$ trivy image --scanners secret nginx:latest

Scan image for embedded secrets.

Scan local image

$ trivy image --input myapp.tar

Scan a local image tarball.

Scan directory

$ trivy fs .

Scan current directory for vulnerabilities.

Scan with skip

$ trivy fs --skip-dirs node_modules,vendor .

Scan and skip certain directories.

Scan lock files

$ trivy fs --scanners vuln package-lock.json

Scan specific lock file.

Exit code on findings

$ trivy fs --exit-code 1 --severity HIGH,CRITICAL .

Exit with code 1 if vulnerabilities found.

Scan Git repo

$ trivy repo https://github.com/user/repo

Scan a remote Git repository.

Scan for secrets

$ trivy repo --scanners secret https://github.com/user/repo

Scan repository for secrets.

Scan specific branch

$ trivy repo --branch develop https://github.com/user/repo

Scan a specific branch.

Scan with commit

$ trivy repo --commit abc123 https://github.com/user/repo

Scan at specific commit.

Scan Terraform

$ trivy config ./terraform

Scan Terraform files for misconfigurations.

Scan Kubernetes

$ trivy config ./k8s-manifests

Scan Kubernetes manifests.

Compliance check

$ trivy config --compliance docker-cis ./

Run compliance benchmark checks.

Scan Dockerfile

$ trivy config Dockerfile

Scan Dockerfile for issues.

Generate CycloneDX

$ trivy image --format cyclonedx -o sbom.json nginx:latest

Generate CycloneDX SBOM.

Generate SPDX

$ trivy image --format spdx-json -o sbom.spdx.json nginx:latest

Generate SPDX SBOM.

Scan existing SBOM

$ trivy sbom sbom.json

Scan an existing SBOM for vulnerabilities.

Filesystem SBOM

$ trivy fs --format cyclonedx -o sbom.json .

Generate SBOM for filesystem.

Scan cluster

$ trivy k8s --report summary cluster

Scan entire Kubernetes cluster.

Scan namespace

$ trivy k8s --namespace default all

Scan specific namespace.

Scan workloads

$ trivy k8s --report all deployments,pods

Scan specific resource types.

Compliance scan

$ trivy k8s --compliance k8s-nsa cluster

Run NSA K8s hardening compliance.

Scan with context

$ trivy k8s --context=prod-cluster all

Scan using specific kubeconfig context.

Discussion

Loading comments...

Trivy

Comprehensive security scanner for containers, filesystems, and IaC. Find vulnerabilities, misconfigurations, and secrets.

30 commands

Browse by Topic

Getting Started

Quick setup and installation

3commands

Image Scanning

Scan container images

6commands

Filesystem

Scan project files

4commands

Repository

Scan Git repos

4commands

IaC Scanning

Scan Terraform, K8s

4commands

SBOM

Software bill of materials

4commands

Kubernetes

Scan running clusters

5commands

Install Trivy (macOS)

$ brew install trivy

Install Trivy security scanner using Homebrew on macOS

Install Trivy (Linux)

$ sudo apt install trivy -y

Install Trivy security scanner on Debian/Ubuntu Linux

Check Trivy version

$ trivy --version

Verify Trivy installation and display version info

Scan image

$ trivy image nginx:latest

Scan a container image for vulnerabilities.

Scan with severity filter

$ trivy image --severity HIGH,CRITICAL nginx:latest

Show only high and critical vulnerabilities.

Ignore unfixed

$ trivy image --ignore-unfixed nginx:latest

Hide vulnerabilities without fixes.

JSON output

$ trivy image -f json -o results.json nginx:latest

Output results as JSON.

Scan for secrets

$ trivy image --scanners secret nginx:latest

Scan image for embedded secrets.

Scan local image

$ trivy image --input myapp.tar

Scan a local image tarball.

Scan directory

$ trivy fs .

Scan current directory for vulnerabilities.

Scan with skip

$ trivy fs --skip-dirs node_modules,vendor .

Scan and skip certain directories.

Scan lock files

$ trivy fs --scanners vuln package-lock.json

Scan specific lock file.

Exit code on findings

$ trivy fs --exit-code 1 --severity HIGH,CRITICAL .

Exit with code 1 if vulnerabilities found.

Scan Git repo

$ trivy repo https://github.com/user/repo

Scan a remote Git repository.

Scan for secrets

$ trivy repo --scanners secret https://github.com/user/repo

Scan repository for secrets.

Scan specific branch

$ trivy repo --branch develop https://github.com/user/repo

Scan a specific branch.

Scan with commit

$ trivy repo --commit abc123 https://github.com/user/repo

Scan at specific commit.

Scan Terraform

$ trivy config ./terraform

Scan Terraform files for misconfigurations.

Scan Kubernetes

$ trivy config ./k8s-manifests

Scan Kubernetes manifests.

Compliance check

$ trivy config --compliance docker-cis ./

Run compliance benchmark checks.

Scan Dockerfile

$ trivy config Dockerfile

Scan Dockerfile for issues.

Generate CycloneDX

$ trivy image --format cyclonedx -o sbom.json nginx:latest

Generate CycloneDX SBOM.

Generate SPDX

$ trivy image --format spdx-json -o sbom.spdx.json nginx:latest

Generate SPDX SBOM.

Scan existing SBOM

$ trivy sbom sbom.json

Scan an existing SBOM for vulnerabilities.

Filesystem SBOM

$ trivy fs --format cyclonedx -o sbom.json .

Generate SBOM for filesystem.

Scan cluster

$ trivy k8s --report summary cluster

Scan entire Kubernetes cluster.

Scan namespace

$ trivy k8s --namespace default all

Scan specific namespace.

Scan workloads

$ trivy k8s --report all deployments,pods

Scan specific resource types.

Compliance scan

$ trivy k8s --compliance k8s-nsa cluster

Run NSA K8s hardening compliance.

Scan with context

$ trivy k8s --context=prod-cluster all

Scan using specific kubeconfig context.

Discussion

Loading comments...