Trivy

Image Scanning Commands

Scan Docker images for vulnerabilities, misconfigurations, and secrets in container layers.

6 commands

Pro Tips

Use --severity HIGH,CRITICAL to focus on important issues

Use --ignore-unfixed to hide vulnerabilities without fixes

Common Mistakes

First scan downloads vulnerability database (~30MB)

Commands

Scan image

$ trivy image nginx:latest

Scan a container image for vulnerabilities.

Scan with severity filter

$ trivy image --severity HIGH,CRITICAL nginx:latest

Show only high and critical vulnerabilities.

Ignore unfixed

$ trivy image --ignore-unfixed nginx:latest

Hide vulnerabilities without fixes.

JSON output

$ trivy image -f json -o results.json nginx:latest

Output results as JSON.

Scan for secrets

$ trivy image --scanners secret nginx:latest

Scan image for embedded secrets.

Scan local image

$ trivy image --input myapp.tar

Scan a local image tarball.