Trivy

4 December 20251 min read

Trivy is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

Targets (what Trivy can scan):

• Container Image

• Filesystem

• Git Repository (remote)

• Virtual Machine Image

• Kubernetes

Scanners (what Trivy can find there):

• OS packages and software dependencies in use (SBOM)

• Known vulnerabilities (CVEs)

• IaC issues and misconfigurations

• Sensitive information and secrets

• Software licenses

Trivy also has a kubernetes operator.

Usage

Usage: trivy [command] [options]

Commands:

• config: Scan config files for misconfigurations

• filesystem: Scan local filesystem

• image: Scan a container image

• kubernetes: Scan kubernetes cluster

• repository: Scan a repository

• rootfs: Scan rootfs

• sbom: Scan SBOM for vulnerabilities and licenses

• vm: Scan a virtual machine image