TroveGrid
Back to all tools
Trivy logo

Trivy

All-in-one open-source vulnerability and misconfiguration scanner.

0Open Source
Security Container Security Vulnerability Scanning
Official Website View on GitHub
Share:XLinkedInWhatsApp

Overview

A simple and comprehensive vulnerability scanner for containers and other artifacts, by Aqua Security.

Key Features

  • Scans container images, filesystems, Git repos, and Kubernetes clusters
  • Detects OS package vulnerabilities, language dependencies, and IaC misconfigurations
  • Secret scanning for accidentally committed credentials
  • SBOM generation in CycloneDX and SPDX formats
  • Fast local scanning with no daemon or server required
  • Native integrations with CI/CD pipelines and Kubernetes admission controllers

Real-World Workflows

Container image scanning in CI/CD

  1. 1Add a Trivy scan step after the Docker build in the CI pipeline
  2. 2Run: trivy image --exit-code 1 --severity CRITICAL myapp:latest
  3. 3Pipeline fails automatically if CRITICAL CVEs are found
  4. 4Generate a SARIF report and upload to GitHub Security tab for visibility
  5. 5Use .trivyignore to suppress accepted false positives

Kubernetes cluster misconfiguration audit

  1. 1Run trivy k8s --report summary cluster to scan all running workloads
  2. 2Trivy checks for privileged containers, missing resource limits, and exposed secrets
  3. 3Export results as JSON and feed into a Grafana dashboard
  4. 4Integrate as a pre-apply admission webhook to block non-compliant manifests

Getting Started

brew install aquasecurity/trivy/trivy
# Scan a Docker image:
trivy image nginx:latest
# Scan a repo for secrets and misconfigs:
trivy fs .

Compare Alternatives

See how Trivy stacks up against similar tools.

VSclairVSaquaVStwistlockVSsonatype nexus