Trivy tells you which known vulnerabilities are present in something you are about to run. It scans container images, filesystems, repositories, and Kubernetes clusters with one tool and one command shape.

The basic use

# A container image
trivy image nginx:latest

# Only what matters
trivy image --severity HIGH,CRITICAL nginx:latest

# A local filesystem or project
trivy fs /path/to/project

# A Git repository
trivy repo https://github.com/example/project

It reads package manifests and installed package databases, matches them against vulnerability feeds, and reports what is known to be affected.

Why it is worth running on your own images

The base image you built on six months ago has accumulated vulnerabilities since. Nothing tells you, and the image keeps working.

For a self-hoster, the useful habit is scanning the images you actually run:

docker images --format '{{.Repository}}:{{.Tag}}' | grep -v '<none>' | \
  xargs -I{} trivy image --severity HIGH,CRITICAL --quiet {}

That produces a short list of things worth updating, which is more actionable than a general intention to keep containers current.

Beyond vulnerabilities

Misconfiguration scanning for Dockerfiles, Kubernetes manifests, and Terraform, catching things like containers running as root.

Secret detection for credentials committed into an image or repository.

SBOM generation in CycloneDX or SPDX format, listing what is actually inside an artefact.

Reading the output sensibly

A long list of CVEs is not a list of exploitable problems. Many affect code paths your application never reaches, and some have no fix available yet.

Filter to HIGH and CRITICAL with --ignore-unfixed to see what you can actually act on. A scan that reports two hundred findings gets ignored; one that reports four gets fixed.

Alternatives

Grype covers image and filesystem scanning with a similar approach and pairs with Syft for SBOM generation. Trivy covers more ground in one tool.

License

Trivy is released under the Apache License 2.0.

Links

• Website
• Repository