Trivy Container Scanner: Docker Image & IaC Security Scanning

Trivy is an open-source, all-in-one vulnerability and misconfiguration scanner from Aqua Security. It scans container images, filesystems, Git repositories, Kubernetes manifests, and Terraform — making it the go-to tool for cloud-native security pipelines.

What is Trivy?

Trivy (Trivial Vulnerability scanner) detects CVEs in OS packages and language-specific dependencies, misconfigurations in IaC files, and exposed secrets in source code — all with a single binary and no daemon required. It's widely adopted in Kubernetes environments and integrates natively with GitHub Actions, GitLab CI, and ArgoCD.

Installation

# Homebrew (macOS/Linux)
brew install aquasecurity/trivy/trivy

# Debian/Ubuntu
sudo apt-get install wget apt-transport-https gnupg
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list
sudo apt-get update && sudo apt-get install trivy

# Docker
docker run --rm aquasec/trivy image nginx:latest

Scan Docker Images

# Scan a public image
trivy image nginx:latest

# Scan your own image
trivy image myapp:1.0.0

# Only show CRITICAL and HIGH
trivy image --severity CRITICAL,HIGH myapp:1.0.0

# Skip unfixed vulnerabilities (less noise)
trivy image --ignore-unfixed myapp:1.0.0

# Output as JSON
trivy image --format json --output report.json myapp:1.0.0

Scan Filesystem & Git Repos

# Scan local filesystem (app dependencies + secrets)
trivy fs .

# Scan a git repository remotely
trivy repo https://github.com/myorg/myrepo

# Scan with secret detection enabled
trivy fs --scanners secret .

# Scan specific directory
trivy fs --scanners vuln,secret ./src/

Scan IaC — Terraform & Kubernetes

# Scan Terraform files
trivy config ./terraform/

# Scan Kubernetes YAML manifests
trivy config ./k8s/

# Scan Helm chart
trivy config ./charts/myapp/

# Scan a single file
trivy config deployment.yaml

IaC scanning catches issues like containers running as root, missing read-only root filesystems, privilege escalation enabled, hostPath volumes, and open ingress ports — all before kubectl apply.

GitHub Actions Integration

name: Trivy Security Scan

on: [push, pull_request]

jobs:
  trivy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:{{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:{{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

      - name: Upload SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

Output Formats

Trivy vs Alternatives