Trivy

Trivy scans a wide range of targets beyond just container images, providing a unified security tool for the entire stack.

• Container Images: Scans OS packages and application dependencies in Docker, containerd, and OCI images
• Filesystems: Analyzes local directories, root filesystems, and virtual machine images
• Git Repositories: Scans commit history and current state for secrets and misconfigurations
• Kubernetes: Audits cluster resources and pod configurations against best practices
• Infrastructure as Code: Checks Terraform, CloudFormation, and Dockerfile configurations for security issues

Trivy maintains an extensive, continuously updated database of known vulnerabilities sourced from multiple authoritative feeds.

• OS Packages: Detects CVEs in Alpine, Red Hat, Ubuntu, Debian, SUSE, and Amazon Linux packages
• Language-Specific Libraries: Scans dependencies for Java (JAR, WAR), Node.js (npm/yarn), Python (pip/Poetry), Ruby (Bundler), Rust (Cargo), and Go (modules)
• Database Sources: Aggregates from NVD, Red Hat OVAL, Debian Security Tracker, Alpine SecDB, and GitHub Advisory Database
• False Positive Reduction: Uses vendor-specific severity data rather than relying solely on NVD CVSS scores

Trivy identifies security misconfigurations in infrastructure and application deployment manifests using built-in policies.

• Kubernetes: Checks for privileged containers, exposed dashboards, missing resource limits, and overly permissive RBAC roles
• Dockerfiles: Flags running as root, ADD instead of COPY, missing HEALTHCHECK, and exposed sensitive ports
• Terraform & CloudFormation: Detects open S3 buckets, unencrypted EBS volumes, and overly permissive security group rules
• Policy Library: Ships with hundreds of built-in checks aligned with CIS Benchmarks and security best practices
• Custom Policies: Supports Rego (Open Policy Agent language) for writing organization-specific compliance rules

Trivy scans for hardcoded secrets and sensitive information accidentally committed to code repositories or baked into container images.

• Pattern Matching: Detects over 140 types of secrets including AWS access keys, GCP service accounts, GitHub tokens, private SSH keys, and database connection strings
• Entropy Analysis: Identifies high-entropy strings that may represent unclassified secrets or API keys
• Git History Scanning: Examines entire commit history, not just the current HEAD, to find secrets that were committed and later removed
• Allow Rules: Supports .trivyignore files and inline comments to suppress false positives for test credentials or known safe patterns

Trivy can generate Software Bill of Materials documents in multiple standard formats, enabling supply chain transparency and compliance.

• Supported Formats: Generates SBOMs in CycloneDX and SPDX formats, the two leading industry standards
• Attestation: Creates in-toto attestations with SLSA provenance metadata, cryptographically binding the SBOM to the scanned artifact
• Integration with Cosign: Signs SBOM attestations using Sigstore keyless signing, storing them alongside images in OCI-compliant registries
• Dependency Graph: Maps complete transitive dependency trees, showing which packages depend on vulnerable components

Trivy is designed for seamless integration into automated pipelines and Kubernetes environments, enabling shift-left and runtime security.

• GitHub Actions: Official action available for scanning pull requests and blocking merges on critical findings
• Kubernetes Operator: Runs as a cluster operator to continuously scan deployed workloads and report new vulnerabilities
• Admission Controller: Integrates with OPA Gatekeeper and Kyverno to reject deployments containing critical vulnerabilities
• Exit Codes and SARIF: Returns structured exit codes and SARIF output for integration with GitHub Code Scanning and other CI platforms
• Client-Server Mode: Supports a centralized server architecture for shared vulnerability databases across teams

Trivy automatically generates Software Bill of Materials in CycloneDX and SPDX formats. An SBOM is a nested inventory of every OS package, language-specific library, and dependency within an image.

• Detects packages from 20+ languages including Java, Node.js, Python, and Go
• Maps dependencies to known vulnerabilities using multiple advisory databases
• Enables supply chain transparency by providing a machine-readable manifest of all components