Trivy — All-in-One Security Scanner for Containers & Code

What it is

Trivy is an open-source security scanner by Aqua Security that detects vulnerabilities in OS packages and language dependencies, misconfigurations in Terraform and Dockerfiles, leaked secrets like API keys, and SBOM issues -- all from a single binary with zero configuration. It scans Docker images, Git repositories, Kubernetes clusters, and local filesystems.

Trivy targets DevSecOps engineers, platform teams, and developers who need security scanning integrated into CI/CD pipelines without managing multiple specialized tools.

How it saves time or tokens

Trivy consolidates what used to require four or five separate tools (vulnerability scanner, secret detector, IaC linter, SBOM generator, Kubernetes auditor) into one binary. A single trivy image nginx:latest command replaces a chain of Grype, detect-secrets, checkov, and kube-bench commands. The scanner runs offline-capable with a local vulnerability database, so CI pipelines avoid network round-trips to external APIs.

How to use

1. Install Trivy:

# macOS
brew install trivy

# Debian/Ubuntu
sudo apt install trivy

1. Scan a Docker image for vulnerabilities:

trivy image nginx:latest

1. Scan a Git repository for secrets and misconfigurations:

trivy repo https://github.com/your-org/your-repo

1. Audit a running Kubernetes cluster:

trivy k8s --report=summary cluster

Example

# Scan a project filesystem with all scanners enabled
trivy fs --scanners vuln,misconfig,secret /path/to/project

# Output as JSON for CI/CD integration
trivy image --format json --output results.json myapp:v2.1

# Fail the build if critical vulnerabilities are found
trivy image --exit-code 1 --severity CRITICAL myapp:v2.1

# Generate an SBOM in CycloneDX format
trivy image --format cyclonedx --output sbom.json myapp:v2.1

Related on TokRepo

• Security tools directory -- Other security scanning and auditing tools
• DevOps tools -- CI/CD and infrastructure automation solutions

Common pitfalls

• The first scan downloads a vulnerability database (~30MB) which can timeout in air-gapped environments; pre-download with trivy image --download-db-only before going offline
• Scanning large monorepo filesystems with all scanners enabled can be slow; use --scanners flag to limit to specific scan types
• The --exit-code 1 flag only triggers on findings matching the specified severity; omitting --severity means any finding fails the build