Scan Targets
- imageContainer images
- fsFilesystem
- repoGit repository
- configIaC misconfig
- k8sKubernetes cluster
- sbomSoftware BOM
Severity Levels
- CRITICALHighest risk
- HIGHHigh risk
- MEDIUMModerate risk
- LOWLow risk
- UNKNOWNUnknown severity
Output Formats
- tableTable (default)
- jsonJSON format
- sarifSARIF format
- cyclonedxCycloneDX SBOM
- spdxSPDX SBOM
Scanners
- vulnVulnerabilities
- misconfigMisconfigurations
- secretSecret detection
- licenseLicense compliance
Container Image Scanning
# Scan container image
trivy image nginx:latest
# Scan with severity filter
trivy image --severity CRITICAL,HIGH nginx:latest
# Scan and exit with error code
trivy image --exit-code 1 --severity CRITICAL nginx:latest
# Scan private registry image
trivy image --username user --password pass registry.example.com/myimage:tag
# Scan specific scanners only
trivy image --scanners vuln,secret nginx:latest
Filesystem & Repository Scanning
# Scan local filesystem
trivy fs /path/to/project
# Scan current directory
trivy fs .
# Scan Git repository
trivy repo https://github.com/org/repo
# Scan for misconfigurations
trivy fs --scanners misconfig /path/to/terraform
# Scan for secrets
trivy fs --scanners secret .
IaC Scanning
- Terraform.tf files
- CloudFormationAWS CFN
- KubernetesYAML manifests
- DockerfileDocker configs
- HelmHelm charts
Common Flags
- --severityFilter severity
- --formatOutput format
- --outputOutput file
- --exit-codeExit code on vuln
- --ignore-unfixedSkip unfixed
- --timeoutScan timeout
Kubernetes Scanning
# Scan Kubernetes cluster
trivy k8s --report summary cluster
# Scan specific namespace
trivy k8s --namespace default
# Scan all namespaces
trivy k8s --all-namespaces
# Generate SBOM for cluster
trivy k8s --format cyclonedx cluster
CI/CD Integration
# GitHub Actions example
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: 'myimage:tag'
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
exit-code: '1'
# Upload to GitHub Security
- name: Upload results
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
Ignore/Skip
# .trivyignore file
# Ignore specific CVEs
CVE-2021-44228
CVE-2022-22965
# Ignore by exp date
CVE-2023-12345 exp:2024-12-31
# Use ignore file
trivy image --ignorefile \
.trivyignore nginx:latest
Cache Management
- trivy image --download-db-onlyDownload DB
- trivy image --skip-db-updateSkip update
- trivy clean --allClear cache
- --cache-dirCustom cache