trivy

Scan a container image for vulnerabilities

$ trivy image [image_name:tag]

$ trivy fs [path/to/directory]

$ trivy repo [https://github.com/user/repo]

$ trivy config [path/to/configs]

$ trivy image --format json [image_name]

$ trivy image --severity CRITICAL,HIGH [image_name]

$ trivy image --ignore-unfixed [image_name]

$ trivy image --format cyclonedx [image_name]

trivy [global options] command [command options] target

Trivy is a comprehensive security scanner developed by Aqua Security. It detects vulnerabilities in OS packages and application dependencies, infrastructure misconfigurations, exposed secrets, and software license issues.
Trivy supports multiple targets including container images, filesystems, git repositories, virtual machine images, and Kubernetes clusters. It integrates with CI/CD pipelines and can output results in various formats for different tools and platforms.
The vulnerability database is automatically downloaded and cached. Trivy can generate Software Bill of Materials (SBOM) in CycloneDX and SPDX formats, and can also scan existing SBOM files for known vulnerabilities.

image, i

Scan a container image for vulnerabilities.

Scan a local filesystem or directory.

Scan a remote git repository.

Scan configuration files for misconfigurations.

Scan a Kubernetes cluster.

Scan a root filesystem (e.g., extracted container image).

Scan an SBOM file for vulnerabilities.

Run Trivy in server mode.

Manage Trivy plugins.

Comma-separated list of severity levels to show: UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL.

Output format: table, json, sarif, template, cyclonedx, spdx, spdx-json, github.

Write results to a file.

Only show vulnerabilities that have a fix available.

Comma-separated list of package types to scan.

Comma-separated list of scanners: vuln, misconfig, secret, license.

Specify cache directory for database.

Suppress progress bar and log output.

Enable debug mode.

Display version information.

Display help message.

The vulnerability database download requires internet access on first run. For air-gapped environments, the database can be pre-downloaded and specified via --cache-dir or hosted on a private OCI registry. Container image scanning requires a working container runtime or access to the registry.

Trivy was created by Teppei Fukuda and first released in 2019 as a container vulnerability scanner. It was acquired by Aqua Security in 2019 and has since expanded to become a comprehensive security scanner. In 2023, tfsec (Terraform security scanner) was merged into Trivy, consolidating Aqua's open-source security tools. Trivy has become one of the most widely adopted open-source vulnerability scanners.

docker(1), tfsec(1), grype(1), syft(1), snyk(1)