Container and cloud security scanner

What you get

• Multi-layered target scanning: Inspects container images (Docker, OCI), local file systems, remote Git repositories, virtual machine disks and live Kubernetes clusters with a single tool.
• Zero additional infrastructure overhead: No need for an external database server or heavy agents running constantly; It delivers analysis in seconds as a single executable binary.
• Capturing sensitive data and secrets: It detects API keys, passwords and private certificates accidentally embedded in the source code or image layers with its heuristic engine.
• Infrastructure as code (IaC) audit: Catches security misconfigurations in Terraform, Dockerfile, Kubernetes YAML, and CloudFormation files before they go to production.
• SBOM and open source license compliance: Complies software supply chain security with legal regulations by producing software bill of materials in CycloneDX and SPDX standards.

Installation

brew install trivy

winget install AquaSecurity.Trivy

Running it

trivy image imaj-adi:etiket

Technical architecture and working principle

• Trivy DB and local cache: NVD automatically downloads a lightweight database cache containing GitHub Advisory Database, Red Hat, Debian, Ubuntu, and Alpine security bulletins. Since scans are performed through this local cache, it runs at lightning speed even in environments with network restrictions.
• Static layer analysis: Directly parses OCI layers without running container images or needing a Docker daemon. This approach does not compromise system security during the scanning process.
• IaC engine and Rego policies: Controls infrastructure templates with Open Policy Agent (OPA) compliant rules. Insecure open ports or services running with root privilege are reported immediately.
• SBOM standardization: The package manager scans the lock files (package-lock.json, poetry.lock, Cargo.lock, etc.) and creates a complete dependency map of your application.

DevSecOps and CI/CD pipeline integration

• Early stage feedback: Developers instantly see vulnerabilities in open source libraries by running Trivy in their local environment before pushing their code to the remote repository.
• Automatic SARIF reporting: The produced SARIF outputs are transferred to GitHub Code Scanning or GitLab Security dashboards, allowing teams to perform central vulnerability tracking.
• Live cluster monitoring (Trivy Operator): It constantly monitors workloads running in the Kubernetes environment and instantly reports newly discovered zero-day (0-day) vulnerabilities.

If you don't write code

Frequently asked questions

• Can Trivy Docker scan container images without a daemon? Yes. Trivy can download and scan images directly from remote image repositories (Docker Hub, GitHub Container Registry, AWS ECR, etc.) or local tar archives without the need for a Docker client or daemon.
• Does it work in air-gapped environments without internet connection? Yes. The Trivy database (trivy-db) can be downloaded in advance and moved to a closed network environment. Trivy can scan through the local database cache without going online.
• What is SBOM and why is Trivy preferred in this field? SBOM (Software Bill of Materials) is a digital content list that documents all open source libraries, versions and licenses included in your software. Trivy is one of the few standard tools that can produce SBOM at both the image level and the source code level.
• How to exclude false positives or accepted risks? You can list the CVE codes you want to ignore line by line by adding a .trivyignore file to the project root directory. In this way, unnecessary compilation interruptions in CI/CD pipelines are prevented.

Related dictionary terms

Links

• GitHub repository →
• Read in Turkish →