Trivy
By Aqua Security
Trivy is an open-source vulnerability scanner that inspects container images, filesystems, Git repositories, and infrastructure-as-code configurations for known security vulnerabilities, exposed secrets, and misconfigurations. It…
Definition
Trivy is an open-source vulnerability scanner that inspects container images, filesystems, Git repositories, and infrastructure-as-code configurations for known security vulnerabilities, exposed secrets, and misconfigurations. It cross-references installed packages and operating system libraries against public vulnerability databases and flags outdated or insecure dependencies before they reach production. DevOps and security teams run it in CI/CD pipelines and locally to catch vulnerable images and misconfigured infrastructure early in the development process.
Overview
Trivy exists to address a specific gap in container-based development: images are typically built from base layers pulled from public registries, and those layers can carry outdated system packages and libraries with known vulnerabilities that a team never explicitly chose to include. Manually auditing every dependency in every image is impractical at the pace modern teams ship containers, so Trivy automates that audit as a fast, single-binary scan. Mechanically, Trivy extracts the list of installed packages and libraries from a container image, filesystem, or repository, then compares that list against vulnerability databases covering operating system packages and language-specific dependency ecosystems, reporting matches by severity along with the fixed version where one is available. Beyond package vulnerabilities, Trivy also scans for hardcoded secrets like API keys accidentally committed to a repository, and it evaluates infrastructure-as-code files such as Terraform, Kubernetes manifests, and Dockerfiles against a library of misconfiguration rules. Compared to Clair, another open-source container vulnerability scanner, Trivy is generally regarded as easier to adopt because it ships as a single self-contained binary with no separate database server to run, while Clair traditionally requires running its own service with a persistent database and is more often embedded into container registries as a scanning backend. Trivy's scope also extends beyond container images alone to source repositories and IaC files, which Clair does not cover. In practice, teams add Trivy as a step in CI/CD pipelines to fail a build when a container image contains vulnerabilities above a configured severity threshold, scan Kubernetes manifests before deployment for common misconfigurations, and run ad hoc scans of local Docker images during development. It is also commonly used as a lightweight pre-commit or pre-push check to catch accidentally committed secrets before they reach a shared repository. Limitations include the inherent lag between a vulnerability being disclosed and its addition to Trivy's databases, meaning a scan cannot catch what upstream sources haven't yet published, and vulnerability scanning alone does not address logical application security flaws or runtime threats, which require different tooling such as runtime security monitoring or application-level testing. Trivy is best understood as one layer of a broader supply-chain and container security practice rather than a complete security solution on its own. Trivy's output formats, including JSON and SARIF, make it straightforward to feed results into other tooling, such as pull request annotations or centralized vulnerability dashboards, which has helped it become a common default choice for teams standardizing security scanning across many repositories and pipelines. Its maintainers update severity data and scanning rules frequently, which keeps it relevant as new vulnerability classes and misconfiguration patterns are identified across the container ecosystem.
Key Features
- Scans container images for OS and language-level vulnerabilities
- Detects hardcoded secrets in source code and configuration
- Evaluates Terraform, Kubernetes, and Dockerfile misconfigurations
- Ships as a single self-contained binary with no separate database
- Reports vulnerability severity with available fixed versions
- Integrates into CI/CD pipelines to gate builds on findings
- Scans filesystems and Git repositories, not just container images
- Supports SBOM generation for software supply-chain tracking