Trivy: scan container images, file systems and infrastructure code for known problems

Trivy (about 38,000 stars on GitHub) is a general purpose security scanner written in Go. It was created in 2019 by Teppei Fukuda as a small tool for checking container images and was adopted by Aqua Security later the same year; Aqua’s open source team maintains it with several hundred outside contributors. The project’s name is a play on trivial: the original goal was a scanner that works with one command and no setup, in contrast to the database servers and agents that older tools required.

What it checks

Trivy looks at a target and reports several classes of findings in one run. For operating system packages inside an image (Alpine, Debian, Ubuntu, Red Hat, SUSE and others) and for application dependencies (npm, pip, Go modules, Maven, Cargo, Composer and more) it matches installed versions against public vulnerability databases and prints the CVE identifiers, severities and fixed versions. For infrastructure code it checks Dockerfiles, Kubernetes manifests, Terraform, CloudFormation and Helm charts against a built-in set of misconfiguration rules. It can also flag hard-coded secrets and list software licences. The same engine runs against a local directory, a remote Git repository, a virtual machine image, an SBOM file or a running Kubernetes cluster.

Who it is for

• Developers who want to know whether the base image and dependencies of their own project carry known vulnerabilities before they ship it.
• Administrators who run containers and want a quick inventory of what needs updating on the images they already deploy.
• CI pipelines, where Trivy is one of the most common gates: the how-to Scan your own code and containers in CI: Gitleaks, Semgrep and Trivy shows a workflow.
• Platform teams that need SBOM generation or Kubernetes cluster scanning from a single tool.

How to install and try it

Trivy ships as a single binary. Homebrew, the Aqua apt and rpm repositories, Chocolatey, Nix and a Docker image all carry it, and the releases page has archives for every platform. The first scan downloads the vulnerability database, which takes a moment; later runs reuse the cached copy.

brew install trivy
trivy --version
trivy image nginx:latest
trivy fs --scanners vuln,misconfig,secret .

The second scan command reads the current directory of your own project, including lock files and any Dockerfile or manifests it finds. Results can be printed as a table, JSON, SARIF for code hosting platforms, or CycloneDX and SPDX for SBOM consumers. The documentation lists every target type and output format.

Credit

Trivy was created by Teppei Fukuda and is maintained by Aqua Security and its contributors. It is published under the Apache License 2.0. The vulnerability data it downloads comes from the distributions’ own security trackers, the GitHub Advisory Database and the National Vulnerability Database, each under its own terms.