Security (DevSecOps) · Module 04

Vulnerability scanning with Trivy in the pipeline

Understand CVEs, CVSS and severity; use Trivy to scan images, filesystems, IaC and Kubernetes manifests; set blocking thresholds in CI and generate SBOMs to know what you are running.

Practice interactively →

What you will learn

• Read CVE IDs, CVSS scores, severities and fixed-version status
• Scan container images, filter by severity and skip unfixed issues
• Scan code folders, lockfiles, Dockerfiles, Terraform and Kubernetes manifests
• Make Trivy fail the pipeline on a threshold and manage exceptions with .trivyignore
• Generate and scan SBOMs in CycloneDX or SPDX format

Lessons

1. CVE, CVSS and severity levels

   A CVE is a public identifier for a vulnerability and CVSS scores its severity from 0 to 10; prioritise by severity, likelihood of exploitation and whether a fix exists.

2. Scanning container images with Trivy

   Trivy finds CVEs in the OS packages and application libraries inside an image, filters by severity, skips unfixed issues and helps you choose a better base image or version.

3. Scanning filesystems, repos and IaC with Trivy

   Scan lockfiles and secrets in a code folder with trivy fs before building any image, catch misconfigurations in Dockerfiles, Terraform and Kubernetes YAML with trivy config, and scan clusters with trivy k8s.

4. Putting Trivy into a CI/CD pipeline

   Run Trivy after the image build and before push or deploy, use --exit-code to fail on a threshold, export SARIF or JUnit to surface results, and keep time-limited exceptions in .trivyignore.

5. SBOM - the software bill of materials

   An SBOM lists every package and version inside a piece of software in the CycloneDX or SPDX standard; generate it at build time, keep it with the artifact and rescan it when new CVEs appear without rebuilding.