Scanning filesystems, repos and IaC with Trivy

Security (DevSecOps) · Vulnerability scanning with Trivy in the pipeline · Lesson 3 of 5

Scan lockfiles and secrets in a code folder with trivy fs before building any image, catch misconfigurations in Dockerfiles, Terraform and Kubernetes YAML with trivy config, and scan clusters with trivy k8s.

Scanning earlier than the image

Many problems are visible in the repo, before an image is built:

trivy fs .                                   # lockfiles, secrets, config in the folder
trivy fs --scanners vuln --severity HIGH,CRITICAL .
trivy repo https://github.com/example-org/myapp   # scan a remote repo
trivy config .                               # misconfigurations only
trivy config --severity HIGH,CRITICAL infra/

trivy fs reads lockfiles such as package-lock.json, yarn.lock, poetry.lock, go.sum, pom.xml and Gemfile.lock and compares them with the vulnerability DB. Without a lockfile Trivy often cannot know the exact versions, so commit your lockfiles.

Misconfiguration

trivy config (formerly the tfsec and defsec projects, now merged into Trivy) ships checks for:

File type	Example findings
Dockerfile	Runs as root, uses the `latest` tag, no `HEALTHCHECK`
Kubernetes YAML, Helm	Privileged containers, missing `resources.limits`, `runAsNonRoot` not set
Terraform, CloudFormation	Public S3 bucket, security group open on port 22 to `0.0.0.0/0`, unencrypted disks
Azure ARM, Bicep	Storage account allowing public access

Each finding has an ID (for example AVD-AWS-0107), a severity, the code line and remediation advice.

flowchart LR
  R["Repo"] --> FS["trivy fs<br/>lockfiles + secrets"]
  R --> CF["trivy config<br/>Dockerfile, Terraform, K8s"]
  R --> B["docker build"] --> IM["trivy image"]
  IM --> REG["Registry"]
  REG --> K8["trivy k8s<br/>running cluster"]

Scanning a cluster

trivy k8s --report summary
trivy k8s --include-namespaces app --report all

Trivy reads the workloads, scans the images they use and their configuration. For continuous scanning inside the cluster, use the Trivy Operator: it creates VulnerabilityReport and ConfigAuditReport custom resources.

Controlled exceptions

Some checks do not apply to you. Use .trivyignore with the ID and a comment giving the reason, or an annotation in the code:

# .trivyignore
# This bucket is intentionally public to host a static site, approved by security 2026-10
AVD-AWS-0086

Traps: scanning only images and forgetting IaC, so cloud misconfigurations reach production; ignoring whole folders instead of single IDs; forgetting Helm charts that live outside the app repo.