Scanning container images with Trivy

Security (DevSecOps) · Vulnerability scanning with Trivy in the pipeline · Lesson 2 of 5

Trivy finds CVEs in the OS packages and application libraries inside an image, filters by severity, skips unfixed issues and helps you choose a better base image or version.

What Trivy is

Trivy (open source, by Aqua Security) is a single-binary scanner for many targets: container images, filesystems, Git repos, Kubernetes clusters, IaC and SBOMs. On first run it downloads the vulnerability DB (updated several times a day) into its cache.

trivy image nginx:1.27
trivy image --severity HIGH,CRITICAL --ignore-unfixed example-org/myapp:1.0
trivy image --scanners vuln,secret example-org/myapp:1.0
trivy image --input myapp.tar                 # an image saved with docker save

What Trivy looks at in an image

flowchart LR
  IMG["Image layers"] --> OS["OS packages<br/>apk, dpkg, rpm"]
  IMG --> LANG["App libraries<br/>package-lock.json, go.sum, jar, requirements"]
  IMG --> SEC["Forgotten secrets<br/>(--scanners secret)"]
  OS --> DB[("Vulnerability DB")]
  LANG --> DB
  DB --> R["Report by severity"]

Each result row shows the library, CVE ID, severity, installed version, fixed version and a title. An empty fixed version means no fix exists yet; --ignore-unfixed hides those rows so you can focus on what you can act on now.

Reading results and acting

Situation	Action
OS package issue with a fixed version	Rebuild on a newer base image (`apt-get upgrade` or a new tag)
App library issue	Bump the version in the lockfile
Base image with too many CVEs	Switch to a smaller image: `-slim`, Alpine, distroless, Chainguard
No fix yet	Record it, mitigate, schedule a review

Fewer packages mean fewer CVEs: a distroless image for a Go app often has close to zero CVEs, while a full Ubuntu image may list hundreds of Low and Medium rows.

Operating tips

In CI, cache ~/.cache/trivy so the DB is not downloaded every time; offline environments use --skip-db-update with a pre-synced DB.
--format table is for people, json or sarif for machines and GitHub's Security tab.
Rescan images already in the registry on a schedule: new CVEs are published daily, and yesterday's clean image may not be clean today.

Flag	Meaning
`--severity HIGH,CRITICAL`	Show only the chosen levels
`--ignore-unfixed`	Hide issues with no fix
`--pkg-types os`	Scan OS packages only
`--exit-code 1`	Return an error code when findings exist