What it is

Trivy is an open-source security scanner written in Go and released under the Apache-2.0 license. It is an Aqua Security open source project, hosted at trivy.dev, and it lives in the cloud-native and DevSecOps ecosystem alongside container runtimes, Kubernetes clusters, and infrastructure-as-code tooling. The design separates two ideas: scanners, which describe the classes of security issue Trivy looks for, and targets, which describe where it looks. The README presents the project as a comprehensive and versatile scanner, and the topic list — containers, devsecops, docker, iac, infrastructure-as-code, kubernetes, vulnerability-detection, security-tools — reflects that positioning. The repository is roughly seven years old, carries about 37,915 stars and 685 forks, and has 269 open issues at the time of writing.

The concrete problem it solves is the fragmentation of security checks across the software supply chain. A team shipping a container image usually needs one tool for OS package vulnerabilities, another for application dependencies, another for infrastructure-as-code misconfigurations, another for leaked secrets, and another for license compliance. Trivy collapses those checks into a single binary with a single invocation, and it runs that invocation against several kinds of target: a container image, a filesystem, a remote Git repository, a virtual machine image, or a Kubernetes cluster. The same scanners then report OS packages and software dependencies as an SBOM, known CVEs, IaC issues and misconfigurations, sensitive information and secrets, and software licenses.

Key capabilities

• Scans container images, filesystems, remote Git repositories, virtual machine images, and Kubernetes clusters as targets.
• Detects known vulnerabilities (CVEs) in OS packages and software dependencies, and can emit an SBOM of what is in use.
• Detects IaC issues and misconfigurations.
• Detects sensitive information and secrets.
• Reports software licenses.
• Selects scanners per run through the --scanners flag, for example trivy fs --scanners vuln,secret,misconfig myproject/.
• Supports most popular programming languages, operating systems, and platforms, per the Scanning Coverage page.
• Ships canary builds from every push to the main branch as Docker Hub, GitHub, and ECR images and as binaries.

Who uses it and how

• Developers scan a container image before pushing, as in trivy image python:3.4-alpine.
• Projects scan a working tree or filesystem for vulnerabilities, secrets, and misconfigurations in one pass with `trivy fs --scanners vuln

trivy <target> [--scanners <scanner1,scanner2>] <subject>

trivy image python:3.4-alpine

trivy fs --scanners vuln,secret,misconfig myproject/

trivy k8s --report summary cluster