aquasec/trivy Docker Image

Quick reference

• Maintained by: https://www.aquasec.com
• Documentation: https://aquasecurity.github.io/trivy
• Getting help: https://github.com/aquasecurity/trivy/discussions, https://slack.aquasec.com
• Source code: https://github.com/aquasecurity/trivy

What is Trivy

Trivy scans code projects and build artifacts for security issues such as vulnerabilities, IaC misconfigurations, secrets, and more.

How to use this image

It's recommended to read this within the Trivy documentation: https://aquasecurity.github.io/trivy/latest/getting-started/installation/#docker

Scan a container image for vulnerabilities:

bash
docker run aquasec/trivy image python:3.4-alpine

Scan a local directory for IaC misconfigurations:

bash
docker run -v $PWD:/myapp aquasec/trivy config /myapp

Generate SBOM:

bash
docker run aquasec/trivy sbom alpine:3.15

In order reuse previously dowloaded vulnerability database, and pulled layers, you should mount the cache directory from the host, for example by adding the following to the docker tun command: -v [YOUR_CACHE_DIR]:/root/.cache/. Also *** mounting the Docker socket, for example: -v /var/run/docker.sock:/var/run/docker.sock

License

Trivy is licensed under https://www.apache.org/licenses/LICENSE-2.0.