trivy

Project Overview

Trivy is a comprehensive and versatile security scanner. It scans container images, filesystems, Git repositories, virtual machine images, and Kubernetes.

Key Features

• OS packages and software dependencies (SBOM)
• Known vulnerabilities (CVEs)
• IaC issues and misconfigurations
• Sensitive information and secrets
• Software licenses
• Supports major programming languages and OS

Target Audience

• DevOps and security engineers
• Developers needing container security scanning
• Kubernetes cluster administrators

Quick Start

1. Install via package manager: brew install trivy
2. Or via Docker: docker run aquasec/trivy
3. Scan container image: trivy image python:3.4-alpine
4. Scan filesystem: trivy fs --scanners vuln,secret,misconfig myproject/

Core Advantages

• Comprehensive coverage across multiple targets and scanners
• Supports major platforms and languages
• Multiple installation methods for easy integration
• Open-source and free with active community

System Requirements

• OS: Cross-platform (macOS, Linux, Windows)
• Architectures: x86_64, arm64
• Additional Dependencies: None

Notes

• Canary builds may have critical bugs, not for production
• Full documentation at trivy.dev