What is Trivy?
Trivy is an all-in-one scanner from Aqua Security. It finds known vulnerabilities (CVEs) in OS packages and libraries, misconfigurations in IaC and Kubernetes, secrets, and generates SBOMs.
1 CVE scanning
Trivy compares package versions in your image with vulnerability databases and tells you the fixed version.
2 Severity & fixability
Focus on CRITICAL/HIGH with a fix available; --ignore-unfixed removes noise.
3 SBOM
A Software Bill of Materials lists every component, so you can answer 'are we affected?' in minutes.
The scenario: Can shop-api 1.4 ship on Friday?
The release pipeline built shop-api:1.4. Security must approve it. Scan the image, focus on what matters, check the Kubernetes manifests, produce an SBOM, and verify the fixed build shop-api:1.5.
Live lab: try it now
Type the commands in the terminal below. Everything is simulated, so it's safe and legal and nothing is installed.
Step-by-step: Trivy commands used in this lab
1Scan the image for vulnerabilities
trivy image <name:tag>
trivy image shop-api:1.4Show sample output
2026-11-09T10:02:11Z INFO Vulnerability scanning is enabled
2026-11-09T10:02:14Z INFO Detected OS: alpine 3.15.0
shop-api:1.4 (alpine 3.15.0)
Total: 38 (UNKNOWN: 0, LOW: 14, MEDIUM: 19, HIGH: 4, CRITICAL: 1)
Java (jar)
Total: 21 (UNKNOWN: 0, LOW: 6, MEDIUM: 9, HIGH: 4, CRITICAL: 2)2Show only CRITICAL and HIGH issues that have a fix
--severity and --ignore-unfixed
trivy image --severity CRITICAL,HIGH --ignore-unfixed shop-api:1.4Show sample output
shop-api:1.4 (alpine 3.15.0)
Total: 2 (HIGH: 1, CRITICAL: 1)
┌──────────┬────────────────┬──────────┬───────────────────┬───────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │
├──────────┼────────────────┼──────────┼───────────────────┼───────────────┤
│ zlib │ CVE-2022-37434 │ CRITICAL │ 1.2.11-r3 │ 1.2.12-r2 │3Scan the Kubernetes manifests for misconfigurations
trivy config <folder>
trivy config k8s/Show sample output
k8s/deployment.yaml (kubernetes)
Tests: 96 (SUCCESSES: 89, FAILURES: 7)
Failures: 7 (HIGH: 3, MEDIUM: 3, LOW: 1)
HIGH KSV017 Container 'shop-api' should set 'securityContext.privileged' to false
HIGH KSV012 Container 'shop-api' should set 'securityContext.runAsNonRoot' to true
HIGH KSV014 Container 'shop-api' should set 'securityContext.readOnlyRootFilesystem' to true4Generate an SBOM in CycloneDX format
--format cyclonedx --output
trivy image --format cyclonedx --output sbom.json shop-api:1.4Show sample output
INFO "--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the CycloneDX report.
SBOM written to sbom.json (148 components: 41 alpine packages, 107 Java libraries)
Store it with the release. When the next Log4Shell happens, search SBOMs instead of guessing.5Verify the fixed image passes the gate
Scan 1.5 with --exit-code 1 for CRITICAL.
trivy image --exit-code 1 --severity CRITICAL shop-api:1.5Show sample output
shop-api:1.5 (alpine 3.20.3)
Total: 0 (CRITICAL: 0)
Java (jar)
Total: 0 (CRITICAL: 0)
✓ Exit code 0: the pipeline gate passes. shop-api:1.5 is approved to ship.Key takeaways
- Gate on CRITICAL/HIGH with fixes; track the rest.
- Scan IaC/Kubernetes too: misconfigurations are as risky as CVEs.
- --exit-code makes Trivy a pipeline gate.
- Generate and store an SBOM with every release.
Install Trivy and practise for real
brew install trivy # or: docker run aquasec/trivy image alpine:3.15Scan the images you use at work or home. Start with an old base image to see findings. Only scan or test systems you own or are explicitly authorised to assess. Official site: trivy.dev · Licence: Apache 2.0.
Scenario questions
Which finding should block the release immediately?
Answer: CVE-2021-44228 (Log4Shell) in log4j-core 2.14.1. Log4Shell is critical and actively exploited; fixed versions exist, so ship the fix first.
What does --ignore-unfixed do?
Answer: Hides vulnerabilities with no fixed version yet, to focus on what you can act on. Unfixable items still need tracking, but gates usually focus on fixable issues.
Why keep an SBOM for every release?
Answer: To quickly know which releases contain a newly disclosed vulnerable component. SBOMs turn 'are we affected?' from days of guesswork into a quick search.
More open-source tool labs
Semgrep
Find security bugs in source code with fast, readable rules.
Gitleaks
Find passwords, keys and tokens committed to Git, then stop it happening again.
Checkov
Catch cloud misconfigurations in Terraform before they're deployed.
Nmap
Discover hosts, open ports and services on networks you're authorised to assess.
Wireshark / tshark
See exactly what's crossing the wire and spot malware calling home.
Zeek
Turn raw traffic into rich, searchable logs for threat hunting.