Trivy¶

# Installation
brew install trivy                     # macOS
apt-get install trivy                  # Debian/Ubuntu
# Or download from https://github.com/aquasecurity/trivy/releases

# Container image scanning
trivy image nginx:latest               # Scan public image  # (1)!
trivy image myapp:1.0.0                # Scan local image
trivy image --severity HIGH,CRITICAL nginx:latest  # (2)!
trivy image --ignore-unfixed nginx     # Ignore issues without fixes

# Filesystem scanning
trivy fs .                             # Scan current directory
trivy fs /path/to/project              # Scan specific path
trivy fs --security-checks vuln,secret .  # Vulns + secrets  # (3)!

# Git repository scanning
trivy repo https://github.com/user/repo
trivy repo --branch develop .          # Scan specific branch

# Infrastructure as Code scanning
trivy config terraform/                # Scan Terraform
trivy config k8s/*.yaml                # Scan Kubernetes manifests
trivy config --severity HIGH,CRITICAL .

# Kubernetes cluster scanning
trivy k8s --report summary             # Scan entire cluster  # (4)!
trivy k8s deployment/myapp             # Scan specific resource
trivy k8s all --namespace production

# SBOM generation
trivy image --format cyclonedx nginx:latest > sbom.json  # (5)!
trivy image --format spdx nginx:latest > sbom.spdx

# Output formats
trivy image --format json nginx > results.json
trivy image --format sarif nginx > results.sarif  # (6)!
trivy image --format template --template "@contrib/gitlab.tpl" nginx

# GitHub Actions integration (.github/workflows/trivy.yml)
name: Trivy Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 0 * * 0'  # Weekly

jobs:
  container-scan:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'  # (1)!
          ignore-unfixed: true  # (2)!

      - name: Upload to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  iac-scan:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy IaC scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'  # (3)!
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-iac.sarif'
          severity: 'HIGH,CRITICAL'

      - name: Upload IaC results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-iac.sarif'

  secret-scan:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for secret scanning

      - name: Run Trivy secret scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          security-checks: 'secret'  # (4)!
          format: 'table'

# trivy.yaml (configuration file)
# Place in .trivy.yaml at project root
severity:
  - CRITICAL
  - HIGH
ignore-unfixed: true
ignorefile: .trivyignore  # (1)!
output: trivy-report.json
format: json
dependency-tree: true  # Show dependency chains  # (2)!

# .trivyignore (ignore specific vulnerabilities)
# CVE-2023-12345 - False positive, not exploitable in our usage
CVE-2023-12345

# Ignore all npm vulnerabilities (example, not recommended)
# CVE-*-* npm

# GitLab CI integration (.gitlab-ci.yml)
trivy_scan:
  stage: test
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity CRITICAL,HIGH myapp:$CI_COMMIT_SHA  # (1)!
    - trivy config --exit-code 1 --severity CRITICAL,HIGH .
    - trivy fs --security-checks vuln,secret --exit-code 1 .
  artifacts:
    reports:
      container_scanning: gl-container-scanning.json  # (2)!
  only:
    - merge_requests
    - main