![Forrest logo](/images/logo.png)
trivy
Trivy is an open-source command-line vulnerability scanner and security tool. It is designed to scan and detect vulnerabilities in container images and filesystems. Trivy focuses on scanning vulnerabilities in the software packages and libraries used in these images and filesystems. The tool supports scanning images in various formats like Docker, OCI, and containerd. Trivy utilizes multiple vulnerability databases, including CVE, Red Hat, and Debian security advisories, to perform comprehensive scans. It can scan images both locally on your machine or remotely by specifying a repository or image URL. Trivy provides detailed reports of vulnerabilities found, including the severity level, CVE-ID, and suggestions for remediation. The tool is easy to use with a simple command-line interface and provides fast and accurate results. It can be integrated into CI/CD pipelines or used as a standalone tool during development or deployment to ensure the security of containerized applications. Trivy continues to be actively developed and updated, making it a reliable choice for container vulnerability scanning.
List of commands for trivy:
-
trivy:tldr:42990 trivy: Generate output with a SARIF template.$ trivy image --format ${template} --template ${"@sarif-tpl"} -o ${path-to-report-sarif} ${image:tag}try on your machineexplain this command
-
trivy:tldr:bc301 trivy: Scan the filesystem for vulnerabilities and misconfigurations.$ trivy fs --security-checks ${vuln,config} ${path-to-project_directory}try on your machineexplain this command
-
trivy:tldr:d9e07 trivy: Scan an image.$ trivy image ${image:tag}try on your machineexplain this command
-
trivy:tldr:ed724 trivy: Scan a directory for misconfigurations.$ trivy config ${path-to-iac_directory}try on your machineexplain this command