trivy(1)
Trivy is a simple and comprehensive vulnerability scanner for containers, filesystems, and repositories.
Synopsis
trivy [global options] command [command options] targetDescription
Trivy is an open-source vulnerability scanner that detects security issues in container images, filesystems, Git repositories, and Kubernetes clusters. It scans for known vulnerabilities in OS packages and application dependencies, providing fast and accurate results with minimal configuration.
Trivy supports multiple image sources including Docker registries, local images, and tarball files. It can generate reports in various formats (JSON, SARIF, CycloneDX) and integrates with CI/CD pipelines for automated security scanning.
Common options
| Flag | What it does |
|---|---|
image | Scan a container image for vulnerabilities |
fs | Scan a filesystem or directory for vulnerabilities |
repo | Scan a Git repository for vulnerabilities |
--format json | Output results in JSON format for parsing |
--format sarif | Output results in SARIF format for integration with GitHub |
--severity HIGH,CRITICAL | Filter results by severity level |
--exit-code 1 | Return exit code 1 if vulnerabilities are found |
--skip-update | Skip updating vulnerability database |
--offline-scan | Run scan without internet connectivity |
-o, --output FILE | Write results to a file instead of stdout |
Examples
Scan the latest nginx image from Docker Hub for vulnerabilities
trivy image nginx:latestScan nginx image and show only critical-level vulnerabilities
trivy image --severity CRITICAL nginx:latestScan a local directory for vulnerable packages and dependencies
trivy fs /var/www/appScan image and save results in JSON format to a file
trivy image --format json nginx:latest -o results.jsonScan a Git repository for secrets and vulnerabilities
trivy repo https://github.com/owner/repo.gitScan image and exit with code 1 if any vulnerabilities are found
trivy image --exit-code 1 myapp:v1.0Scan a local tar file without updating the vulnerability database
trivy image --skip-update my-image.tarGenerate a SARIF report for GitHub security integration
trivy image --format sarif nginx:latest -o trivy-report.sarif