Trivy Container Vulnerability Scanner

# Install
brew install trivy

# Scan a container image
trivy image nginx:latest

# Output
nginx:latest (debian 12.4)
Total: 142 (UNKNOWN: 0, LOW: 89, MEDIUM: 41, HIGH: 10, CRITICAL: 2)

┌──────────────┬────────────────┬──────────┬────────────┐
│   Library    │ Vulnerability  │ Severity │   Status   │
├──────────────┼────────────────┼──────────┼────────────┤
│ libssl3      │ CVE-2024-XXXX  │ CRITICAL │ fix: 3.0.14│
│ libcurl4     │ CVE-2024-YYYY  │ HIGH     │ fix: 8.5.0 │
└──────────────┴────────────────┴──────────┴────────────┘

# Scan with severity filter
trivy image --severity HIGH,CRITICAL myorg/app:v1.2.3

# Scan and fail CI if critical vulnerabilities found
trivy image --exit-code 1 --severity CRITICAL myorg/app:v1.2.3

# Scan with SBOM output
trivy image --format spdx-json -o sbom.json myorg/app:v1.2.3

# Scan project dependencies
trivy fs --scanners vuln .

# Scan for exposed secrets
trivy fs --scanners secret .

# Scan IaC files (Terraform, CloudFormation, Kubernetes)
trivy config ./terraform/

# Scan running cluster
trivy k8s --report summary cluster

# Scan specific namespace
trivy k8s -n production --report all

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myorg/app:${{ github.sha }} .

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myorg/app:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

container_scanning:
  stage: test
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL
        --format json -o trivy-report.json
        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  artifacts:
    reports:
      container_scanning: trivy-report.json

# .trivyignore.yaml
vulnerabilities:
  - id: CVE-2024-1234
    statement: "Not exploitable — feature not used"
    expires: 2026-06-01

  - id: CVE-2024-5678
    statement: "Mitigated by network policy — no external access"

helm install trivy-operator aquasecurity/trivy-operator \
  --namespace trivy-system --create-namespace

# View vulnerability reports
kubectl get vulnerabilityreports -A

# Check a specific workload
kubectl get vulnerabilityreport -n production \
  -l trivy-operator.resource.name=order-api -o yaml

trivy config ./terraform/

Failures: 3 (HIGH: 2, CRITICAL: 1)

CRITICAL: S3 bucket has public access enabled
  terraform/storage.tf:15-20

HIGH: Security group allows ingress from 0.0.0.0/0
  terraform/networking.tf:8-14

HIGH: RDS instance not encrypted
  terraform/database.tf:22-30