What is this?
Trivy is an all-in-one security scanner that finds vulnerabilities, misconfigurations, secrets, and software licenses across container images, filesystems, git repositories, VM images, and Kubernetes clusters.
Trivy is an all-in-one security scanner that finds vulnerabilities, misconfigurations, secrets, and software licenses across container images, filesystems, git repositories, VM images, and Kubernetes clusters.Is this a CLI tool or a service I run in my cluster?It's primarily a command-line tool you install as a binary or Docker image; it can also generate SBOMs and integrate into CI/CD pipelines rather than running as a persistent service.
It's primarily a command-line tool you install as a binary or Docker image; it can also generate SBOMs and integrate into CI/CD pipelines rather than running as a persistent service.How do I get it running?Install via Homebrew with 'brew install trivy', run it directly with 'docker run aquasec/trivy', or download a prebuilt binary from the releases page.
Install via Homebrew with 'brew install trivy', run it directly with 'docker run aquasec/trivy', or download a prebuilt binary from the releases page.Do I need anything special installed first, like Docker?No specific runtime dependency is required beyond Docker if you use the container image; otherwise the binary runs standalone.
No specific runtime dependency is required beyond Docker if you use the container image; otherwise the binary runs standalone.Does it cover every language and platform?Trivy supports most popular programming languages, operating systems, and platforms, with the full compatibility list kept on a separate Scanning Coverage page rather than in the README itself.
Trivy supports most popular programming languages, operating systems, and platforms, with the full compatibility list kept on a separate Scanning Coverage page rather than in the README itself.Who is this aimed at?It's aimed at developers and DevSecOps teams who need to catch vulnerabilities, bad configs, and leaked secrets before code or images ship.
It's aimed at developers and DevSecOps teams who need to catch vulnerabilities, bad configs, and leaked secrets before code or images ship.What exactly can Trivy scan as a target?It can scan container images, filesystems, remote git repositories, virtual machine images, and Kubernetes clusters.
It can scan container images, filesystems, remote git repositories, virtual machine images, and Kubernetes clusters.What kinds of issues does Trivy detect?It detects OS and dependency packages for SBOM generation, known CVEs, IaC misconfigurations, exposed secrets, and software license issues.
It detects OS and dependency packages for SBOM generation, known CVEs, IaC misconfigurations, exposed secrets, and software license issues.Is there a more advanced product built on Trivy?Yes, Aqua's commercial platform builds on top of Trivy to offer an enhanced, complete security management offering.
Yes, Aqua's commercial platform builds on top of Trivy to offer an enhanced, complete security management offering.How do you pronounce 'Trivy'?It's pronounced like 'tri' in trigger plus 'vy' as in envy.
It's pronounced like 'tri' in trigger plus 'vy' as in envy.Which topics is it in?vulnerability-detection, secrets, cicd, devsecops, infrastructure-as-code, vulnerability, containers, golang, security-tools, kubernetes, hacktoberfest, devops
vulnerability-detection, secrets, cicd, devsecops, infrastructure-as-code, vulnerability, containers, golang, security-tools, kubernetes, hacktoberfest, devops