| name | scanning-docker-images-with-trivy |
| description | Scans Docker container images with Trivy, Aqua Security's open-source scanner, to detect vulnerabilities in OS packages and language-specific dependencies, misconfigurations, exposed secrets, and license violations, outputting results in formats like SARIF, CycloneDX, or SPDX. Use when assessing, auditing, or scheduling a security scan of Docker images, including as part of CI/CD or incident-response investigations. |
| domain | cybersecurity |
| subdomain | container-security |
| tags | ["containers","docker","security","trivy","vulnerability-scanning"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"] |
| mitre_attack | ["T1610","T1611","T1609","T1525","T1190"] |
Scanning Docker Images with Trivy
Overview
Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violations within container images. It integrates into CI/CD pipelines and supports multiple output formats including SARIF, CycloneDX, and SPDX.
When to Use
- When conducting security assessments that involve scanning docker images with trivy
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Docker Engine 20.10+
- Trivy v0.50+ installed
- Internet access for vulnerability database updates
- Container registry credentials (for private registries)
Core Concepts
Scanner Types
| Scanner | Flag | Detects |
|---|
| Vulnerability | --scanners vuln | CVEs in OS packages and libraries |
| Misconfiguration | --scanners misconfig | Dockerfile/K8s manifest misconfigs |
| Secret | --scanners secret | Hardcoded passwords, API keys, tokens |
| License | --scanners license | Software license compliance issues |
Severity Levels
- CRITICAL: CVSS 9.0-10.0 - Immediate action required
- HIGH: CVSS 7.0-8.9 - Fix before production deployment
- MEDIUM: CVSS 4.0-6.9 - Plan remediation
- LOW: CVSS 0.1-3.9 - Accept or fix opportunistically
- UNKNOWN: Unscored - Evaluate manually
Vulnerability Database
Trivy uses multiple vulnerability databases:
- NVD (National Vulnerability Database)
- Red Hat Security Data
- Alpine SecDB
- Debian Security Tracker
- Ubuntu CVE Tracker
- Amazon Linux Security Center
- GitHub Advisory Database
Workflow
Step 1: Install Trivy
apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | /usr/share/keyrings/trivy.gpg > /dev/null
| -a /etc/apt/sources.list.d/trivy.list
apt-get update && apt-get install trivy
brew install trivy
docker pull aquasecurity/trivy:latest
