| name | implementing-aqua-security-for-container-scanning |
| description | Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries. |
| domain | cybersecurity |
| subdomain | devsecops |
| tags | ["aqua-security","trivy","container-scanning","vulnerability-scanning","sbom","image-security","supply-chain"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"] |
Implementing Aqua Security for Container Scanning
Overview
Aqua Security provides Trivy, the world's most popular open-source universal security scanner, designed to find vulnerabilities, misconfigurations, secrets, SBOM data, and license issues in containers, Kubernetes, code repositories, and cloud environments. Trivy covers OS packages (Alpine, Debian, Ubuntu, RHEL, etc.) and language-specific dependencies (npm, pip, Maven, Go modules, Cargo, etc.) with vulnerability databases sourced from NVD, vendor advisories, and GitHub Security Advisories. The enterprise Aqua Platform extends Trivy with centralized policy management, runtime protection, and compliance reporting.
When to Use
- When deploying or configuring implementing aqua security for container scanning capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Common Misconfigurations & Verification
These mistakes let vulnerable images ship while Trivy appears to "pass":
--exit-code 0 everywhere. A scan run with trivy image --exit-code 0 only reports; it never fails the build. Use a gating invocation trivy image --exit-code 1 --severity CRITICAL,HIGH (the GitLab template pattern of a report pass followed by a real --exit-code 1 pass is correct — keep both).continue-on-error: true / soft_fail. In GitHub Actions the trivy-action exit-code: '1' is undone by a job-level continue-on-error: true; remove it on the gating step.- Scanning the wrong tag.
image-ref/CS_IMAGE pinned to :latest instead of ${{ github.sha }} scans a stale image. Scan the exact digest you just built.
- Stale vuln DB or
--skip-db-update misses recent CVEs; let Trivy refresh its DB in CI.
- Over-broad
.trivyignore (or unexpired exp: dates) silently suppresses real CRITICALs — review it.
--ignore-unfixed hides fixable CVEs if you actually want to gate on them.
Concrete verification: Build an image FROM a known-vulnerable base (e.g. or an old ) and run your gating step. Confirm the job , then confirm a clean patched image passes. This proves the exit code is honored, not swallowed.
