| name | scanning-docker-images-with-trivy |
| description | Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati |
| domain | cybersecurity |
| subdomain | container-security |
| tags | ["containers","docker","security","trivy","vulnerability-scanning"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"] |
Scanning Docker Images with Trivy
Overview
Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violations within container images. It integrates into CI/CD pipelines and supports multiple output formats including SARIF, CycloneDX, and SPDX.
When to Use
- When conducting security assessments that involve scanning docker images with trivy
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Coverage Gaps & Validation
A passing Trivy scan reflects what was enabled and reachable, not a guarantee the image is safe:
- Default scanner set:
trivy image runs vulnerability detection by default - misconfigurations, secrets, and licenses are only checked with --scanners vuln,misconfig,secret,license. A clean run without those flags never looked for hardcoded keys or Dockerfile misconfigs.
--severity and --ignore-unfixed mask risk: gating on CRITICAL,HIGH drops exploitable MEDIUM CVEs, and --ignore-unfixed hides unpatched-but-exploitable ones. State the filter when reporting results.- OS packages vs app libraries: Trivy enumerates language deps only when the lockfile is present in the image; vendored, statically compiled, or distroless/
scratch images can return few or zero findings - looks clean, isn't verified.
- Tag vs running container drift: scanning
myapp:latest in CI may not match the digest actually deployed.
Validate: refresh the DB (trivy image --download-db-only) so a clean result isn't just a stale database, then re-run with all scanners and no severity filter to see true counts. For distroless/minimal images, generate an SBOM (--format cyclonedx) to confirm which packages were actually catalogued, and use --exit-code 1 gates plus a diff against the deployed digest to verify scan completeness rather than assuming zero output means zero risk.
Prerequisites
- Docker Engine 20.10+
- Trivy v0.50+ installed
- Internet access for vulnerability database updates
- Container registry credentials (for private registries)
Core Concepts
