What is Trivy and what types of security scanning does it support?
Quick Answer
Trivy is an open-source, comprehensive security scanner developed by Aqua Security that detects vulnerabilities, misconfigurations, secrets, and license issues. It supports scanning container images, filesystems, Git repositories, Kubernetes clusters, and Infrastructure as Code files in a single unified tool.
Detailed Answer
Think of Trivy as a Swiss Army knife for security scanning. Just as a Swiss Army knife combines multiple tools into a single handle, Trivy combines vulnerability scanning, misconfiguration detection, secret scanning, and license checking into one CLI binary. Before Trivy existed, teams needed separate tools for each type of scan, making security pipelines complex and hard to maintain.
Trivy is an open-source security scanner originally created by Aqua Security and now part of the Cloud Native Computing Foundation (CNCF) ecosystem. It performs static analysis to find known vulnerabilities (CVEs) in operating system packages and application dependencies, misconfigurations in Infrastructure as Code files like Terraform and Kubernetes manifests, hardcoded secrets such as API keys and passwords, and software license violations. The tool is written in Go and distributed as a single binary, which makes installation straightforward across Linux, macOS, and Windows. In a typical DevOps pipeline for a service like payments-api, Trivy can scan the Docker image during the CI build stage and block deployments that contain critical vulnerabilities.
Under the hood, Trivy works by downloading vulnerability databases from GitHub releases and OCI registries, then matching the packages found in your scan targets against known CVEs. It supports multiple scan targets, which Trivy calls 'scanners' and 'targets.' The primary targets are container images (both local and remote registry images), filesystem directories, Git repositories, Kubernetes clusters (via the kubernetes scanner), and virtual machine images. For container images, Trivy unpacks the image layers, identifies the OS distribution and installed packages, detects application dependencies (like npm packages in node_modules or Python packages in requirements.txt), and cross-references everything against its vulnerability database.
In production environments, teams integrate Trivy at multiple stages of the software delivery lifecycle. A developer working on user-auth-service might run Trivy locally before committing to catch obvious issues early. The CI pipeline then runs Trivy as a gate, failing the build if CRITICAL or HIGH vulnerabilities are found in the container image. In Kubernetes environments, Trivy Operator (a separate component) runs as a controller inside the cluster, continuously scanning deployed workloads and generating VulnerabilityReport custom resources. This gives the security team a live inventory of vulnerabilities across all services like order-processing-service, inventory-sync, and checkout-service running in the cluster.
A common misconception for beginners is that Trivy only scans container images. While image scanning is its most popular feature, Trivy's filesystem and repository scanning capabilities are equally powerful. Running trivy fs on your project directory will detect vulnerable dependencies in package-lock.json, go.sum, pom.xml, and dozens of other dependency manifest files without ever building a container image. This makes Trivy useful even for teams that deploy to serverless platforms or traditional virtual machines, not just those running containers.