Trivy

Trivy checks the container images and source code you use for known vulnerabilities and for secrets such as API keys. It scans files on your own machine, so it is an easy first tool to try.

This review is for people who build software with dependencies from Docker, npm, or similar ecosystems. After reading it, you can do the following:

• List the vulnerable dependencies in a project on your computer
• Filter the results by severity and start with the ones that have a fix
• Scan a container image

##What Trivy is for

You use Trivy by combining a target (where to look) with scanners (what to look for).

The two columns don’t map one to one. For example, you can look for vulnerabilities, secrets, and misconfigurations in a local folder in a single run.

##Install

The official installation page lists every method. The common ones are:

• macOS and Linux: brew install trivy with Homebrew
• Debian, Ubuntu, RHEL, and CentOS: add the official package repository and install from it
• Windows: download trivy_<version>_windows-64bit.zip from the releases page and unzip it
• Docker: use the official aquasec/trivy image

After installing, run trivy --version to check that it prints a version number.

##Try it safely: scan a local project

1. Go to the folder of the project you want to check.

2. Run this command to look for vulnerabilities, secrets, and misconfigurations together:

   trivy fs --scanners vuln,secret,misconfig .

3. The first run downloads the vulnerability database, so it takes a little longer. When it finishes, Trivy prints the problems it found as a table.

Most of the traffic Trivy sends out is the download of this database and of the misconfiguration checks, both from mirror.gcr.io or ghcr.io. Later runs use the local cache, and --skip-db-update skips the database update. Trivy can also call APIs to identify dependencies; --offline-scan turns that off.

##Filter the results

The first results are often long. Use these options to focus on what to fix now.

To scan a container image, use trivy image <image>. For example, trivy image --severity HIGH,CRITICAL python:3.4-alpine shows only the serious vulnerabilities in an old Python image.

##Cautions

##Read next

• cd ../osv-scannerOSV-Scannera scanner focused on dependency vulnerabilities, with a comparison to Trivy
• cd ../gitleaksGitleaksfinds leaked secrets, including in Git history
• cd ../prowlerProwleraudits cloud settings such as AWS