Scanning Images with Trivy

What an image scanner sees

An image scanner unpacks the image layers, identifies OS packages (from the package database of Debian, Alpine, and so on) and language packages (from lockfiles, JARs, Python site-packages, Go binaries), then matches versions against vulnerability data. Trivy is a popular open-source scanner that also detects misconfigurations, secrets and licences, and can scan filesystems, Git repositories, IaC and Kubernetes clusters. Grype is another common choice. Raw results are noisy, so tune them: filter by severity (often HIGH and CRITICAL for gates), use --ignore-unfixed so you are not blocked by CVEs that have no patched version yet, and record accepted risks in an ignore file with a reason and an expiry date. Remember that a clean scan today is not clean forever: new CVEs are published daily, so re-scan images in your registry and running in production on a schedule, not only at build time.

Typical Trivy commands

The first command is a CI gate; the others are useful for reports and SBOMs.

# Fail the build on fixable HIGH/CRITICAL vulnerabilities
trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 shop/api:1.4.2

# Scan the project directory: dependencies, secrets and misconfigurations
trivy fs --scanners vuln,secret,misconfig .

# Produce a CycloneDX SBOM for the image
trivy image --format cyclonedx --output sbom.cdx.json shop/api:1.4.2

Expiry dates on medicines

A medicine that was fine when you bought it can expire on the shelf. An image that scanned clean last month can 'expire' when a new CVE is published, which is why you re-check stock regularly.

Fix by rebuilding, not patching in place

Most image CVEs come from the base image. The fix is to bump the base, rebuild and redeploy, not to apt-get upgrade inside a running container.

Quick check: What does Trivy's --ignore-unfixed flag do?

• Hides vulnerabilities that have no fixed version available yet
• Ignores all LOW severity findings
• Skips scanning the base image
• Automatically upgrades vulnerable packages