# Scanning Images with Trivy — DevSecOps

Source: https://www.skillbyai.com/en/devsecops/dso-image-scanning

> Scan container images and filesystems for vulnerabilities, set sensible thresholds and handle unfixed CVEs.

## What an image scanner sees

An image scanner unpacks the image layers, identifies OS packages (from the package database of Debian, Alpine, and so on) and language packages (from lockfiles, JARs, Python site-packages, Go binaries), then matches versions against vulnerability data. **Trivy** is a popular open-source scanner that also detects misconfigurations, secrets and licences, and can scan filesystems, Git repositories, IaC and Kubernetes clusters. Grype is another common choice. Raw results are noisy, so tune them: filter by **severity** (often HIGH and CRITICAL for gates), use `--ignore-unfixed` so you are not blocked by CVEs that have no patched version yet, and record accepted risks in an ignore file with a reason and an expiry date. Remember that a clean scan today is not clean forever: new CVEs are published daily, so re-scan images in your registry and running in production on a schedule, not only at build time.

## Typical Trivy commands

The first command is a CI gate; the others are useful for reports and SBOMs.

```bash
# Fail the build on fixable HIGH/CRITICAL vulnerabilities
trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 shop/api:1.4.2

# Scan the project directory: dependencies, secrets and misconfigurations
trivy fs --scanners vuln,secret,misconfig .

# Produce a CycloneDX SBOM for the image
trivy image --format cyclonedx --output sbom.cdx.json shop/api:1.4.2
```

## Expiry dates on medicines

A medicine that was fine when you bought it can expire on the shelf. An image that scanned clean last month can 'expire' when a new CVE is published, which is why you re-check stock regularly.

## Fix by rebuilding, not patching in place

Most image CVEs come from the base image. The fix is to bump the base, rebuild and redeploy, not to `apt-get upgrade` inside a running container.

**Quiz:** What does Trivy's --ignore-unfixed flag do?

- [x] Hides vulnerabilities that have no fixed version available yet
- [ ] Ignores all LOW severity findings
- [ ] Skips scanning the base image
- [ ] Automatically upgrades vulnerable packages

*Answer:* Hides vulnerabilities that have no fixed version available yet. It suppresses findings with no available fix, so gates focus on vulnerabilities you can actually resolve now.