Trivy (pronunciation) is a comprehensive and versatile security scanner.
Trivy has scanners that look for security issues, and targets where it can find those issues.
Targets (what Trivy can scan):
Container Image
Filesystem
Git Repository (remote)
Virtual Machine Image
Kubernetes
AWS
Scanners (what Trivy can find there):
OS packages and software dependencies in use (SBOM)
Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:
Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:
trivy k8s --report summary cluster
----+++<details>++++++<summary>+++Result+++</summary>+++ +++</details>+++
== FAQ
=== How to pronounce the name "Trivy"?
`tri` is pronounced like **tri**gger, `vy` is pronounced like en**vy**.
'''
Trivy is an https://aquasec.com[Aqua Security] open source project. +
Learn about our open source work and portfolio https://www.aquasec.com/products/open-source-projects/[here]. +
Contact us about any matter by opening a GitHub Discussion https://raw.githubusercontent.com/aquasecurity/trivy/discussions[here]
@aquasecurity
Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.
Targets (what Trivy can scan):
Container Image
Filesystem
Git Repository (remote)
Virtual Machine Image
Kubernetes
AWS
Scanners (what Trivy can find there):
OS packages and software dependencies in use (SBOM)
Known vulnerabilities (CVEs)
IaC issues and misconfigurations
Sensitive information and secrets
Software licenses
To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.
=
readme
Get Trivy
Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:
brew install trivydocker run aquasec/trivyDownload binary from https://raw.githubusercontent.com/aquasecurity/trivy/releases/latest/
See Installation for more
Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:
GitHub Actions
Kubernetes operator
VS Code plugin
See Ecosystem for more
General usage
Examples:
trivy fs --scanners vuln,secret,config myproject/ ----
Result
https://user-images.githubusercontent.com/1161307/171013917-b1f37810-f434-465c-b01a-22de036bd9b3.mov