Trivy

What it does#

Trivy detects OS package and language dependency vulnerabilities, embedded secrets and IaC misconfigurations. It can also emit CycloneDX/SPDX SBOMs and scan SBOMs it or other tools produced.

Where it fits#

The Secure stage: scan images after build and before push, scan the repository (trivy fs) in merge requests, and re-scan released images on a schedule. It also runs in-cluster (trivy k8s) for a periodic posture check.

Quick start#

trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 registry.example.com/app:1.2.3
trivy fs --scanners vuln,secret,misconfig .
trivy image --format cyclonedx --output app.cdx.json registry.example.com/app:1.2.3

Common pitfalls#

• Gating on unfixed CVEs trains people to ignore the gate — use --ignore-unfixed for the blocking scan.
• Downloading the DB on every CI job hits registry rate limits; cache TRIVY_CACHE_DIR.
• Exceptions without expiry become permanent. Prefer .trivyignore.yaml with expired_at.

On this site#

• Secrets and Configuration Security: trivy image --scanners secret finding a GitLab token in a copied .env and a Stripe key in the image configuration, and missing the token in a deleted layer.

Hands-on labs using Trivy

Lab

Secure Docker Images with Trivy

Build a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.

beginner 30 minutes Trivy · Docker

Articles about Trivy

CI/CD intermediate

Reusable GitLab CI Templates and Components: A Golden Delivery Path

One platform-owned GitLab CI template instead of a pipeline per repository: spec:inputs with validation, a consumer that includes it by project and tag, extension points, versioning, and what a consumer can override.

Sep 16, 2026 14 min read

Cloud Security intermediate

Secrets and Configuration Security: Images, Kubernetes, Vault and Rotation

The secrets lifecycle for a cloud workload: credentials recovered from image history and deleted layers, a build that leaves nothing behind, Secrets in etcd before and after encryption at rest, rotation, and Vault TTLs.

Sep 16, 2026 14 min read

Docker beginner

Building Minimal Container Images with Multi-Stage Builds

Build the same Go service as a single-stage image and as a multi-stage image on a distroless base, then compare size, package count, scanner findings and the user it runs as.

Sep 1, 2026 12 min read

CI/CD intermediate

A GitLab CI/CD Security Pipeline That Developers Do Not Route Around

The GitLab pipeline that gated this site while it ran CI: frozen installs, parallel quality gates, Trivy with SAST and secret detection, artifact verification, and one deployment owner behind protected main.

Aug 18, 2026 20 min read

Security Tools beginner

Container Image Scanning with Trivy

How Trivy finds OS and application vulnerabilities, secrets and misconfigurations in container images, how to make the results actionable, and how to wire it into CI without slowing builds down.

May 12, 2026 9 min read

CI/CD intermediate

Building a Secure CI/CD Pipeline with Jenkins

A declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.

May 7, 2026 9 min read