performing-container-security-scanning-with-trivy

Run trivy image against a local or remote image to list CVEs with severity, CVSS scores, fixed versions, and affected packages. For a full audit, enable all scanners with --scanners vuln,misconfig,secret,license since the default runs vulnerability scanning only.

Use Trivy with --format cyclonedx or --format spdx to produce a Software Bill of Materials from the scanned image. SBOMs support supply chain compliance and help verify which components were actually enumerated, especially for distroless images.

Yes, Trivy detects misconfigurations in Dockerfiles, Kubernetes YAML, Terraform, and Helm charts using built-in policy checks aligned with CIS benchmarks. It can also be deployed as a Trivy Operator inside a Kubernetes cluster for continuous scanning.

Add Trivy as a pipeline step in GitHub Actions, GitLab CI, or Jenkins that fails builds on critical or high vulnerabilities. It can emit SARIF reports for GitHub Advanced Security and JUnit XML for test dashboards.

A clean result often means limited coverage, not a safe image. Default scans skip misconfigurations and secrets, distroless or scratch images may lack detectable lockfiles, and a stale vulnerability database misses new CVEs, so refresh the DB and re-run with all scanners.

Filtering to CRITICAL,HIGH drops exploitable MEDIUM findings, and --ignore-unfixed hides CVEs that have no patch yet but remain exploitable. Report what was filtered and re-run without severity filters to gauge true vulnerability counts.