trivy-scan

Vulnerability scanning for container images is performed using Trivy to identify and remediate security issues before deployment. You can run the Trivy image command against your target image to detect vulnerabilities and enforce security gates in your pipelines.

Yes, you can fail a CI/CD pipeline by integrating Trivy vulnerability scanning with severity filtering controls. The scan can be configured to break builds and stop deployment workflows upon detecting HIGH or CRITICAL security findings.

Filesystem vulnerability scans generate SARIF output using the Trivy fs command. This standardized reporting format captures security findings from local repositories and file systems, producing actionable reports for compliance needs and automated security audits.

The best way to scan a local filesystem is using the Trivy fs command to identify security vulnerabilities. This approach detects issues in local directories and repositories, allowing you to apply severity filtering and remediate findings before deployment.

Trivy vulnerability scanning supports container images, filesystems, and git repositories using specific commands. It covers image, fs, and repo scanning with severity controls and SARIF output to meet diverse scanning and compliance requirements.

Installing Trivy is required to execute repository vulnerability scans and identify security issues. The tooling provides standardized installation guidance and enforces requirements to properly run trivy repo commands and generate accurate security findings.