Trivy: One Scanner for Images, IaC and Dependencies
Add it to CI in ten minutes. Then spend a week deciding which findings you are actually going to fix.
Adding Trivy to a pipeline takes about ten minutes. Deciding what to do with its output takes about a week, and that week is the actual work.
What it covers
One scanner across most of what a project ships:
trivy image myapp:latest # OS packages + language dependencies
trivy fs . # source tree, lockfiles
trivy config ./infra # Dockerfiles, Kubernetes, Terraform
trivy repo <url> # a repository directlyNot having to run four tools with four report formats is most of the value. The findings land in one place with one severity scale.
The first run will alarm you
A typical Node image scans with dozens of findings, many labelled critical. This is normal, and treating it as an emergency is the mistake that gets scanning switched off.
Triage in this order:
Is it reachable? A vulnerability in a library your code never calls is real but not urgent. A vulnerability in your HTTP parser is.
Is it in the base image or in your dependencies? Base image findings are usually fixed by moving to a current or slimmer base — often dozens disappear at once.
Is there a fix available? --ignore-unfixed is not cheating. A critical with no patch is a monitoring item, not a build failure.
Configuring it so people keep using it
trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 myapp:latestFail the build on high and critical with fixes available. Report everything else without blocking.
The alternative — failing on every finding — means a blocked deploy on a Friday for an unfixable low-severity issue in a package nobody imports, and after the second time someone adds || true and the scanner is decorative.
Use a .trivyignore with expiry dates and a reason for each entry, and review it monthly. An ignore file with no dates becomes permanent by default.
The container-specific wins
Most findings come from packages your application never uses — a shell, a package manager, build tools left in the final layer. A multi-stage build and a minimal base image typically remove more vulnerabilities than any amount of patching.
Scanning tells you the number. Slimming the image is what reduces it.
Resources
- Repo: aquasecurity/trivy
- Docs: trivy.dev
- Video walkthroughs: YouTube: Trivy tutorial
- The structural fix: A smaller image is a smaller attack surface
Need this built properly?
I build secure, fast, bilingual platforms for clients across Egypt, Saudi Arabia, the UAE and Kuwait.
