Trivy Security Scanner: Vulnerability Scanning Guide

In this blog, you will learn to use an open-source Trivy security scanner for scanning Docker Containers, Filesystem, Git repo, Kubernetes, etc.

What is Trivy

Trivy is an open-source security scanner that scans for vulnerabilities in containers and other artifacts. It has an internal database called trivy-db which contains information about different vulnerabilities.

It is created and maintained by AquaSecurity

Trivy not only scan for vulnerability but also give suggestion to solve the issues and links to the vulnerable data for more information.

Trivy can access a wide range of vulnerability information from different vulnerability databases and uses vulnerability data from those vulnerability databases to detect security issues. Some of the vulnerability databases are National Vulnerability Database (NVD), Red Hat Security Data, and Alpine SecDB.

While scanning Trivy compares the directory or container image’s software packages and libraries with the information in the vulnerability database and if a match is found that means the package or library in the container image has a vulnerability. Then Trivy reports these vulnerabilities along with other details such as severity level, affected versions, and repair suggestions.

Trivy updates its database every 6 hours. When you start the scan, trivy updates the databases automatically so that you don’t have to keep track of database updates.

Install Trivy

Let’s see how to install Trivy on Ubuntu, follow the below steps to install Trivy.

Step 1: First, install the required dependencies for Trivy using the command given below:

sudo apt-get install wget apt-transport-https gnupg lsb-release

Step 2: Download the public key and Trivy repository using the commands given below:

wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null

echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list

Step 3: Update the repository using the update command.

sudo apt update -y

Step 4: Install Trivy using the command:

sudo apt install trivy

How to scan for vulnerability

Whenever you run the Trivy command to scan for vulnerabilities it will download the relevant database first and compare it with the vulnerabilities listed in the database.

Trivy shows the risk of vulnerability as critical, high, medium, and low.

1. Critical – This is the most severe vulnerability which needs to be fixed as soon as possible because it can allow administrative control over the system.
2. High – It could cause data leakage.
3. Medium – It could make the system unavailable for users.
4. Low – This can be solved during regular maintenance.

We can use Trivy to scan the following targets:

1. Container images
2. Filesystem
3. Remote Git repositories

There are also experimental features to scan Kubernetes & AWS configurations.

Trivy uses different commands to scan targets that are mentioned above.

Let’s look at an example for each.

Scan Container Images

You can scan container images for vulnerabilities using Trivy.

The command used to scan container images is given below:

trivy image <image name>

For example, if the name of the image is nginx:1 then the command will be:

trivy image nginx:1

It will scan the image and shows the vulnerability of the image as shown below.

If you have the container image in tar format, you can use the following command to scan it.

trivy image --input nginx:1.tar

Scan Filesystem

The command used to scan the filesystem is given below:

trivy fs <path of the directory>

For example, if the path of the directory is Documents/jenkins-pipeline/ then the command will be:

trivy fs Documents/jenkins-pipeline/

It will scan the directory and shows the vulnerability in the directory as shown below.

Scan Git Repository

The command used to scan the git repository is given below:

trivy repo <repo URL>

If you are using a private repository, you need to provide your git token for authentication as given below.

export GITHUB_TOKEN=,git token>

trivy repo <repo URL>

It will scan the repo and shows the vulnerability in the repo as shown below.

You can also check out the official Trivy scanner video guide to see Trivy in action.

Conclusion

Vulnerability scanning is one of the important aspects of CI/CD. Application code, infra code, and infra configs should be scanned for vulnerabilities during the CI stages. This ensures good DevSecOps practices.

In your projects, ensure you add a security scanner like Trivy to your devops tools.

Also, if you are looking for CIS compliance for Kubernetes clusters, check out our Kube Bench guide.