How does Trivy work for container scanning?

Question

Accepted Answer

**Trivy** — A tool for scanning vulnerabilities in Docker images, file systems, and IaC.

**What it scans:** OS packages, dependencies, IaC (Terraform, K8s YAML), secrets.

```bash
# Scanning a Docker image
trivy image nginx:latest
trivy image --severity HIGH,CRITICAL myapp:latest

# Scanning the file system
trivy fs --security-checks vuln,config,secret ./

# Scanning Dockerfile
trivy config Dockerfile

# SBOM
trivy image --format spdx-json myapp:latest > sbom.json
```

**GitHub Actions:**
```yaml
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: myapp:latest
    format: sarif
    output: trivy-results.sarif
    severity: CRITICAL,HIGH
    exit-code: 1

- name: Upload Trivy scan results
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: trivy-results.sarif
```

**GitLab CI:**
```yaml
trivy-scan:
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
```

**Trivy Operator** — automatically scans all images in a K8s cluster and creates VulnerabilityReport.

DevOps: How does Trivy work for container scanning?