aquasecurity/trivy
Trivy
Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain.
The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations against compliance standards and relies on a remote, periodically updated vulnerability database to maintain current detection logic without requiring binary updates. By employing static analysis pattern matching, it maps disparate scan results into a unified output schema for consistent reporting.
Beyond its core scanning capabilities, the project supports cloud infrastructure auditing and deep inspection of local and remote environments. It is distributed as a single cross-platform executable, and comprehensive configuration and usage details are available in the project's official user guide.
Features
- Container Security Scanners - Identifies vulnerabilities and misconfigurations in container images for secure deployment.
- Vulnerability Scanners - Identifies known software vulnerabilities and misconfigurations within container images, file systems, and infrastructure files.
- Infrastructure as Code Scanners - Detects security risks and policy violations in configuration files like Terraform or Kubernetes manifests.
- Infrastructure Security Scanners - Evaluates cloud configurations and infrastructure templates against security best practices.
- Pipeline Security Tools - Automates security checks within development pipelines to prevent vulnerable code from reaching production.
