About Trivy
Trivy is an open source security scanner. It looks for known vulnerabilities and misconfigurations in code repositories, container images, binaries and Kubernetes clusters.
What it does
Trivy checks what you build and run for security problems. It can scan container images, file systems and code repositories for known vulnerabilities, and it reviews infrastructure-as-code files for misconfigurations. It can also produce software bills of materials (SBOMs) and look for exposed secrets, which helps when you need a clear list of the components in a release.
Key features
- Scans container images for known vulnerabilities
- Checks infrastructure-as-code for misconfigurations
- Scans Kubernetes clusters for security issues
- Generates SBOM files for software components
- Finds secrets left in code and files
Who it's for
DevOps and platform engineers who build container images are a natural fit. Developers who want a free scanner in their build pipeline may also find it useful, and so may security teams that need one tool across many targets.
Pricing and good to know
Trivy is released under the Apache-2.0 license and its code is on GitHub, so it is free to use under those terms. It runs as a command-line tool and can be added to CI workflows. Check the documentation for supported targets, since coverage changes between releases.
Highlights
- Scan container images for known vulnerabilities
- Check infrastructure-as-code for misconfigurations
- Scan Kubernetes clusters for security issues
- Generate SBOM files listing software components
- Find secrets left in code and files
