Repolode
Submit
aquasecurity

aquasecurity/trivy

Trivy is an open-source security scanner that finds vulnerabilities, misconfigurations, secrets and SBOM data in containers, filesystems, Git repos, VM images and Kubernetes.

Open-source alternative to:SnykPrisma Cloud

View on GitHubWebsite
Stars
38,514
Forks
774
Open issues
271
Last commit
23 hours ago

What is it?

Trivy is a security scanner that checks a range of targets: container images, filesystems, remote Git repositories, virtual machine images and Kubernetes clusters. For each target it can look for known CVEs in OS packages and application dependencies, generate an SBOM listing the software in use, detect infrastructure-as-code misconfigurations, find exposed secrets, and report software licenses.

Usage follows a simple pattern: a target subcommand such as image, fs or k8s, a set of scanners selected with --scanners, and the subject to scan. Results can be printed in several report formats, and the tool is distributed as a single binary, a Docker image, and through common package managers.

Trivy is maintained by Aqua Security and integrates with CI systems such as GitHub Actions, a Kubernetes operator, and a VS Code extension.

Key features

  • 01Scans container images, filesystems, remote Git repositories, VM images and Kubernetes clusters.
  • 02Detects known CVEs in OS packages and software dependencies.
  • 03Finds IaC misconfigurations and exposed secrets.
  • 04Generates SBOM output and reports software licenses.
  • 05Selects scanners per run with the --scanners flag.

Use cases

  • Scanning container images for vulnerabilities before deploying them.
  • Checking Terraform or Kubernetes manifests for misconfigurations in CI pipelines.
  • Auditing a Kubernetes cluster for risky workloads.
  • Detecting hardcoded secrets in a code repository.

Quick start

  1. 1

    Install Trivy with Homebrew

    brew install trivy
  2. 2

    Or run Trivy from the Docker image

    docker run aquasec/trivy
  3. 3

    Scan a container image

    trivy image python:3.4-alpine

Things to know

  • Canary builds from the main branch may contain critical bugs and are not recommended for production.

Topics

#security#vulnerability-scanner#containers#kubernetes#iac#sbom#devsecops#docker#go#golang

FAQ

What is trivy?
Trivy is an open-source security scanner that finds vulnerabilities, misconfigurations, secrets and SBOM data in containers, filesystems, Git repos, VM images and Kubernetes. Trivy is a security scanner that checks a range of targets: container images, filesystems, remote Git repositories, virtual machine images and Kubernetes clusters. For each target it can look for known CVEs in OS packages and application dependencies, generate an SBOM listing the software in use, detect infrastructure-as-code misconfigurations, find exposed secrets, and report software licenses.
Is trivy free to use? What license does it have?
trivy is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is trivy still maintained?
Actively maintained. The last commit to trivy was on Oct 19, 2026.
What can I use trivy for?
Scanning container images for vulnerabilities before deploying them. Checking Terraform or Kubernetes manifests for misconfigurations in CI pipelines. Auditing a Kubernetes cluster for risky workloads. Detecting hardcoded secrets in a code repository.
How do I install trivy?
Install Trivy with Homebrew: brew install trivy Or run Trivy from the Docker image: docker run aquasec/trivy Scan a container image: trivy image python:3.4-alpine
Where can I get trivy?
The source code and installation instructions are on GitHub: https://github.com/aquasecurity/trivy

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects