Trivy is an open-source security scanner for Docker images, repositories, and configuration. It fits naturally into golden-image builds and CI/CD workflows, where vulnerability databases can be cached between scans. section 17.2
A practical scan workflow can:
- Scan an image for vulnerabilities, then narrow results to HIGH and CRITICAL severity. section 17.2
- Use an ignore file for accepted vulnerabilities after evaluating their operational risk. section 17.2
- Scan remote Git repositories for vulnerabilities or misconfigured Dockerfiles and Kubernetes manifests. section 17.2
Scan an image
Create a trivy-cache volume, then run diamol/trivy:2e image --scanners vuln against diamol/openjdk:2e. Repeat with --severity HIGH,CRITICAL and optionally --ignorefile /sample.trivyignore. section 17.2
# create a volume to use as a data cache: docker volume create trivy-cache # run a vulnerability scan on the book's OpenJDK image: docker run -v trivy-cache:/root/.cache ` -it diamol/trivy:2e image --scanners vuln diamol/openjdk:2e # run the same scan but ignore low severity problems: docker run -v trivy-cache:/root/.cache ` -it diamol/trivy:2e image --scanners vuln ` --severity HIGH,CRITICAL diamol/openjdk:2e # and finally ignore specific problems we have accepted: docker run -v trivy-cache:/root/.cache ` -it diamol/trivy:2e image --scanners vuln ` --severity HIGH,CRITICAL --ignorefile /sample.trivyignore ` diamol/openjdk:2e
Runnable commands demonstrate cached image scans, severity filtering, and accepted-vulnerability exclusions. section 17.2
