Skip to content
/ trivy Public
forked from aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

License

Notifications You must be signed in to change notification settings

antflux/trivy

This branch is 1482 commits behind aquasecurity/trivy:main.

Folders and files

NameName
Last commit message
Last commit date
Feb 3, 2023
Oct 21, 2022
Feb 1, 2023
Feb 10, 2023
Nov 20, 2022
Feb 1, 2023
Jan 23, 2023
Jan 28, 2023
Feb 10, 2023
Nov 27, 2022
Jan 31, 2023
Feb 10, 2023
Jan 23, 2023
Dec 13, 2019
Jul 28, 2020
Dec 22, 2022
Nov 27, 2022
Jan 30, 2023
Apr 11, 2022
Feb 3, 2023
Feb 3, 2023
Dec 4, 2022
Mar 11, 2020
Feb 1, 2023
Mar 11, 2020
Jan 23, 2023
Dec 22, 2022
Feb 10, 2023
Feb 10, 2023
Dec 22, 2022
Dec 22, 2022
Feb 1, 2023

Repository files navigation

Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

Targets (what Trivy can scan):

  • Container Image
  • Filesystem
  • Git Repository (remote)
  • Virtual Machine Image
  • Kubernetes
  • AWS

Scanners (what Trivy can find there):

  • OS packages and software dependencies in use (SBOM)
  • Known vulnerabilities (CVEs)
  • IaC issues and misconfigurations
  • Sensitive information and secrets
  • Software licenses

To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.

Quick Start

Get Trivy

Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:

Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:

General usage

trivy <target> [--scanners <scanner1,scanner2>] <subject>

Examples:

trivy image python:3.4-alpine
Result
trivy-image.mov
trivy fs --scanners vuln,secret,config myproject/
Result
trivy-fs.mov
trivy k8s --report summary cluster
Result

k8s summary

FAQ

How to pronounce the name "Trivy"?

tri is pronounced like trigger, vy is pronounced like envy.


Trivy is an Aqua Security open source project.
Learn about our open source work and portfolio here.
Contact us about any matter by opening a GitHub Discussion here

About

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Go 98.1%
  • Smarty 0.8%
  • Shell 0.6%
  • Open Policy Agent 0.2%
  • Makefile 0.2%
  • Mustache 0.1%