Trivy: Security Scanner for Containers, Code and Kubernetes

What Trivy is

Trivy is a security scanner from Aqua Security that its README describes as comprehensive and versatile. The model is simple: Trivy has scanners that look for security issues, and targets where it can find them. One binary can scan container images, filesystems, remote Git repositories, virtual machine images and Kubernetes clusters, and in each of those it can look for OS packages and software dependencies (producing an SBOM), known vulnerabilities (CVEs), infrastructure-as-code issues and misconfigurations, secrets and other sensitive information, and software licences.

It is aimed at developers, platform teams and security engineers who want one tool for checks in CI and for auditing what is already deployed. Trivy is written in Go and licensed under Apache-2.0, and the README says it supports most popular programming languages, operating systems and platforms, with the complete matrix on its Scanning Coverage page.

How it works

The installed Trivy artifact contains the scanner engine but not the security data it needs to make detections. That data lives in separate "databases" that Trivy fetches and maintains automatically. The database documentation lists three: the Vulnerabilities DB (trivy-db, CVE information collected from various feeds), the Java DB (trivy-java-db, an index of Java artifacts and their hash digests, used to identify JARs) and the Checks Bundle (trivy-checks, the logic of the misconfiguration checks). All three are packaged as OCI images and published to GitHub Container Registry, Docker Hub and AWS ECR. By default Trivy pulls them from mirror.gcr.io/aquasec first and then from ghcr.io/aquasecurity.

A scan therefore has two halves: Trivy inspects the target to inventory packages, dependencies, configuration files and file contents, then matches that inventory against the downloaded data. The Checks Bundle is also embedded in the binary at build time and used as a fallback when the external copy is unavailable, so misconfiguration scanning still works in an air-gapped environment, using the checks from the release you are running. Some features reach further: Java scanning may call Maven Central to identify packages, Terraform scanning may fetch remote modules, and VEX Hub data is fetched from GitHub.

The CLI uses one pattern for everything, trivy <target> [--scanners <scanner1,scanner2>] <subject>, so the same flags and output options apply whether you are scanning an image, a directory or a cluster.

Key features

• Five target types: container images, filesystems, remote Git repositories, VM images and Kubernetes.
• Several scanners in one pass: vulnerabilities, misconfigurations, secrets, licences and SBOM generation, selected with --scanners.
• Kubernetes cluster reports: trivy k8s scans a cluster and can print a summary report for it.
• Configurable database sources: --db-repository, --java-db-repository and --checks-bundle-repository point Trivy at alternative registries. The vulnerability and Java database flags accept multiple values, and Trivy falls back through them on transient errors such as 429 or 5xx responses.
• Offline and air-gapped operation: the databases can be self-hosted in your own registry, downloads can be skipped with --skip-db-update, --skip-java-db-update and --skip-check-update, and Maven Central lookups can be disabled with --offline-scan.
• Cache management: trivy clean removes caches and databases, either all at once or component by component.
• Integrations: the README highlights an official GitHub Action, a Kubernetes operator and a VS Code extension, with more listed on the Ecosystem page.
• Many install channels: Homebrew, official container images, GitHub release binaries, an install script, RPM and DEB repositories and FreeBSD packages, plus community-maintained packages for Arch Linux, openSUSE, MacPorts and Nix.
• Canary builds: images and binaries are built from every push to the main branch, for people who want the newest changes early.

Getting started

Install with Homebrew on macOS or Linux, or run the official container image:

brew install trivy
docker run aquasec/trivy

Scan a container image for known vulnerabilities:

trivy image python:3.4-alpine

Scan a project directory for vulnerabilities, secrets and misconfigurations in one pass:

trivy fs --scanners vuln,secret,misconfig myproject/

Get a summary report for a Kubernetes cluster:

trivy k8s --report summary cluster

Populate the database cache without running a scan, which is useful as a warm-up step so later scans reuse the cache:

trivy image --download-db-only

To stop Trivy from contacting its update and telemetry endpoint, both flags are needed:

trivy image --skip-version-check --disable-telemetry <image>

When running Trivy as a container, the installation docs advise mounting a persistent cache directory from the host, and mounting the container engine socket from the host when scanning local images.

Use cases

• CI gates for container images: scan every image a pipeline builds before it is pushed, using the GitHub Action or the CLI directly.
• Repository checks: run filesystem scans for leaked secrets and for misconfigurations in Terraform, Kubernetes manifests and other infrastructure-as-code files.
• SBOM generation: inventory the OS packages and dependencies in an image or directory for compliance or supply-chain tracking.
• Cluster audits: scan a running Kubernetes cluster on demand, or use the Trivy operator for in-cluster scanning.
• Licence review: list the licences of dependencies before shipping a product.
• Restricted networks: mirror the OCI databases into an internal registry and point Trivy at it for regulated or air-gapped environments.

How it compares

Trivy sits in a crowded category of open-source scanners. Single-purpose tools, such as Gitleaks for secrets or dedicated IaC linters, focus on one of the areas Trivy covers, and other vulnerability and SBOM scanners focus on the dependency side. Trivy's pitch is breadth: one binary and one flag set across images, code, VM images and clusters, with the security data distributed as OCI images that fit into existing registry infrastructure. Whether that breadth beats a set of specialised tools depends on how deep you need each check to go.

On the commercial side, the README is direct that Aqua Security sells products that build on Trivy, and it links to a comparison table between Trivy and the commercial offering for teams that want more than the CLI provides. None of the README's quick-start commands require an Aqua account.

Things to know before adopting

• Licence: Apache-2.0.
• Telemetry is on by default: Trivy collects anonymous usage data, namely an installation identifier (a one-way hash of a machine fingerprint), the Trivy version, the operating system and non-revealing scan options. The docs say user-controlled values such as file paths and image names are never collected. --disable-telemetry turns it off, but Trivy still contacts check.trivy.dev for update checks unless --skip-version-check is also set.
• Network dependence: normal operation needs internet access to fetch the databases. The docs note that Trivy relies on public free infrastructure and that under extreme load you may encounter rate limiting, so busy CI fleets may want to cache or self-host the databases.
• Data freshness: results are only as current as the downloaded databases, so skipping updates trades freshness for speed or isolation.
• Canary builds are not for production: the README warns they might have critical bugs.
• Community packages: the Arch, openSUSE, MacPorts and Nix packages are maintained outside the Trivy team, which directs support questions about them to their own maintainers.
• Vendor-backed project: Trivy is an Aqua Security open source project, and the README promotes Aqua's commercial platform alongside it.
• Pre-1.0 versioning: releases are still numbered 0.x.

Project activity

As of October 2026 the aquasecurity/trivy repository has about 38,700 stars. It was created in April 2019, is written in Go and is licensed under Apache-2.0. The latest release at the time of writing is v0.76.1, published on October 21, 2026. Source is at github.com/aquasecurity/trivy, the homepage is trivy.dev, and documentation is at trivy.dev/docs.

[![Featured on TechLogHub](https://techloghub.com/badge-neutral.svg)](https://techloghub.com/open-source/trivy?utm_source=techloghub_badge&utm_medium=referral&utm_campaign=readme)