Anchore
Container security and compliance platform for scanning container images and software supply chains
Trivy
Unified scanner for vulnerabilities, misconfigurations, secrets, and SBOMs
Trivy scans container images, filesystems, Git repos, VM images, and Kubernetes clusters for CVEs, misconfigurations, secrets, licenses, and generates SBOMs, supporting many languages and platforms.
Overview
Overview
Trivy provides a single‑command interface to detect a wide range of security issues across multiple target types, including container images, local filesystems, remote Git repositories, virtual‑machine images, and Kubernetes clusters. It identifies known CVEs, infrastructure‑as‑code misconfigurations, embedded secrets, and license problems while also producing a software bill of materials (SBOM) for compliance and supply‑chain visibility.
Who It Serves & How to Deploy
Designed for DevSecOps engineers, developers, and security auditors, Trivy integrates seamlessly into CI/CD pipelines, IDEs, and orchestration platforms. Installation is straightforward via Homebrew, Docker, pre‑built binaries, or source compilation, and the tool runs on all major operating systems. Updates to vulnerability databases are fetched automatically, but cached data enables offline scans after the initial download. The scanner’s fast, single‑pass approach makes it suitable for both local development checks and large‑scale production environments.
Highlights
Scans images, filesystems, Git repos, VM images, and Kubernetes clusters
Detects CVEs, IaC misconfigurations, secrets, licenses, and generates SBOMs
Integrates with CI/CD, GitHub Actions, Kubernetes operator, VS Code plugin
Available via binary, Docker, Homebrew, supporting all major OSes
Pros
- Broad coverage of assets and vulnerability types
- Fast, single‑pass scanning
- Easy installation through multiple distribution channels
- Active community with frequent updates
Considerations
- Canary builds may contain bugs and are not recommended for production
- Large scan outputs can be verbose
- Provides detection only; remediation guidance is external
- Initial vulnerability database download requires internet
Managed products teams compare with
When teams consider Trivy, these hosted platforms usually appear on the same shortlist.
Looking for a hosted option? These are the services engineering teams benchmark against before choosing open source.
Fit guide
Great for
- DevSecOps teams needing quick security feedback in CI pipelines
- Developers who want local scanning of code and containers
- Security auditors assessing infrastructure‑as‑code configurations
- Organizations adopting container and Kubernetes workloads
Not ideal when
- Environments that require fully offline scanning without any network access
- Teams needing built‑in remediation or policy enforcement beyond detection
- Projects that demand commercial support guarantees
- Use cases where a proprietary scanner with custom reporting is mandatory
How teams use it
CI pipeline vulnerability check
Automatically fails builds when new CVEs are found in container images
IaC misconfiguration audit
Identifies insecure Terraform or Kubernetes manifests before deployment
Secret leakage detection in codebase
Finds hard‑coded API keys and passwords in repositories
SBOM generation for compliance
Produces a software bill of materials to satisfy licensing and supply‑chain requirements
Tech snapshot
Go99%
Mustache1%
Smarty1%
Shell1%
Yacc1%
Dockerfile1%
Frequently asked questions
What types of assets can Trivy scan?
Container images, filesystems, remote Git repositories, virtual machine images, and Kubernetes clusters.
Which security issues does Trivy detect?
Known CVEs, infrastructure‑as‑code misconfigurations, embedded secrets, software licenses, and it can generate an SBOM.
How is Trivy installed?
Via Homebrew, Docker image, pre‑built binaries, or from source; see the Installation page.
Can Trivy be used in CI/CD?
Yes, it integrates with GitHub Actions, other CI systems, and provides exit codes for automated gating.
Are there any limitations for offline use?
Scanning works offline after the vulnerability database is cached, but initial database download and updates require internet.
Project at a glance
Active- Stars
- 31,040
- Watchers
- 31,040
- Forks
- 2,883
LicenseApache-2.0
Repo age6 years old
Last commityesterday
Primary languageGo
Last synced yesterday