Trivy

Scope

Trivy covers more ground than most scanners in a single binary: container image CVEs, Infrastructure-as-Code misconfiguration, hardcoded secrets, software licences, and SBOM generation in both CycloneDX and SPDX formats. That breadth is why it turns up as the default in most CI pipeline examples — one tool replaces three or four.

It runs as a single binary with no server component, which makes it trivial to add to a pipeline. trivy image myapp:latest works with no setup.

In a pipeline

The common pattern is scanning on build and failing on severity thresholds. Trivy supports exit codes by severity, so a pipeline can block on CRITICAL while letting MEDIUM through to a report. IaC scanning covers Terraform, CloudFormation, Kubernetes manifests and Helm charts against built-in policy.

Version v0.76.0 shipped in October 2026, and the project maintains a steady release cadence under Aqua Security's stewardship while staying Apache 2.0.

The noise problem

Breadth has a cost. Trivy reports what is in the vulnerability database without assessing whether your application reaches the vulnerable code path. A Node image can produce hundreds of findings, most of them in transitive dependencies of packages nothing calls.

This is a real operational issue rather than a nitpick. Teams that turn Trivy on and gate deploys on its output typically either drown or set the threshold so high the gate stops meaning anything. Making it useful takes .trivyignore curation, VEX documents to suppress assessed findings, and a decision about which severities actually block.

Trivy also has no runtime visibility — it reads artifacts, not running systems. Nothing it reports tells you whether a vulnerable package is loaded in production, and it cannot see an attack in progress. That needs a runtime tool alongside it.

Where it fits

As a build-time gate and SBOM generator, Trivy is hard to beat at the price. As a complete container security programme, it is one layer of several.

Making the output usable

Three settings do most of the work. --severity HIGH,CRITICAL cuts the report to findings worth a human's attention. --ignore-unfixed drops vulnerabilities with no available patch, which is a large share of base-image noise and nothing you can act on today. And --exit-code 1 on a chosen severity turns the scan into a gate rather than a report nobody reads.

A .trivyignore file holds accepted findings with a reason and ideally an expiry. Reviewing that file periodically is the difference between documented risk acceptance and a list of things quietly forgotten.

Pairing it with a smaller base image

The most effective change is usually upstream of the scanner. Moving from a full distribution base to a distroless or Wolfi-based image removes most of the packages generating findings, and the scan output drops from hundreds of CVEs to a handful. Tuning Trivy's flags manages the symptom; shrinking the image removes the cause, and the two together are what makes a scanning gate sustainable.