mrvitej.in

Archive · Docker

Scanning Images for Vulnerabilities with Trivy

Find known CVEs in an image before it is deployed, and fail the build on serious ones.

1 min read

  • Trivy 0.14
  • Docker Engine 20.10.2
  • alpine:3.13

Every image carries an operating system and libraries that may have known vulnerabilities. Trivy (Aqua Security, open source) scans an image in seconds.

# run without installing
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy:0.14.0 image myapp:1.0

# fail a CI job on serious findings
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:1.0

Reading the result: each row lists the library, the CVE, the installed version and the fixed version. Many findings are fixed by rebuilding on a newer base image, so scan regularly, not only once.

Reduce the exposure:

  • Start from a small base (alpine:3.13, or a distroless image).
  • Use multi-stage builds so compilers are not shipped.
  • Run as a non-root USER.
  • Pin versions and rebuild on a schedule.

Scanning is one layer; it does not replace patching running hosts or limiting what the container can reach.