trivy-scan

Scan container images, filesystems, and dependencies for vulnerabilities.

What To Do

1. Install: choco install trivy or brew install trivy

2. Scan container image:

   trivy image --severity HIGH,CRITICAL --format json -o trivy-report.json myapp:latest
   

3. Scan filesystem (NuGet/npm):

   trivy fs --severity HIGH,CRITICAL --scanners vuln .
   

4. Scan IaC (Terraform, Helm, Dockerfile):

   trivy config --severity HIGH,CRITICAL .
   

5. CI Integration:

   - script: trivy image --exit-code 1 --severity CRITICAL $(ACR_NAME).azurecr.io/$(IMAGE):$(TAG)
     displayName: "Container Scan"
   

Arguments

• <image-or-path>: Container image or filesystem path
• --severity=<levels>: Filter (LOW, MEDIUM, HIGH, CRITICAL)