Container Scanning with Trivy

When to use

Prerequisites

• Trivy installed (

  brew install trivy

  or

  apt install trivy

  )
• Verify:

  trivy --version

Instructions

1. Identify the target — Determine the container image or scan target.
2. Run the scan:
   Container image:
   bash

   trivy image --format json --output trivy-results.json <image>:<tag>

   Filesystem:
   bash

   trivy fs --format json --output trivy-results.json <path>

   IaC / Config:
   bash

   trivy config --format json --output trivy-results.json <path>

   • Severity filter:

     trivy image --severity HIGH,CRITICAL --format json <image>

   • Ignore unfixed:

     trivy image --ignore-unfixed --format json <image>

   • Scan for secrets too:

     trivy image --scanners vuln,secret --format json <image>

3. Parse the results — Read JSON output and present findings:

| # | Severity | CVE | Package | Installed | Fixed | Type (OS/library) | Title |
|---|----------|-----|---------|-----------|-------|--------------------|-------|

1. Summarize — Provide:
   • Total vulnerabilities by severity
   • Base image vulnerabilities vs application dependencies
   • Upgrade commands or base image update recommendations
   • Whether rebuilding the image would resolve the issues