How to Scan Container Images, Code and IaC for Vulnerabilities With Trivy

Step by step

1. Install Trivy

   Use your package manager, or run it as a container without installing anything.

   brew install trivy
   # or
   docker run --rm aquasec/trivy:latest --version
   

2. Scan an image

   Trivy lists CVEs per package with severity and the fixed version.

   trivy image nginx:1.27
   

3. Show only what matters

   Filter to high and critical issues that already have a fix.

   trivy image --severity HIGH,CRITICAL --ignore-unfixed myapp:1.4.2
   

4. Scan your project folder

   Find vulnerable dependencies (npm, pip, Go, Java and more) and leaked secrets in the source tree.

   trivy fs --scanners vuln,secret,misconfig .
   

5. Scan infrastructure-as-code

   Trivy checks Terraform, Kubernetes manifests, Dockerfiles and Helm charts for risky settings such as public buckets or containers running as root.

   trivy config ./infra
   

6. Fail the build on critical issues

   In CI, a non-zero exit code stops the pipeline when critical vulnerabilities are found.

   trivy image --exit-code 1 --severity CRITICAL --ignore-unfixed myapp:${GIT_SHA}
   

7. Fix and rebuild

   Update the base image (smaller images such as distroless or alpine have fewer packages), upgrade dependencies, rebuild and re-scan.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.