Docker

Detect vulnerabilities using Trivy scanner

Image – Trivy Logo

If you’re looking for a simple and comprehensive vulnerability scanner for your containers then Trivy is the best choice. In this post, we see how to scan a sample image & its key features.

Key Features :

  • Detect comprehensive vulnerabilities for most of the OS packages  like Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless and Application dependencies such as Bundler, Composer, Pipenv, Poetry, npm, yarn and Cargo
  • Scanning is quick (1st scan might complete in less than 10 secs) and simple to use, just enter the image name and get results
  • Suitable for CI pipelines such as Travis CI, CircleCI, Jenkins, GitLab CI, etc.
  • Supports multiple formats like local image, a remote image in docker registry, image saved as tar file or OCI image format. Filesystem and Remote git repository is also supported.

Here’s a comparison with other scanners

Scanner OS
Packages
Application
Dependencies
Easy to use Accuracy Suitable
for CI
Trivy
(5 languages)
⭐ ⭐ ⭐ ⭐ ⭐ ⭐ ⭐ ⭐ ⭐
Clair × ⭐ ⭐ ⭐ ⭐
Anchore Engine
(4 languages)
⭐ ⭐ ⭐ ⭐ ⭐ ⭐ ⭐
Quay × ⭐ ⭐ ⭐ ⭐ ⭐ ×
Docker Hub × ⭐ ⭐ ⭐ ×
GCR × ⭐ ⭐ ⭐ ⭐ ⭐ ×

 

In the next section, we take look at how to scan a sample image for vulnerabilities.

Step #1.Install Trivy

I’m using Ubuntu, following is the script will install Trivy for me. For other distros, please do check here.

$ sudo apt-get install wget apt-transport-https gnupg lsb-release
$ wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
$ echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
$ sudo apt-get update
$ sudo apt-get install trivy

 

Image – Trivy Installation
Image – Trivy Installation

Now that Trivy installation completed, Next step we can scan a sample image and check vulnerabilities.

Step #2.Detect vulnerabilities

Use trivy image [IMAGE_NAME] to initiate scanning and getting vulnerabilities here in this example I have used httpd image. As you can see there are a total of 332 vulnerabilities with varying severities.

Image – Trivy vulnerability scanner

You can also filter the vulnerabilities by severities with --severity option

Image – Trivy vulnerability scanner

To save the results as JSON,use -f and -o option

Image – Trivy vulnerability scanner

There are many options/examples, you can check out all of them here.

Like this post? Don’t forget to share it!

Additional Resources :

 

Summary
Detect vulnerabilities using Trivy scanner
Article Name
Detect vulnerabilities using Trivy scanner
Description
If you're looking for a simple and comprehensive vulnerability scanner for your containers then Trivy is the best choice.
Author
Publisher Name
Upnxtblog
Publisher Logo

Average Rating

5 Star
0%
4 Star
0%
3 Star
0%
2 Star
0%
1 Star
0%

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Previous post Is AI Going to Benefit HR in the Future?
Next post What Are 5 D’s Of Digital Marketing?