Personal Development Category (English)728x90

Detect vulnerabilities using Trivy scanner

Disclosure: This page uses affiliate links.When you click an affliate link,we get a small compensation at no cost to you.Thanks for your support!Learn more

Image – Trivy Logo

If you’re looking for a simple and comprehensive vulnerability scanner for your containers then Trivy is the best choice. In this post, we see how to scan a sample image & its key features.

Key Features :

  • Detect comprehensive vulnerabilities for most of the OS packages  like Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless and Application dependencies such as Bundler, Composer, Pipenv, Poetry, npm, yarn and Cargo
  • Scanning is quick (1st scan might complete in less than 10 secs) and simple to use, just enter the image name and get results
  • Suitable for CI pipelines such as Travis CI, CircleCI, Jenkins, GitLab CI, etc.
  • Supports multiple formats like local image, a remote image in docker registry, image saved as tar file or OCI image format. Filesystem and Remote git repository is also supported.

Here’s a comparison with other scanners

Scanner OS
Packages
Application
Dependencies
Easy to use Accuracy Suitable
for CI
Trivy
(5 languages)
⭐ ⭐ ⭐ ⭐ ⭐ ⭐ ⭐ ⭐ ⭐
Clair × ⭐ ⭐ ⭐ ⭐
Anchore Engine
(4 languages)
⭐ ⭐ ⭐ ⭐ ⭐ ⭐ ⭐
Quay × ⭐ ⭐ ⭐ ⭐ ⭐ ×
Docker Hub × ⭐ ⭐ ⭐ ×
GCR × ⭐ ⭐ ⭐ ⭐ ⭐ ×

 

In the next section, we take look at how to scan a sample image for vulnerabilities.

Step #1.Install Trivy

I’m using Ubuntu, following is the script will install Trivy for me. For other distros, please do check here.

$ sudo apt-get install wget apt-transport-https gnupg lsb-release
$ wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
$ echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
$ sudo apt-get update
$ sudo apt-get install trivy

 

Subscribe to Emails

More than 100,000 subscribers across the world trust & read Upnxtblog articles. Subscribe to emails updates!
* indicates required

Image – Trivy Installation

Image – Trivy Installation

Now that Trivy installation completed, Next step we can scan a sample image and check vulnerabilities.

Advertisement:
Devops Engineer Masters Program will make you proficient in DevOps principles like CI/CD, Continuous Monitoring and Continuous Delivery, using tools like Puppet, Nagios, Chef, Docker, Git & Jenkins. It includes training on Linux, Python, Docker, AWS DevOps Certification Training and Splunk. The curriculum has been determined by extensive research on 5000+ job descriptions across the globe.
New customer offer! Top courses from $13.99 when you first visit Udemy

Step #2.Detect vulnerabilities

Use trivy image [IMAGE_NAME] to initiate scanning and getting vulnerabilities here in this example I have used httpd image. As you can see there are a total of 332 vulnerabilities with varying severities.

Image – Trivy vulnerability scanner

Recover over 700 unique file formats. Fully recover documents, emails, photos, videos, audio files and more. Supports 8 different data lost scenarios: deleted files recovery, recycle bin recovery, formatted drive recovery, lost partition recovery, externa

You can also filter the vulnerabilities by severities with --severity option

Image – Trivy vulnerability scanner

To save the results as JSON,use -f and -o option

Image – Trivy vulnerability scanner

There are many options/examples, you can check out all of them here.

Like this post? Don’t forget to share it!

Additional Resources :

 

Summary
Detect vulnerabilities using Trivy scanner
Article Name
Detect vulnerabilities using Trivy scanner
Description
If you're looking for a simple and comprehensive vulnerability scanner for your containers then Trivy is the best choice.
Author
Publisher Name
Upnxtblog
Publisher Logo

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: