Container Image Scanning with Trivy

By Khimananda Oli | Last reviewed: August 2026

Shipping containers without verifying their contents is a security liability that no modern engineering team can afford. Container image scanning with Trivy provides a fast, open-source mechanism to identify OS package vulnerabilities, application dependencies, embedded secrets, and infrastructure-as-code misconfigurations before deployment. Whether you are securing a Laravel application or a complex microservices platform, integrating this scanner into your workflow is the first line of defense against supply chain attacks.

How does container image scanning with Trivy actually work?

Trivy operates as a standalone binary that unpacks container layers and indexes their contents against multiple upstream vulnerability databases, including NVD, Red Hat, Debian, and GitHub Advisory. Unlike older scanners that only checked OS packages, Trivy also parses language-specific lock files (like composer.lock, package-lock.json, or go.mod) to detect application-level dependencies. This dual-layer inspection is critical because a base image might be patched while the application layer contains a vulnerable library version.

The scanner maintains a local cache of these databases, typically stored in ~/.cache/trivy, which allows subsequent scans to run in seconds rather than minutes. For teams building Docker containers for Laravel applications, this means you can validate every build artifact locally before pushing to a registry. The tool also supports scanning filesystems directly, git repositories, and even running Kubernetes clusters, making it a versatile component in a broader CI/CD security strategy.

How do you install and configure Trivy for local development?

Installation is straightforward across all major platforms. On macOS, use Homebrew; on Linux, the official install script or package managers work reliably. Avoid downloading random binaries from unverified sources—always use the official Aqua Security release channels.

# macOS installation
brew install trivy

# Linux (Debian/Ubuntu) example
sudo apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update && sudo apt-get install trivy

# Verify installation and download DBs
trivy --version
trivy image --download-db-only

A common mistake in 2026 is ignoring the database update step in air-gapped or restricted network environments. If your development machines lack direct internet access, you must manually download the trivy-db.tgz and trivy-java-db.tgz artifacts and place them in the cache directory. Without current databases, the scanner will produce false negatives, giving you a dangerous sense of security.

Configuring severity thresholds and ignore policies

Not every vulnerability requires immediate action. Configure Trivy to focus on actionable findings by setting severity filters and using .trivyignore files for accepted risks. This prevents alert fatigue during development.

# Scan with severity filter and ignore file
trivy image \
  --severity HIGH,CRITICAL \
  --ignorefile .trivyignore \
  --format table \
  myapp:latest

# Example .trivyignore content
# CVE-2024-12345: Accepted risk until vendor patch Q3 2026
# CVE-2025-67890: Mitigated by WAF rule #442

Document every ignored CVE with a justification and expiration date. During SOC 2 or ISO 27001 audits, reviewers will examine these exceptions. An undocumented ignore file is a compliance finding itself.

How do you integrate Trivy into CI/CD pipelines effectively?

Local scanning catches issues early, but pipeline integration enforces standards consistently. The goal is to fail builds when critical vulnerabilities exist while allowing warnings to pass with visibility. This balance prevents security from becoming a blocker while maintaining accountability.

For GitHub Actions users, the official aquasecurity/trivy-action simplifies integration. GitLab CI and Jenkins have equivalent plugins or shell execution patterns. The key is outputting results in SARIF format for native platform integration and JSON for archival.

# GitHub Actions snippet
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:${{ github.sha }}'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'
    exit-code: '1'  # Fail pipeline on findings

- name: Upload Trivy scan results
  uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: 'trivy-results.sarif'

Set exit-code: '1' only for severities you genuinely intend to block. Starting with CRITICAL-only failures and expanding to HIGH after team buy-in prevents pipeline breakage from legacy debt. Track metrics over time: if your team consistently produces images with zero CRITICAL findings, tighten the threshold. Security maturity is incremental, not binary.

What types of security issues does Trivy detect beyond CVEs?

Vulnerability scanning is table stakes. Modern container image scanning with Trivy extends to three additional categories that often pose greater operational risk than known CVEs.

• Embedded secrets: API keys, private certificates, database passwords, and cloud provider tokens accidentally committed to image layers. Trivy uses regex patterns and entropy analysis to flag these. A single leaked AWS access key in a public image can compromise an entire account within minutes.
• IaC misconfigurations: When scanning Dockerfiles or Kubernetes manifests, Trivy checks for insecure defaults like running as root, missing resource limits, privileged containers, or writable root filesystems. These are policy violations, not vulnerabilities, but they expand your attack surface significantly.
• License compliance: Enterprise deployments must track open-source license obligations. Trivy identifies SPDX license identifiers in dependencies, helping legal teams assess GPL, AGPL, or proprietary license exposure before distribution.

For teams managing secrets with HashiCorp Vault, Trivy serves as a validation layer: if a secret appears in a scan, your injection mechanism failed. Treat every secret finding as a process defect, not just a cleanup task.

How does Trivy compare to other container security scanners?

Choosing a scanner depends on your team's constraints: budget, ecosystem integration, compliance requirements, and maintenance tolerance. No tool is universally superior.

In practice, many organizations run Trivy alongside a cloud-native scanner. Trivy catches issues pre-push in CI, while ECR or GCR scanning provides continuous monitoring of stored artifacts. This defense-in-depth approach aligns with AWS Well-Architected security pillars and similar frameworks. Grype is excellent for quick local checks but lacks IaC and secret coverage. Snyk offers superior developer experience and fix guidance but introduces vendor dependency and cost at scale.

Implementing Container Image Scanning with Trivy as a Sustainable Practice

Adopting container image scanning with Trivy is not a one-time setup—it is an ongoing engineering discipline. Start by integrating scans into your CI pipeline with CRITICAL-only blocking. Establish a weekly review cadence for HIGH-severity findings, assigning ownership and remediation timelines. Maintain your .trivyignore file as living documentation, not a graveyard of unaddressed risks. Automate database updates in air-gapped environments using scheduled jobs or artifact mirroring.

Security tooling only delivers value when teams trust and act on its output. False positives erode trust faster than any vulnerability exploits a system. Invest time tuning policies, documenting exceptions, and celebrating reductions in vulnerability counts. If your team needs help establishing a sustainable container security program or preparing for compliance audits, reach out to discuss your specific infrastructure challenges.