trivy

Verified against the Trivy CLI reference. Current release is v0.74.0.

Commands

Scan an image, and only report what you can act on:

trivy image --severity HIGH,CRITICAL --ignore-unfixed IMAGE

Fail a pipeline on findings:

trivy image --severity CRITICAL --exit-code 1 IMAGE

Scan the working tree, including dependency manifests:

trivy fs .

Scan infrastructure as code, which is off by default:

trivy config .
trivy fs --scanners misconfig,secret .

Produce a software bill of materials:

trivy image --format cyclonedx -o sbom.json IMAGE
trivy image --format spdx-json -o sbom.spdx.json IMAGE

Output for a code scanning dashboard:

trivy image --format sarif -o results.sarif IMAGE

Notes

--scanners defaults to vuln,secret. Misconfiguration and licence scanning only run when you ask, so a clean trivy image says nothing about your Dockerfile or your Kubernetes manifests.

--ignore-unfixed hides vulnerabilities with no released fix. It makes a report actionable and it also hides real exposure, so it belongs in a pipeline gate rather than in an audit.

--exit-code 1 on its own still exits 0 when the scan itself fails to run. Check that the command succeeded as well as that it found nothing.

Valid --format values are table, json, template, sarif, cyclonedx, spdx, spdx-json, github and cosign-vuln.

Links

• Trivy docs
• trivy image reference