Trivy in Action: DevSecOps Strategies for Container and Code Security

Overview

In today’s DevOps landscape, containers are the backbone of cloud-native infrastructure. With this shift comes the need for strong, automated security practices. Trivy, an open-source vulnerability scanner developed by Aqua Security, empowers DevSecOps teams to detect vulnerabilities across Docker containers, Kubernetes clusters, and infrastructure-as-code.

In this guide, we’ll explore Trivy’s core features, installation steps, use cases, and how to integrate it into CI/CD workflows.

Why Trivy?

Trivy is a fast, lightweight, and easy-to-use security scanner tailored for developers and DevOps professionals. Unlike traditional tools that require complex configuration, Trivy simplifies security scanning, aligning perfectly with “shift-left” security principles.

Key Advantages:

Multi-target scanning: Supports Docker images, file systems, Kubernetes clusters, and IaC (Terraform, Helm).
Comprehensive vulnerability sources: Uses NVD, GitHub Security Advisories, and proprietary feeds.
Performance optimization: Caches scan results for faster repeat scans.
Free & Open source: Ideal for teams of all sizes.

Getting Started with Trivy

Installation

macOS:

brew install aquasecurity/trivy/trivy

Linux/Windows:

Download the latest release from Trivy’s GitHub and follow the platform-specific instructions.

Quick Image Scan

trivy image nginx:latest

This command scans the nginx:latest image and outputs vulnerabilities, CVEs, severity levels, and suggested fixes.

Tips:

Focus on HIGH and CRITICAL vulnerabilities.
Use --ignore-unfixed to filter only patchable issues.

Kubernetes Cluster Scanning with Trivy

Trivy can also analyze Kubernetes clusters for vulnerabilities and misconfigurations.

Install Trivy Operator via Helm

Option 1: From Local Directory

helm install trivy-operator ./deploy/helm --namespace trivy-system --create-namespace

Option 2: From Aqua Helm Repository

helm repo add aqua https://aquasecurity.github.io/helm-charts/ helm repo update helm install trivy-operator aqua/trivy-operator \ --namespace trivy-system --create-namespace --version 0.25.0

Optional: Only show vulnerabilities with available patches:

--set="trivy.ignoreUnfixed=true"

Kubernetes Scan Examples

trivy k8s --report summary trivy k8s --kubeconfig ~/.kube/config2 trivy k8s --report summary --exclude-kinds node,pod trivy k8s --report summary --exclude-namespace dev-system

You can target vulnerabilities, secrets, and misconfigurations individually:

trivy k8s --scanners=secret --report=summary trivy k8s --scanners=misconfig --report=summary

Output formats: table (default) and json

trivy k8s --format json -o results.json cluster

CI/CD Integration: Automate Security in Your Pipeline

Trivy can be easily integrated into CI/CD platforms like GitHub Actions.

GitHub Actions Workflow Example:

- name: Run Trivy vulnerability scanner 
  uses: aquasecurity/trivy-action@v0.26.0
  with:
    image-ref: 'docker.io/my-org/my-app:${{ github.sha }}'
    format: 'table'
    exit-code: '1'
    ignore-unfixed: true
    scanners: 'vuln'
    vuln-type: 'os'
    severity: 'CRITICAL,HIGH'

Benefits:

Automates scanning for every build.
Blocks deployments with high-severity issues.
Keeps your supply chain secure.

Best Practices

Automate Regular Scans: Schedule scans for images, clusters, and IaC.
Combine with Other Tools: Use alongside SonarQube or Dependency Track.
Educate Your Team: Help teams interpret and act on scan results.
Keep It Updated: Regularly update Trivy and its databases.

Appointment Organizer

Book Now

Common Challenges & Solutions

Challenge	Recommended Approach
Too many vulnerabilities reported	Focus on HIGH/CRITICAL; use filtering options
False positives	Manually review or use --ignore-policy to refine scans

Conclusion

Trivy is a versatile and essential tool for embedding security into modern development workflows. From scanning Docker images to monitoring Kubernetes clusters, Trivy helps teams detect threats early and fix them fast.

At Ananta Cloud, we specialize in integrating security tools like Trivy into secure DevOps pipelines to shift the security left.

🔐 Secure your cloud-native infrastructure with expert support.

📞 Contact Ananta Cloud today for a free consultation.

SPEAK TO OUR SECURITY EXPERT