Skip to main content
In this guide, you’ll discover how to use Trivy—a fast, easy-to-use vulnerability scanner for container images and other artifacts. Trivy inspects both operating system packages (Alpine, RHEL, CentOS, Debian, Distroless) and application dependencies (NPM, Cargo, NuGet, Go modules, Maven). We’ll demonstrate scanning a Maven-based Java application, but the commands apply to any supported language or OS.

​
Installation

You can install Trivy as a standalone binary or run it via Docker.

​
Standalone Binary

Download the latest release from the Trivy GitHub Releases page, then:
If you skip the vulnerability database update (--skip-update), you may miss newly disclosed CVEs.

​
Using Docker

Use the official Trivy image and mount a cache to speed up repeat scans:
Mounting ~/.cache ensures that vulnerability databases persist between runs, dramatically reducing scan time.

​
Scan Exit Codes

Control your CI/CD pipeline behavior by setting one of these exit codes:
  • --exit-code 0
    Always returns 0—even if vulnerabilities are found.
  • --exit-code 1
    Returns 1 when vulnerabilities meet or exceed your severity threshold.
Use the exit code strategy to fail builds when critical flaws are detected.

​
Output Formats

Trivy supports three formats: Example:

​
Listing All Packages

By default, Trivy only reports packages with known vulnerabilities. To list every package in the image:
This helps you understand the full software inventory, not just vulnerable components.

​
Common Options

​
Sample Report

Below is a sample Trivy table output, showing each vulnerability’s ID, severity, installed version, and fixed version when available:
The image shows a sample Trivy scan table report detailing vulnerabilities in various libraries, including their severity, installed versions, and fixed versions. It includes entries for libraries like jQuery, lodash, django, and rails-html-sanitizer.
Key columns:
  • Vulnerability ID (e.g., CVE-2021-1234)
  • Severity level
  • Installed version
  • Fixed version (if available)
When scanning a full image, Trivy aggregates OS-level and application dependency vulnerabilities in one report.
Now you’re ready to run your own vulnerability scans and integrate Trivy into your CI/CD pipeline. Happy scanning!

Watch Video