# trivy

> Security scanner that detects vulnerabilities, secrets, and misconfigurations in containers, filesystems, git repos, VMs, and Kubernetes

Stars: 38.9k · Language: Go · License: Apache-2.0 · Categories: Dev Tools

- Repository: https://github.com/aquasecurity/trivy
- Website: https://trivy.dev
- Page: https://www.trmn.sh/tools/trivy

## Install

- Homebrew: `brew install trivy`
- Docker: `docker run aquasec/trivy`

## Overview

Trivy is a security scanner that identifies vulnerabilities, secrets, and configuration issues across multiple target types including container images, filesystems, Git repositories, virtual machine images, and Kubernetes clusters. The tool combines multiple scanning capabilities in a single binary: vulnerability detection (CVEs), Infrastructure as Code (IaC) misconfiguration analysis, secret detection, software license identification, and Software Bill of Materials (SBOM) generation.

Trivy supports scanning OS packages and software dependencies across most popular programming languages and operating systems. It can be run as a standalone CLI tool with commands like `trivy image python:3.4-alpine` to scan container images or `trivy fs --scanners vuln,secret,misconfig myproject/` to analyze local filesystems with specific scanner combinations. For Kubernetes environments, commands like `trivy k8s --report summary cluster` provide cluster-wide security assessment.

The tool integrates with development workflows through GitHub Actions, Kubernetes operators, and VS Code extensions. It's available as a Docker container (`docker run aquasec/trivy`), system packages, and standalone binaries, making it suitable for both local development security checks and CI/CD pipeline integration. Security teams and developers can use Trivy for container security scanning, infrastructure auditing, and compliance validation across their deployment pipeline.

### Installation

```bash
# via Homebrew
brew install trivy
```

```bash
# via Docker
docker run aquasec/trivy
```

![Kubernetes cluster security scan summary](https://media.trmn.sh/cached/56d976fa5534c8f08a1faff70bbf5cd2020834e15f914d19dbe2887b11454eb7.png)

## Alternatives

- [k9s](https://www.trmn.sh/tools/k9s.md): Terminal UI for managing and observing Kubernetes clusters with real-time monitoring and resource navigation (Go, 34.9k stars)
- [k6](https://www.trmn.sh/tools/k6.md): JavaScript-based load testing tool for developers with HTTP, WebSockets, gRPC support and CI integration (Go, 32.1k stars)
- [TruffleHog](https://www.trmn.sh/tools/trufflehog.md): Secrets scanner that finds credentials in Git, filesystems, S3/GCS buckets and Docker images, classifies 800+ types, and verifies whether they are live. (Go, 28.8k stars)
- [Terraform](https://www.trmn.sh/tools/terraform.md): Infrastructure-as-code CLI that builds, changes, and versions infrastructure from declarative configuration files, using execution plans and a resource graph. (Go, 50.3k stars)
- [asdf](https://www.trmn.sh/tools/asdf.md): Version manager that handles multiple language runtimes per project through plugins, using a single CLI and a .tool-versions file. (Go, 25.6k stars)

## Guides

- [Find leaked secrets in a git repo with gitleaks](https://www.trmn.sh/guides/scan-repo-for-secrets-gitleaks): Scan git history and working files for API keys and tokens with gitleaks, allowlist false positives, add a pre-commit hook and run it in CI.
- [Best CLI Secret Scanners](https://www.trmn.sh/best/secret-scanners): Compare gitleaks, TruffleHog, trivy: workflows, strengths and tradeoffs.

---

Canonical: https://www.trmn.sh/tools/trivy