Trivy Cheat Sheet

Scan images, filesystems, Git repos, and Kubernetes clusters for vulnerabilities, misconfigurations, and secrets.

Security4 sections · 21 commands

⌘K

trivy image IMAGE

Scan an image for CVEs

trivy image --severity CRITICAL,HIGH IMAGE

Filter by severity

trivy image --ignore-unfixed IMAGE

Skip unfixed (no patch yet)

trivy image --format sarif --output out.sarif IMAGE

SARIF report (SIEM/CI)

trivy image --exit-code 1 --severity CRITICAL IMAGE

Fail the build on criticals

trivy image --scanners vuln,secret IMAGE

Enable multiple scanners

trivy image --platform linux/amd64 IMAGE

Scan a specific platform

trivy fs .

Scan the working directory

trivy fs --exclude-patterns 'node_modules/**' .

Skip noisy directories

trivy repo URL --scan-vuln

Scan a public Git repo

trivy config .

Check IaC/SECURITY misconfigs

trivy rootfs ROOT_DIR

Scan a root filesystem

trivy k8s cluster --report summary

Scan the whole cluster

trivy k8s --namespace NS

Scan one namespace

trivy image --scanners secret IMAGE

Find secrets in image layers

trivy sbom IMAGE

Generate a software bill of materials

trivy auth login REGISTRY

trivy image --cache-dir .cache IMAGE

Custom cache path

trivy image --no-progress IMAGE

Silent output for CI

trivy image --template @tmpl --format template IMAGE

Custom output template

trivy image --db-repository ghcr.io/aquasecurity/trivy-db IMAGE

Air-gapped DB mirror