Trivy

trivy Scans source and images for known vulnerabilities and gives each app a security score.

Settings

imageImageAdvanced

The Trivy image to run.

string · Default aquasec/trivy:0.74.0 (pinned)

hostDocker hostAdvanced

The Docker endpoint Trivy runs on.

string · Default DOCKER_HOST, or the local socket

timeout_secondsTimeoutAdvanced

Seconds a scan may take.

int · Default 600

db_repositoryVulnerability database repositoryAdvanced

OCI repositories to download Trivy's vulnerability database from, comma-separated, first tried first.

string · Default mirror.gcr.io/aquasec/trivy-db:2, ghcr.io/aquasecurity/trivy-db:2

java_db_repositoryJava database repositoryAdvanced

OCI repositories to download Trivy's Java database from, comma-separated, first tried first.

string · Default mirror.gcr.io/aquasec/trivy-java-db:1, ghcr.io/aquasecurity/trivy-java-db:1

checks_bundle_repositoryChecks bundle repositoryAdvanced

The OCI repository to download Trivy's misconfiguration checks from.

string · Default mirror.gcr.io/aquasec/trivy-checks:2

offline_scanOffline scanAdvanced

Stop Trivy asking package registries about dependencies; database downloads still happen.

bool · Default false