Awesome Open Source
Awesome Open Source

Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

Targets (what Trivy can scan):

  • Container Image
  • Filesystem
  • Git Repository (remote)
  • Virtual Machine Image
  • Kubernetes
  • AWS

Scanners (what Trivy can find there):

  • OS packages and software dependencies in use (SBOM)
  • Known vulnerabilities (CVEs)
  • IaC issues and misconfigurations
  • Sensitive information and secrets
  • Software licenses

To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.

Quick Start

Get Trivy

Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:

Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:

General usage

trivy <target> [--scanners <scanner1,scanner2>] <subject>


trivy image python:3.4-alpine

trivy fs --scanners vuln,secret,config myproject/

trivy k8s --report summary cluster

k8s summary


How to pronounce the name "Trivy"?

tri is pronounced like trigger, vy is pronounced like envy.

Trivy is an Aqua Security open source project.
Learn about our open source work and portfolio here.
Contact us about any matter by opening a GitHub Discussion here

Alternatives To Trivy
Select To Compare

Alternative Project Comparisons
Related Awesome Lists
Top Programming Languages

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Golang (172,630
Docker (99,793
Security (32,286
Kubernetes (26,020
Vulnerabilities (15,323
Scanner (13,966
Continuous Integration (12,749
Security Tools (2,202
Infrastructure As Code (789
Vulnerability Scanner (585
Devsecops (534
Iac (480
Vulnerability Detection (273
Misconfigurations (18