What is Trivy?
- open-source security scanner tool developed by Aqua Security.
- Used for vulnerability scanning in such as
- container images
- file systems/folders
- Git repositories
- Kubernetes clusters
- Trivy helps identify security issues and misconfigurations early in the software development lifecycle.
How to scan a docker image using Trivy by integrating in Jenkins CICD pipeline
Pre-requisites:
- Jenkins up and running
- Docker install in Jenkins
Install Trivy scanner
Trivy scanner can be installed so many ways. Check here for more information. But we will using APT package manager to install on Ubuntu.
sudo apt-get install wget gnupg -y
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy -y
trivy --version
This confirm that Trivy got installed successfully.
Perform some scan locally:
trivy image nginx
Jenkins Pipeline for scanning docker images:
.png)
